clymb3r/PowerShell

Does this work inside Windows containers?

Closed this issue · 0 comments

Trying to impersonate withing WindowsServerCore container

c34d2b1cabb2...]: PS C:\Users\ContainerAdministrator\Documents> Invoke-TokenManipulation -ImpersonateUser -Username "nt authority\system"
The property 'Id' cannot be found on this object. Verify that the property exists.
At C:\Users\ContainerAdministrator\AppData\Local\Temp\token.ps1:1689 char:9
+         $systemTokenInfo = Get-PrimaryToken -ProcessId (Get-Process w ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], PropertyNotFoundException
    + FullyQualifiedErrorId : PropertyNotFoundStrict
 
WARNING: Unable to impersonate SYSTEM, the script will not be able to enumerate all tokens
WARNING: Failed to get processes primary token. ProcessId: 6660. ProcessName CExecSvc. Error: 5
WARNING: Failed to get processes primary token. ProcessId: 6404. ProcessName lsass. Error: 5
WARNING: Failed to get processes primary token. ProcessId: 7924. ProcessName msdtc. Error: 5
WARNING: Failed to get processes primary token. ProcessId: 372. ProcessName svchost. Error: 5
WARNING: Failed to get processes primary token. ProcessId: 1948. ProcessName svchost. Error: 5
WARNING: Failed to get processes primary token. ProcessId: 2244. ProcessName svchost. Error: 5
WARNING: Failed to get processes primary token. ProcessId: 2844. ProcessName svchost. Error: 5
WARNING: Failed to get processes primary token. ProcessId: 3688. ProcessName svchost. Error: 5
WARNING: Failed to get processes primary token. ProcessId: 5168. ProcessName svchost. Error: 5
WARNING: Failed to get processes primary token. ProcessId: 5264. ProcessName svchost. Error: 5
WARNING: Failed to get processes primary token. ProcessId: 5460. ProcessName svchost. Error: 5
WARNING: Failed to get processes primary token. ProcessId: 6124. ProcessName svchost. Error: 5
WARNING: Failed to get processes primary token. ProcessId: 6520. ProcessName svchost. Error: 5
WARNING: Failed to get processes primary token. ProcessId: 7020. ProcessName svchost. Error: 5
WARNING: Failed to get processes primary token. ProcessId: 4712. ProcessName WmiPrvSE. Error: 5
A token belonging to the specified username was not found. Username: nt authority\system
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Main