windows token isper microsoft"an object that describes the security context of process or thread "[ how token is initialized and which permissions and privileges are set on token determine which tasks that process or thread can perform well-intentioned developer might have system tray application as part of security productwhich they' like to give the ability for nonprivileged user to control the main windows servicewhich is driver the developer uses the native windows api function adjusttokenprivileges on the process and innocently enough grants the system tray application the seloaddriver privilege what the developer is not thinking about is the fact that if you can climb inside that system tray applicationyou too now have the ability to load or unload any driver you wantwhich means you can drop kernel mode rootkit -and that means game over bear in mindif you can' run your process monitor as system or an administrative userthen you need to keep an eye on what processes you are able to monitorand see if there are any additional privileges you can leverage process running as your user with the wrong privileges is fantastic way to get to system or run code in the kernel interesting privileges that always look out for are listed in table - it isn' exhaustivebut serves as good starting point [ table - interesting privileges privilege name access that is granted sebackupprivilege this enables the user process to back up files and directoriesand grants read access to files no matter what their acl defines sedebugprivilege this enables the user process to debug other processes this also includes obtaining process handles to inject dlls or code into running processes seloaddriver this enables user process to load or unload drivers now that we have the fundamentals of what privileges are and which privileges to look forlet' leverage python to automatically retrieve the enabled privileges on the processes we're monitoring we'll make use of the win securitywin apiand win con modules if you encounter situation where you can' load these modulesall of the following functions can be translated into native calls using the ctypes libraryit' just lot more work add the following code to process_monitor py directly above our existing log_to_file functiondef get_process_privileges(pid)tryobtain handle to the target process hproc win api openprocess(win con process_query_ information,false,pidopen the main process token htok win security openprocesstoken(hproc,win con token_queryretrieve the list of privileges enabled privs win security gettokeninformation(htokwin security tokenprivilegesiterate over privileges and output the ones that are enabled priv_list "for in privscheck if the privilege is enabled