←

Processes

  • process can be though of as a container to hold the resources of a running program
  • CreateProcessW : API that creates a process that will have the aame access token as the called
  • CreateProcessAsUserW : API that creates a process using alt access token
  • CreateProcessWithLogonW : API that can create a process using a user's plaintext credentials
  • Each of the above APIs calls into the NtCreateUserProcess kernel function

Threads

  • a type of object that Windows schedules for execution within a process
  • holds the state of the CPU, including its registers; and a call stack, which is the set of CPU instructions to execute
  • API:
    • CreateThread
    • CreateRemoteThread : creates new thread in another process
    • Both of the above APIs calls into CreateRemoteThreadEx which then calls NtCreateThreadEx kernel function

Memory

  • Memory management is performed on distinct chunks, called pages
  • pages can be small (4KB) or large (2MB)
  • API:
    • Virtual: lower-level and include VirtualAlloc, VirtualFree, VirtualProtect
    • Heap: HeapAlloc, HeapReAlloc, HeapFree. Used to manage memory allocations smaller than a page
    • Memory-mapping: CreateFileMappingA, OpenFileMappingA, MapViewOfFile. Used to map memory from disk and share mappings across processes

Access Tokens

  • primary access token is given to a process when spawned
  • threads dont have specific access token assigned to them by default
  • thread can impersonate access token of another user and the work performed by that thread will be under the security context of that impersonated user
  • Every object in Windows has a Discretionary Access Control List (DACL) which specifies who has access to what object

Privileges

  • SeDebugPrivilege : obtain read/write handles to any process, even those owned by other users or SYSTEM.
  • SeTakeOwnershipPrivilege : take ownership of any securable object including files, handles, and threads.
  • SeRestorePrivilege : replace any file system
  • SeLoadDriverPrivilege : load a device driver into kernel
  • SeCreateTokenPrivilege : create arbitrary access tokens to impersonate any user with any privilege and any domain group membership.

Termination

  • ExitProcess is called by a program to terminate itself = graceful termination
  • TerminateProcess is called to terminate another process = ungraceful termination