Add meterp message to send impersonation token back

c/meterpreter/source/common/common_command_ids.h

@@ -116,6 +116,7 @@
 #define COMMAND_ID_STDAPI_SYS_CONFIG_STEAL_TOKEN 1058
 #define COMMAND_ID_STDAPI_SYS_CONFIG_SYSINFO 1059
 #define COMMAND_ID_STDAPI_SYS_CONFIG_UPDATE_TOKEN 1120
+#define COMMAND_ID_STDAPI_SYS_CONFIG_GET_TOKEN_HANDLE 1121
 #define COMMAND_ID_STDAPI_SYS_EVENTLOG_CLEAR 1060
 #define COMMAND_ID_STDAPI_SYS_EVENTLOG_CLOSE 1061
 #define COMMAND_ID_STDAPI_SYS_EVENTLOG_NUMRECORDS 1062

c/meterpreter/source/extensions/stdapi/server/stdapi.c

@@ -114,6 +114,7 @@ Command customCommands[] =
 	COMMAND_REQ(COMMAND_ID_STDAPI_SYS_CONFIG_DROP_TOKEN, request_sys_config_drop_token),
 	COMMAND_REQ(COMMAND_ID_STDAPI_SYS_CONFIG_GETSID, request_sys_config_getsid),
 	COMMAND_REQ(COMMAND_ID_STDAPI_SYS_CONFIG_UPDATE_TOKEN, request_sys_config_update_token),
+	COMMAND_REQ(COMMAND_ID_STDAPI_SYS_CONFIG_GET_TOKEN_HANDLE, request_sys_config_get_token_handle),
 
 	// Net
 	COMMAND_REQ(COMMAND_ID_STDAPI_NET_CONFIG_GET_ROUTES, request_net_config_get_routes),

c/meterpreter/source/extensions/stdapi/server/sys/config/config.c

@@ -314,6 +314,30 @@ DWORD request_sys_config_update_token(Remote* pRemote, Packet* pPacket)
 	return dwResult;
 }
 
+/*
+ * @brief Get the current thread impersonation token, or empty if no impersonation is present.
+ * @param pRemote Pointer to the \c Remote instance.
+ * @param pRequest Pointer to the \c Request packet.
+ * @returns Indication of success or failure.
+ */
+DWORD request_sys_config_get_token_handle(Remote* pRemote, Packet* pPacket)
+{
+	Packet* pResponse = met_api->packet.create_response(pPacket);
+	DWORD dwResult = ERROR_SUCCESS;
+	HANDLE hToken = NULL;
+
+	if (pRemote->thread_token != pRemote->server_token)
+	{
+		hToken = pRemote->thread_token;
+	}
+	dprintf("[GET-TOKEN] Got Token %x", hToken);
+	met_api->packet.add_tlv_qword(pResponse, TLV_TYPE_HANDLE, (QWORD)hToken);
+
+	met_api->packet.transmit_response(dwResult, pRemote, pResponse);
+
+	return dwResult;
+}
+
 /*
  * sys_getprivs
  * ----------

c/meterpreter/source/extensions/stdapi/server/sys/config/config.h

@@ -12,5 +12,6 @@ DWORD request_sys_config_steal_token(Remote *remote, Packet *packet);
 DWORD request_sys_config_drop_token(Remote *remote, Packet *packet);
 DWORD request_sys_config_driver_list(Remote *remote, Packet *packet);
 DWORD request_sys_config_update_token(Remote* pRemote, Packet* pPacket);
+DWORD request_sys_config_get_token_handle(Remote* pRemote, Packet* pPacket);
 
 #endif

c/meterpreter/source/metsrv/core.c

@@ -29,7 +29,7 @@ typedef struct _PacketCompletionRoutineEntry
 PacketCompletionRoutineEntry *packetCompletionRoutineList = NULL;
 
 /*!
- * @todo I have no idea why this is here, need someone else to explain.
+ * @brief Keep track of the current impersonation token
  */
 HANDLE core_update_thread_token(Remote *remote, HANDLE token)
 {