Handle Tables & Object Manager

Objective:
Understand the role and internals of the Windows Object Manager, the structure and purpose of handle tables, kernel object creation and management, object security, and impersonation techniques. This knowledge is critical for reverse engineering, system analysis, kernel exploitation, and detection of privilege escalation and persistence techniques.

Introduction

Windows internally uses objects to represent resources—files, processes, threads, events, mutexes, semaphores, and more. The Object Manager is a kernel subsystem responsible for creating, managing, securing, and destroying these objects.

Each process maintains a private Handle Table, mapping numeric handles to kernel objects. Accessing these kernel objects securely and efficiently through handles is fundamental for Windows’ stability and security.

Windows Object Manager Overview

The Object Manager (ntoskrnl.exe) manages:

• Creation and deletion of kernel objects.
• Object namespace management (hierarchical paths).
• Security via Access Control Lists (ACLs).
• Reference counting and lifetime management.

Common Kernel Objects

Object Namespace

Kernel objects are structured hierarchically, similar to a file system:

Example paths:

\Device\HarddiskVolume1
\BaseNamedObjects\GlobalEvent

Use tools like WinObj (Sysinternals) to browse the object namespace.

Object Structures and Headers

Every object in kernel mode has a common header (OBJECT_HEADER) with metadata:

typedef struct _OBJECT_HEADER {
  LONG_PTR PointerCount;       // Number of active pointers
  LONG_PTR HandleCount;        // Active handle count
  PVOID    ObjectType;         // Pointer to OBJECT_TYPE structure
  PVOID    SecurityDescriptor; // ACL for the object
  UNICODE_STRING Name;         // Object name
  // ...
} OBJECT_HEADER;

This header precedes the actual object in memory.

Handle Tables

A Handle is an integer value referencing an object entry in a process-specific handle table.

• Each process has its own handle table.
• Maps handle values (integers) to pointers to kernel-mode objects.

Handle Table Entry (HANDLE_TABLE_ENTRY):

typedef struct _HANDLE_TABLE_ENTRY {
  union {
    PVOID Object;             // Pointer to actual object
    ULONG_PTR Attributes;
  };
  ACCESS_MASK GrantedAccess;  // Permissions for the handle
} HANDLE_TABLE_ENTRY;

Handle Tables allow controlled, indirect access to kernel objects.

Working with Handles (APIs)

Common APIs for working with handles:

Example (C++):

HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
CloseHandle(hProc);

NtQuerySystemInformation

A native NT API function that provides extensive system information.

NTSTATUS NtQuerySystemInformation(
  SYSTEM_INFORMATION_CLASS SystemInformationClass,
  PVOID                    SystemInformation,
  ULONG                    SystemInformationLength,
  PULONG                   ReturnLength
);

Common use:

• Query process lists (SystemProcessInformation)
• Handle information (SystemHandleInformation)

Example: Enumerating Handles

NtQuerySystemInformation(SystemHandleInformation, buffer, bufferSize, &returnedSize);

Enumerating Handles via PowerShell:

Get-Process | ForEach-Object {
  $_ | Select-Object -ExpandProperty Handles
}

Object Security & ACLs

Kernel objects include a Security Descriptor (SD):

• Owner SID
• Group SID
• DACL (Discretionary ACL): who has access
• SACL (System ACL): audit events on access

Example: Changing ACL via WinAPI:

SetSecurityInfo(hFile, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, NULL, NULL, pNewDacl, NULL);

Audit ACLs with:

Get-Acl '\\.\pipe\mypipe'

Object Reference Counting

Objects have two counters:

• Handle Count: Number of handles referencing it.
• Pointer Count: Direct kernel pointers referencing it.

When both reach zero, the object is destroyed automatically.

Kernel Objects and Impersonation

Windows supports Security Impersonation, allowing threads to execute with another user’s security context (token).

Impersonation Levels:

• Anonymous: No identification.
• Identification: Identity check only.
• Impersonation: Access local resources as the impersonated user.
• Delegation: Access remote resources as impersonated user.

Impersonation APIs:

• ImpersonateLoggedOnUser
• ImpersonateNamedPipeClient
• SetThreadToken

Example Impersonation:

LogonUser(user, domain, pass, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, &hToken);
ImpersonateLoggedOnUser(hToken);
// Thread now has user privileges

Attackers exploit impersonation by stealing tokens from privileged processes (Token stealing via handle duplication).

Handle Duplication for Privilege Escalation

Attackers commonly duplicate high-privilege handles:

Example exploitation flow:

1. Open a privileged process handle (OpenProcess).
2. Duplicate its token (DuplicateHandle).
3. Assign the duplicated token to the current process (SetThreadToken or SetTokenInformation).

Detection via Sysmon (Event ID 10 – ProcessAccess).

Common Attacker Techniques

Defensive Strategies & Detection

Sysmon (Process Access Monitoring):

• Track unusual handle duplications:

Sysmon Event ID 10: PROCESS_ACCESS

Handle & Object Auditing:

• Use Process Hacker or Process Monitor.
• Enumerate handles periodically for anomalies.

Object ACL Hardening:

• Reduce unnecessary write permissions.
• Regularly audit ACLs on critical named objects.

Tools for Handle & Object Analysis

Example handle enumeration (handle.exe):

handle.exe -p 1234

Summary

• Windows Object Manager controls lifecycle, security, and naming of kernel objects.
• Each process has a handle table, mapping handles to kernel objects securely.
• NtQuerySystemInformation provides detailed handle and object insights.
• Impersonation techniques allow threads to execute with alternative user privileges.
• Attackers leverage handle duplication and impersonation for privilege escalation.
• Defensive controls include Sysmon monitoring, ACL auditing, and continuous handle enumeration.

0 0 votes

Article Rating

Label

Name*

Email*

Website

Label

Name*

Email*

Website

0 Comments

Oldest

Newest Most Voted

Inline Feedbacks

View all comments