Using Exploits
In the previous sections, we attempted to elevate our privileges
by searching for sensitive information on a system
or abusing Windows components
such as Windows services or scheduled tasks.
In this section, we’ll discuss three different kinds of exploits
leading to privilege escalation
and then show one of them in an example.
The first kind is to exploit application-based vulnerabilities.
Installed applications on a Windows system
may contain different types of vulnerabilities
as we learned in the “Locating Public Exploits” Topic.
If these applications run with administrative permissions
and we can exploit a vulnerability that leads to code execution,
we can also successfully elevate our privileges.
The second kind is to exploit vulnerabilities in the Windows Kernel.
However, the vulnerability research and related exploit techniques are,
in most cases, quite advanced and require an in-depth understanding
of the Windows operating system.
For the purposes of this Topic, it is enough to understand
that Windows kernel exploits exist and can be used for privilege escalation.
Before we blindly download and use a kernel exploit,
we need to consider that these types of exploits can easily crash a system.
Depending on the rules of engagement of a penetration test,
we may not be allowed to use methods
that will potentially disrupt services or systems.
Therefore, we should always have a clear understanding of our limitations,
exclusions, and boundaries in a real-life assessment.
These words of caution should not lead us to abstain from all kernel exploits,
but provide us with the correct mindset when working with them.
The last kind is to abuse certain Windows privileges.
Non-privileged users with assigned privileges,
such as SeImpersonatePrivilege,
can potentially abuse those privileges to perform privilege escalation attacks.
SeImpersonatePrivilege offers the possibility
to leverage a token with another security context,
meaning that a user with this privilege
can perform operations in the security context of another user account
under the right circumstances.
By default, Windows assigns this privilege
to members of the local Administrators group
as well as the device’s LOCAL SERVICE,
NETWORK SERVICE, and SERVICE accounts.
Microsoft implemented this privilege to prevent unauthorized users
from creating a service or server application
to impersonating clients connecting to it.
An example would be Remote Procedure Calls (RPC) or named pipes.
In penetration tests,
we’ll rarely find standard users with this privilege assigned.
However, we’ll commonly come across this privilege
when we obtain code execution on a Windows system
by exploiting a vulnerability in an Internet Information Service
(IIS) web server.
In most configurations, IIS will run as LocalService,
LocalSystem, NetworkService, or ApplicationPoolIdentity,
which all have SeImpersonatePrivilege assigned.
This also applies to other Windows services.
Before we head into the example, let’s discuss named pipes
and how we can use them in the context of SeImpersonatePrivilege
to impersonate a privileged user account.
Named pipes are one method for local
or remote Inter-Process Communication in Windows.
They offer the functionality of two unrelated processes
sharing and transferring data with each other.
A named pipe server can create a named pipe
to which a named pipe client can connect via the specified name.
The server and client don’t need to reside on the same system.
Once a client connects to a named pipe,
the server can leverage SeImpersonatePrivilege
to impersonate this client after capturing
the authentication from the connection process.
To abuse this, we need to find a privileged process
and coerce it into connecting to a controlled named pipe.
With SeImpersonatePrivilege assigned,
we can then impersonate the user account connecting to the named pipe
and perform operations in its security context.
For this example, we’ll use a tool named PrintSpoofer,
which implements a variation of the printer bug
to coerce NT AUTHORITY\SYSTEM
into connecting to a controlled named pipe.
We can use this tool in situations where we have code execution
as a user with the SeImpersonatePrivilege privilege
to execute commands or obtain an interactive shell
as NT AUTHORITY\SYSTEM.
Let’s begin by connecting to the bind shell on port 4444 on CLIENTWK220
as we did in the previous sections.
We’ll use whoami /priv to display the assigned privileges for dave.
User_dave_ has the SeImpersonatePrivilege privilege assigned.
Therefore, we can attempt to elevate our privileges by using PrintSpoofer.
Let’s switch to another terminal tab on Kali,
download the 64-bit version of this tool,
and serve it with a Python3 web server.
In the terminal tab with the active bind shell,
we’ll start a PowerShell session
and use iwr to download PrintSpoofer64.exe
from our Kali machine.
To obtain an interactive PowerShell session
in the context of NT AUTHORITY\SYSTEM
with PrintSpoofer64.exe,
we’ll enter powershell.exe as argument for -c
to specify the command we want to execute,
and -i to interact with the process in the current command prompt.
We successfully performed the privilege escalation attack using PrintSpoofer,
leading us to an interactive PowerShell session
in the context of the NT AUTHORITY\SYSTEM user account.
Excellent!
While PrintSpoofer provided us a straightforward
exploit process to elevate our privileges,
there are also other tools that can abuse
SeImpersonatePrivilege for privilege escalation.
Variants from the Potato family,
for example RottenPotato, SweetPotato,
or JuicyPotato, are such tools.
We should take the time to study these tools
as they are an effective alternative to PrintSpoofer.
Let’s briefly summarize what we did in this section.
First, we explored different kinds of vulnerabilities
we can abuse using exploits in the context of privilege escalation.
Then, we discussed the SeImpersonatePrivilege privilege
and how we can use it to impersonate privileged accounts.
Finally, we used a tool named PrintSpoofer to leverage this privilege
to obtain an interactive PowerShell session as NT AUTHORITY\SYSTEM.