mirror of
https://github.com/carlospolop/hacktricks
synced 2024-12-21 18:43:29 +00:00
218 lines
20 KiB
Markdown
218 lines
20 KiB
Markdown
|
# Abusing Tokens
|
||
|
|
|
||
|
|
{% hint style="success" %}
|
||
|
|
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||
|
|
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||
|
|
|
||
|
|
<details>
|
||
|
|
|
||
|
|
<summary>Support HackTricks</summary>
|
||
|
|
|
||
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
|
|
||
|
|
</details>
|
||
|
|
{% endhint %}
|
||
|
|
|
||
|
|
## Tokens
|
||
|
|
|
||
|
|
If you **don't know what are Windows Access Tokens** read this page before continuing:
|
||
|
|
|
||
|
|
{% content-ref url="../access-tokens.md" %}
|
||
|
|
[access-tokens.md](../access-tokens.md)
|
||
|
|
{% endcontent-ref %}
|
||
|
|
|
||
|
|
**Maybe you could be able to escalate privileges abusing the tokens you already have**
|
||
|
|
|
||
|
|
### SeImpersonatePrivilege
|
||
|
|
|
||
|
|
This is privilege that is held by any process allows the impersonation (but not creation) of any token, given that a handle to it can be obtained. A privileged token can be acquired from a Windows service (DCOM) by inducing it to perform NTLM authentication against an exploit, subsequently enabling the execution of a process with SYSTEM privileges. This vulnerability can be exploited using various tools, such as [juicy-potato](https://github.com/ohpe/juicy-potato), [RogueWinRM](https://github.com/antonioCoco/RogueWinRM) (which requires winrm to be disabled), [SweetPotato](https://github.com/CCob/SweetPotato), [EfsPotato](https://github.com/zcgonvh/EfsPotato), [DCOMPotato](https://github.com/zcgonvh/DCOMPotato) and [PrintSpoofer](https://github.com/itm4n/PrintSpoofer).
|
||
|
|
|
||
|
|
{% content-ref url="../roguepotato-and-printspoofer.md" %}
|
||
|
|
[roguepotato-and-printspoofer.md](../roguepotato-and-printspoofer.md)
|
||
|
|
{% endcontent-ref %}
|
||
|
|
|
||
|
|
{% content-ref url="../juicypotato.md" %}
|
||
|
|
[juicypotato.md](../juicypotato.md)
|
||
|
|
{% endcontent-ref %}
|
||
|
|
|
||
|
|
### SeAssignPrimaryPrivilege
|
||
|
|
|
||
|
|
It is very similar to **SeImpersonatePrivilege**, it will use the **same method** to get a privileged token.\
|
||
|
|
Then, this privilege allows **to assign a primary token** to a new/suspended process. With the privileged impersonation token you can derivate a primary token (DuplicateTokenEx).\
|
||
|
|
With the token, you can create a **new process** with 'CreateProcessAsUser' or create a process suspended and **set the token** (in general, you cannot modify the primary token of a running process).
|
||
|
|
|
||
|
|
### SeTcbPrivilege
|
||
|
|
|
||
|
|
If you have enabled this token you can use **KERB\_S4U\_LOGON** to get an **impersonation token** for any other user without knowing the credentials, **add an arbitrary group** (admins) to the token, set the **integrity level** of the token to "**medium**", and assign this token to the **current thread** (SetThreadToken).
|
||
|
|
|
||
|
|
### SeBackupPrivilege
|
||
|
|
|
||
|
|
The system is caused to **grant all read access** control to any file (limited to read operations) by this privilege. It is utilized for **reading the password hashes of local Administrator** accounts from the registry, following which, tools like "**psexec**" or "**wmiexec**" can be used with the hash (Pass-the-Hash technique). However, this technique fails under two conditions: when the Local Administrator account is disabled, or when a policy is in place that removes administrative rights from Local Administrators connecting remotely.\
|
||
|
|
You can **abuse this privilege** with:
|
||
|
|
|
||
|
|
* [https://github.com/Hackplayers/PsCabesha-tools/blob/master/Privesc/Acl-FullControl.ps1](https://github.com/Hackplayers/PsCabesha-tools/blob/master/Privesc/Acl-FullControl.ps1)
|
||
|
|
* [https://github.com/giuliano108/SeBackupPrivilege/tree/master/SeBackupPrivilegeCmdLets/bin/Debug](https://github.com/giuliano108/SeBackupPrivilege/tree/master/SeBackupPrivilegeCmdLets/bin/Debug)
|
||
|
|
* following **IppSec** in [https://www.youtube.com/watch?v=IfCysW0Od8w\&t=2610\&ab\_channel=IppSec](https://www.youtube.com/watch?v=IfCysW0Od8w\&t=2610\&ab\_channel=IppSec)
|
||
|
|
* Or as explained in the **escalating privileges with Backup Operators** section of:
|
||
|
|
|
||
|
|
{% content-ref url="../../active-directory-methodology/privileged-groups-and-token-privileges.md" %}
|
||
|
|
[privileged-groups-and-token-privileges.md](../../active-directory-methodology/privileged-groups-and-token-privileges.md)
|
||
|
|
{% endcontent-ref %}
|
||
|
|
|
||
|
|
### SeRestorePrivilege
|
||
|
|
|
||
|
|
Permission for **write access** to any system file, irrespective of the file's Access Control List (ACL), is provided by this privilege. It opens up numerous possibilities for escalation, including the ability to **modify services**, perform DLL Hijacking, and set **debuggers** via Image File Execution Options among various other techniques.
|
||
|
|
|
||
|
|
### SeCreateTokenPrivilege
|
||
|
|
|
||
|
|
SeCreateTokenPrivilege is a powerful permission, especially useful when a user possesses the ability to impersonate tokens, but also in the absence of SeImpersonatePrivilege. This capability hinges on the ability to impersonate a token that represents the same user and whose integrity level does not exceed that of the current process.
|
||
|
|
|
||
|
|
**Key Points:**
|
||
|
|
- **Impersonation without SeImpersonatePrivilege:** It's possible to leverage SeCreateTokenPrivilege for EoP by impersonating tokens under specific conditions.
|
||
|
|
- **Conditions for Token Impersonation:** Successful impersonation requires the target token to belong to the same user and have an integrity level that is less or equal to the integrity level of the process attempting impersonation.
|
||
|
|
- **Creation and Modification of Impersonation Tokens:** Users can create an impersonation token and enhance it by adding a privileged group's SID (Security Identifier).
|
||
|
|
|
||
|
|
|
||
|
|
### SeLoadDriverPrivilege
|
||
|
|
|
||
|
|
Thi privilege allows to **load and unload device drivers** with the creation of a registry entry with specific values for `ImagePath` and `Type`. Since direct write access to `HKLM` (HKEY_LOCAL_MACHINE) is restricted, `HKCU` (HKEY_CURRENT_USER) must be utilized instead. However, to make `HKCU` recognizable to the kernel for driver configuration, a specific path must be followed.
|
||
|
|
|
||
|
|
This path is `\Registry\User\<RID>\System\CurrentControlSet\Services\DriverName`, where `<RID>` is the Relative Identifier of the current user. Inside `HKCU`, this entire path must be created, and two values need to be set:
|
||
|
|
- `ImagePath`, which is the path to the binary to be executed
|
||
|
|
- `Type`, with a value of `SERVICE_KERNEL_DRIVER` (`0x00000001`).
|
||
|
|
|
||
|
|
**Steps to Follow:**
|
||
|
|
1. Access `HKCU` instead of `HKLM` due to restricted write access.
|
||
|
|
2. Create the path `\Registry\User\<RID>\System\CurrentControlSet\Services\DriverName` within `HKCU`, where `<RID>` represents the current user's Relative Identifier.
|
||
|
|
3. Set the `ImagePath` to the binary's execution path.
|
||
|
|
4. Assign the `Type` as `SERVICE_KERNEL_DRIVER` (`0x00000001`).
|
||
|
|
|
||
|
|
```python
|
||
|
|
# Example Python code to set the registry values
|
||
|
|
import winreg as reg
|
||
|
|
|
||
|
|
# Define the path and values
|
||
|
|
path = r'Software\YourPath\System\CurrentControlSet\Services\DriverName' # Adjust 'YourPath' as needed
|
||
|
|
key = reg.OpenKey(reg.HKEY_CURRENT_USER, path, 0, reg.KEY_WRITE)
|
||
|
|
reg.SetValueEx(key, "ImagePath", 0, reg.REG_SZ, "path_to_binary")
|
||
|
|
reg.SetValueEx(key, "Type", 0, reg.REG_DWORD, 0x00000001)
|
||
|
|
reg.CloseKey(key)
|
||
|
|
```
|
||
|
|
|
||
|
|
More ways to abuse this privilege in [https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/privileged-accounts-and-token-privileges#seloaddriverprivilege](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/privileged-accounts-and-token-privileges#seloaddriverprivilege)
|
||
|
|
|
||
|
|
### SeTakeOwnershipPrivilege
|
||
|
|
|
||
|
|
This is similar to to **SeRestorePrivilege**. Its primary function allows a process to **assume ownership of an object**, circumventing the requirement for explicit discretionary access through the provision of WRITE_OWNER access rights. The process involves first securing ownership of the intended registry key for writing purposes, then altering the DACL to enable write operations.
|
||
|
|
|
||
|
|
```bash
|
||
|
|
takeown /f 'C:\some\file.txt' #Now the file is owned by you
|
||
|
|
icacls 'C:\some\file.txt' /grant <your_username>:F #Now you have full access
|
||
|
|
# Use this with files that might contain credentials such as
|
||
|
|
%WINDIR%\repair\sam
|
||
|
|
%WINDIR%\repair\system
|
||
|
|
%WINDIR%\repair\software
|
||
|
|
%WINDIR%\repair\security
|
||
|
|
%WINDIR%\system32\config\security.sav
|
||
|
|
%WINDIR%\system32\config\software.sav
|
||
|
|
%WINDIR%\system32\config\system.sav
|
||
|
|
%WINDIR%\system32\config\SecEvent.Evt
|
||
|
|
%WINDIR%\system32\config\default.sav
|
||
|
|
c:\inetpub\wwwwroot\web.config
|
||
|
|
```
|
||
|
|
|
||
|
|
### SeDebugPrivilege
|
||
|
|
|
||
|
|
This privilege permits the **debug other processes**, including to read and write in the memore. Various strategies for memory injection, capable of evading most antivirus and host intrusion prevention solutions, can be employed with this privilege.
|
||
|
|
|
||
|
|
#### Dump memory
|
||
|
|
|
||
|
|
You could use [ProcDump](https://docs.microsoft.com/en-us/sysinternals/downloads/procdump) from the [SysInternals Suite](https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite) to **capture the memory of a process**. Specifically, this can apply to the **Local Security Authority Subsystem Service ([LSASS](https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service))** process, which is responsible for storing user credentials once a user has successfully logged into a system.
|
||
|
|
|
||
|
|
You can then load this dump in mimikatz to obtain passwords:
|
||
|
|
|
||
|
|
```
|
||
|
|
mimikatz.exe
|
||
|
|
mimikatz # log
|
||
|
|
mimikatz # sekurlsa::minidump lsass.dmp
|
||
|
|
mimikatz # sekurlsa::logonpasswords
|
||
|
|
```
|
||
|
|
|
||
|
|
#### RCE
|
||
|
|
|
||
|
|
If you want to get a `NT SYSTEM` shell you could use:
|
||
|
|
|
||
|
|
* ****[**SeDebugPrivilege-Exploit (C++)**](https://github.com/bruno-1337/SeDebugPrivilege-Exploit)****
|
||
|
|
* ****[**SeDebugPrivilegePoC (C#)**](https://github.com/daem0nc0re/PrivFu/tree/main/PrivilegedOperations/SeDebugPrivilegePoC)****
|
||
|
|
* ****[**psgetsys.ps1 (Powershell Script)**](https://raw.githubusercontent.com/decoder-it/psgetsystem/master/psgetsys.ps1)****
|
||
|
|
|
||
|
|
```powershell
|
||
|
|
# Get the PID of a process running as NT SYSTEM
|
||
|
|
import-module psgetsys.ps1; [MyProcess]::CreateProcessFromParent(<system_pid>,<command_to_execute>)
|
||
|
|
```
|
||
|
|
|
||
|
|
### SeManageVolumePrivilege
|
||
|
|
|
||
|
|
The `SeManageVolumePrivilege` is a Windows user right that allows users to manage disk volumes, including creating and deleting them. While intended for administrators, if granted to non-admin users, it can be exploited for privilege escalation.
|
||
|
|
|
||
|
|
It's possible to leverage this privilege to manipulate volumes, leading to full volume access. The [SeManageVolumeExploit](https://github.com/CsEnox/SeManageVolumeExploit) can be used to give full access to all users for C:\
|
||
|
|
|
||
|
|
Additionally, the process outlined in [this Medium article](https://medium.com/@raphaeltzy13/exploiting-semanagevolumeprivilege-with-dll-hijacking-windows-privilege-escalation-1a4f28372d37) describes using DLL hijacking in conjunction with `SeManageVolumePrivilege` to escalate privileges.
|
||
|
|
By placing a payload DLL `C:\Windows\System32\wbem\tzres.dll` and calling `systeminfo` the dll is executed.
|
||
|
|
|
||
|
|
## Check privileges
|
||
|
|
|
||
|
|
```
|
||
|
|
whoami /priv
|
||
|
|
```
|
||
|
|
|
||
|
|
The **tokens that appear as Disabled** can be enable, you you actually can abuse _Enabled_ and _Disabled_ tokens.
|
||
|
|
|
||
|
|
### Enable All the tokens
|
||
|
|
|
||
|
|
If you have tokens disables, you can use the script [**EnableAllTokenPrivs.ps1**](https://raw.githubusercontent.com/fashionproof/EnableAllTokenPrivs/master/EnableAllTokenPrivs.ps1) to enable all the tokens:
|
||
|
|
|
||
|
|
```powershell
|
||
|
|
.\EnableAllTokenPrivs.ps1
|
||
|
|
whoami /priv
|
||
|
|
```
|
||
|
|
|
||
|
|
Or the **script** embed in this [**post**](https://www.leeholmes.com/adjusting-token-privileges-in-powershell/).
|
||
|
|
|
||
|
|
## Table
|
||
|
|
|
||
|
|
Full token privileges cheatsheet at [https://github.com/gtworek/Priv2Admin](https://github.com/gtworek/Priv2Admin), summary below will only list direct ways to exploit the privilege to obtain an admin session or read sensitive files.
|
||
|
|
|
||
|
|
| Privilege | Impact | Tool | Execution path | Remarks |
|
||
|
|
| -------------------------- | ----------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
||
|
|
| **`SeAssignPrimaryToken`** | _**Admin**_ | 3rd party tool | _"It would allow a user to impersonate tokens and privesc to nt system using tools such as potato.exe, rottenpotato.exe and juicypotato.exe"_ | Thank you [Aurélien Chalot](https://twitter.com/Defte\_) for the update. I will try to re-phrase it to something more recipe-like soon. |
|
||
|
|
| **`SeBackup`** | **Threat** | _**Built-in commands**_ | Read sensitve files with `robocopy /b` | <p>- May be more interesting if you can read %WINDIR%\MEMORY.DMP<br><br>- <code>SeBackupPrivilege</code> (and robocopy) is not helpful when it comes to open files.<br><br>- Robocopy requires both SeBackup and SeRestore to work with /b parameter.</p> |
|
||
|
|
| **`SeCreateToken`** | _**Admin**_ | 3rd party tool | Create arbitrary token including local admin rights with `NtCreateToken`. | |
|
||
|
|
| **`SeDebug`** | _**Admin**_ | **PowerShell** | Duplicate the `lsass.exe` token. | Script to be found at [FuzzySecurity](https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Conjure-LSASS.ps1) |
|
||
|
|
| **`SeLoadDriver`** | _**Admin**_ | 3rd party tool | <p>1. Load buggy kernel driver such as <code>szkg64.sys</code><br>2. Exploit the driver vulnerability<br><br>Alternatively, the privilege may be used to unload security-related drivers with <code>ftlMC</code> builtin command. i.e.: <code>fltMC sysmondrv</code></p> | <p>1. The <code>szkg64</code> vulnerability is listed as <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15732">CVE-2018-15732</a><br>2. The <code>szkg64</code> <a href="https://www.greyhathacker.net/?p=1025">exploit code</a> was created by <a href="https://twitter.com/parvezghh">Parvez Anwar</a></p> |
|
||
|
|
| **`SeRestore`** | _**Admin**_ | **PowerShell** | <p>1. Launch PowerShell/ISE with the SeRestore privilege present.<br>2. Enable the privilege with <a href="https://github.com/gtworek/PSBits/blob/master/Misc/EnableSeRestorePrivilege.ps1">Enable-SeRestorePrivilege</a>).<br>3. Rename utilman.exe to utilman.old<br>4. Rename cmd.exe to utilman.exe<br>5. Lock the console and press Win+U</p> | <p>Attack may be detected by some AV software.</p><p>Alternative method relies on replacing service binaries stored in "Program Files" using the same privilege</p> |
|
||
|
|
| **`SeTakeOwnership`** | _**Admin**_ | _**Built-in commands**_ | <p>1. <code>takeown.exe /f "%windir%\system32"</code><br>2. <code>icalcs.exe "%windir%\system32" /grant "%username%":F</code><br>3. Rename cmd.exe to utilman.exe<br>4. Lock the console and press Win+U</p> | <p>Attack may be detected by some AV software.</p><p>Alternative method relies on replacing service binaries stored in "Program Files" using the same privilege.</p> |
|
||
|
|
| **`SeTcb`** | _**Admin**_ | 3rd party tool | <p>Manipulate tokens to have local admin rights included. May require SeImpersonate.</p><p>To be verified.</p> | |
|
||
|
|
|
||
|
|
## Reference
|
||
|
|
|
||
|
|
* Take a look to this table defining Windows tokens: [https://github.com/gtworek/Priv2Admin](https://github.com/gtworek/Priv2Admin)
|
||
|
|
* Take a look to [**this paper**](https://github.com/hatRiot/token-priv/blob/master/abusing\_token\_eop\_1.0.txt) about privesc with tokens.
|
||
|
|
|
||
|
|
{% hint style="success" %}
|
||
|
|
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||
|
|
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||
|
|
|
||
|
|
<details>
|
||
|
|
|
||
|
|
<summary>Support HackTricks</summary>
|
||
|
|
|
||
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
|
|
||
|
|
</details>
|
||
|
|
{% endhint %}
|