Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 20:53:37 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens
History
carlospolop 1fa9f77ec3 change
2023-04-05 14:02:54 +02:00
..
abuse-seloaddriverprivilege.md change 2023-04-05 14:02:54 +02:00
README.md change 2023-04-05 14:02:54 +02:00

README.md

Abusing Tokens

HackTricks in 🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

Tokens

If you don't know what are Windows Access Tokens read this page before continuing:

{% content-ref url="../access-tokens.md" %} access-tokens.md {% endcontent-ref %}

Maybe you could be able to escalate privileges abusing the tokens you already have

SeImpersonatePrivilege (3.1.1)

Any process holding this privilege can impersonate (but not create) any token for which it is able to gethandle. You can get a privileged token from a Windows service (DCOM) making it perform an NTLM authentication against the exploit, then execute a process as SYSTEM. Exploit it with juicy-potato, RogueWinRM (needs winrm disabled), SweetPotato, PrintSpoofer:

{% content-ref url="../roguepotato-and-printspoofer.md" %} roguepotato-and-printspoofer.md {% endcontent-ref %}

{% content-ref url="../juicypotato.md" %} juicypotato.md {% endcontent-ref %}

SeAssignPrimaryPrivilege (3.1.2)

It is very similar to SeImpersonatePrivilege, it will use the same method to get a privileged token.
Then, this privilege allows to assign a primary token to a new/suspended process. With the privileged impersonation token you can derivate a primary token (DuplicateTokenEx).
With the token, you can create a new process with 'CreateProcessAsUser' or create a process suspended and set the token (in general, you cannot modify the primary token of a running process).

SeTcbPrivilege (3.1.3)

If you have enabled this token you can use KERB_S4U_LOGON to get an impersonation token for any other user without knowing the credentials, add an arbitrary group (admins) to the token, set the integrity level of the token to "medium", and assign this token to the current thread (SetThreadToken).

SeBackupPrivilege (3.1.4)

This privilege causes the system to grant all read access control to any file (only read).
Use it to read the password hashes of local Administrator accounts from the registry and then use "psexec" or "wmicexec" with the hash (PTH).
This attack won't work if the Local Administrator is disabled, or if it is configured that a Local Admin isn't admin if he is connected remotely.
You can abuse this privilege with:

{% content-ref url="../../active-directory-methodology/privileged-groups-and-token-privileges.md" %} privileged-groups-and-token-privileges.md {% endcontent-ref %}

SeRestorePrivilege (3.1.5)

Write access control to any file on the system, regardless of the files ACL.
You can modify services, DLL Hijacking, set debugger (Image File Execution Options)… A lot of options to escalate.

SeCreateTokenPrivilege (3.1.6)

This token can be used as EoP method only if the user can impersonate tokens (even without SeImpersonatePrivilege).
In a possible scenario, a user can impersonate the token if it is for the same user and the integrity level is less or equal to the current process integrity level.
In this case, the user could create an impersonation token and add to it a privileged group SID.

SeLoadDriverPrivilege (3.1.7)

Load and unload device drivers.
You need to create an entry in the registry with values for ImagePath and Type.
As you don't have access to write to HKLM, you have to use HKCU. But HKCU doesn't mean anything for the kernel, the way to guide the kernel here and use the expected path for a driver config is to use the path: "\Registry\User\S-1-5-21-582075628-3447520101-2530640108-1003\System\CurrentControlSet\Services\DriverName" (the ID is the RID of the current user).
So, you have to create all that path inside HKCU and set the ImagePath (path to the binary that is going to be executed) and Type (SERVICE_KERNEL_DRIVER 0x00000001).\

{% content-ref url="abuse-seloaddriverprivilege.md" %} abuse-seloaddriverprivilege.md {% endcontent-ref %}

SeTakeOwnershipPrivilege (3.1.8)

This privilege is very similar to SeRestorePrivilege.
It allows a process to “take ownership of an object without being granted discretionary access” by granting the WRITE_OWNER access right.
First, you have to take ownership of the registry key that you are going to write on and modify the DACL so you can write on it.

takeown /f 'C:\some\file.txt' #Now the file is owned by you
icacls 'C:\some\file.txt' /grant <your_username>:F #Now you have full access
# Use this with files that might contain credentials such as
%WINDIR%\repair\sam
%WINDIR%\repair\system
%WINDIR%\repair\software
%WINDIR%\repair\security
%WINDIR%\system32\config\security.sav
%WINDIR%\system32\config\software.sav
%WINDIR%\system32\config\system.sav
%WINDIR%\system32\config\SecEvent.Evt
%WINDIR%\system32\config\default.sav
c:\inetpub\wwwwroot\web.config

SeDebugPrivilege (3.1.9)

It allows the holder to debug another process, this includes reading and writing to that process' memory.
There are a lot of various memory injection strategies that can be used with this privilege that evade a majority of AV/HIPS solutions.

Dump memory

One example of abuse of this privilege is to run ProcDump from the SysInternals to dump a process memory. For example, the Local Security Authority Subsystem Service (LSASS) process, which stores user credentials after a user logs on to a system.

You can then load this dump in mimikatz to obtain passwords:

mimikatz.exe
mimikatz # log
mimikatz # sekurlsa::minidump lsass.dmp
mimikatz # sekurlsa::logonpasswords

RCE

If you want to get a NT SYSTEM shell you could use:

# Get the PID of a process running as NT SYSTEM
import-module psgetsys.ps1; [MyProcess]::CreateProcessFromParent(<system_pid>,<command_to_execute>)

Check privileges

whoami /priv

The tokens that appear as Disabled can be enable, you you actually can abuse Enabled and Disabled tokens.

Enable All the tokens

You can use the script EnableAllTokenPrivs.ps1 to enable all the tokens:

.\EnableAllTokenPrivs.ps1
whoami /priv

Or the script embed in this post.

Table

Full token privileges cheatsheet at https://github.com/gtworek/Priv2Admin, summary below will only list direct ways to exploit the privilege to obtain an admin session or read sensitive files.\

Privilege Impact Tool Execution path Remarks
SeAssignPrimaryToken Admin 3rd party tool "It would allow a user to impersonate tokens and privesc to nt system using tools such as potato.exe, rottenpotato.exe and juicypotato.exe" Thank you Aurélien Chalot for the update. I will try to re-phrase it to something more recipe-like soon.
SeBackup Threat Built-in commands Read sensitve files with robocopy /b

- May be more interesting if you can read %WINDIR%\MEMORY.DMP

- SeBackupPrivilege (and robocopy) is not helpful when it comes to open files.

- Robocopy requires both SeBackup and SeRestore to work with /b parameter.
SeCreateToken Admin 3rd party tool Create arbitrary token including local admin rights with NtCreateToken.
SeDebug Admin PowerShell Duplicate the lsass.exe token. Script to be found at FuzzySecurity
SeLoadDriver Admin 3rd party tool

1. Load buggy kernel driver such as szkg64.sys
2. Exploit the driver vulnerability

Alternatively, the privilege may be used to unload security-related drivers with ftlMC builtin command. i.e.: fltMC sysmondrv

1. The szkg64 vulnerability is listed as CVE-2018-15732
2. The szkg64 exploit code was created by Parvez Anwar
SeRestore Admin PowerShell

1. Launch PowerShell/ISE with the SeRestore privilege present.
2. Enable the privilege with Enable-SeRestorePrivilege).
3. Rename utilman.exe to utilman.old
4. Rename cmd.exe to utilman.exe
5. Lock the console and press Win+U

Attack may be detected by some AV software.

Alternative method relies on replacing service binaries stored in "Program Files" using the same privilege
SeTakeOwnership Admin Built-in commands

1. takeown.exe /f "%windir%\system32"
2. icalcs.exe "%windir%\system32" /grant "%username%":F
3. Rename cmd.exe to utilman.exe
4. Lock the console and press Win+U

Attack may be detected by some AV software.

Alternative method relies on replacing service binaries stored in "Program Files" using the same privilege.
SeTcb Admin 3rd party tool

Manipulate tokens to have local admin rights included. May require SeImpersonate.

To be verified.

Reference

HackTricks in 🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥