User

Privileges

Description

Special privileges can be associated to a user's access token. Some of these privileges can be (ab)used to gain full control over a Windows machine, by providing the ability to execute arbitrary code as SYSTEM for example. A very common scenario is when an attacker has first compromised an application running on an IIS web server. Such applications run as service accounts that are often granted impersonation privileges (SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege) by design, so they can also use such privileges to execute arbitrary code in the context of the SYSTEM account. Whether this should be considered as a vulnerability or not heavily depends on the context. Therefore, it is recommended to apply the principle of least privilege and review the token privileges that are granted to a given account and check if they are really necessary.

Script Output

+------+------------------------------------------------+------+
| TEST | USER > Privileges                              | VULN |
+------+------------------------------------------------+------+
| DESC | List the privileges that are associated to the        |
|      | current user's token. If any of them can be leveraged |
|      | to somehow run code in the context of the SYSTEM      |
|      | account, it will be reported as a finding.            |
+------+-------------------------------------------------------+
[+] Found 1 result(s).

Name                   State   Description
----                   -----   -----------
SeImpersonatePrivilege Enabled Impersonate a client after authentication

Exploitation

Exploitation depends on the reported privileges.

SeAssignPrimaryTokenPrivilege / SeImpersonatePrivilege - TODO
SeCreateTokenPrivilege - TODO
SeDebugPrivilege - TODO
SeLoadDriverPrivilege - TODO
SeRestorePrivilege - TODO
SeTakeOwnershipPrivilege - TODO
SeTcbPrivilege - TODO
SeBackupPrivilege - TODO
SeManageVolumePrivilege - TODO

Remediation

The privilege set of a given service account can be configured using the built-in sc.exe command line tool.

C:\Windows\system32>sc privs SomeService SeChangeNotifyPrivilege/SeUndockPrivilege/SeIncreaseWorkingSetPrivilege/SeTimeZonePrivilege
[SC] ChangeServiceConfig2 SUCCESS

C:\Windows\system32>sc qprivs SomeService
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: SomeService
        PRIVILEGES       : SeChangeNotifyPrivilege
                         : SeUndockPrivilege
                         : SeIncreaseWorkingSetPrivilege
                         : SeTimeZonePrivilege

If a service is configured to run as LOCAL SERVICE or NETWORK SERVICE, an additional hardening step should be taken to ensure that the default privileges cannot be recovered. A virtual service account can be created using the following command.

C:\Windows\system32>sc config SomeService obj= "NT SERVICE\SomeService"
[SC] ChangeServiceConfig SUCCESS

C:\Windows\system32>sc qc SomeService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SomeService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\MyService\service.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : SomeService
        DEPENDENCIES       :
        SERVICE_START_NAME : NT SERVICE\SomeService

Home

Home

Vulnerabilites

Info

TODO