hello and welcome back to activity 2019
we have a few announcements first if you
have a budge and a VIP band
please remember to pick up your hoodie
and your t-shirt from downstairs if you
have an electronic badge please update
the firmware on your badge be sure to
have a look at the hacker rank game in
the Morgan Stanley booth and the black
cell booth is very interesting with a
display on vulnerabilities of security
please could you welcome Andrea peony to
talk about Who am I
privy show me your privileges and I will
lead you to system hello to everyone
hope it continued to work in finger
crossed you can see it okay so first of
all it's a real pleasure for me to be
here for this amazing event and I would
like to thank the organization for
giving me this great opportunity just
towards about me before starting among
the other things I work like an idea
architect and security manager for an
Italian company I come from Italy and
security has always been a special
interest for me since the early 19th so
I'm little bit old to be honest
offensive security is much more an hobby
for me and during my spare time when I'm
not cycling or diving I like to
understand and sometimes discover some
security issues in Windows and Linux and
environments these are my contacts and I
am a proud member of these two
organizations
first of all why this talk because my
talk is about windows privileges I don't
know how many of you know about Windows
privileges I think it's a well-known
argument but we will introduce it
because I started my research not so
much research but to understand better
privileges privileges because I saw
these techniques I found that they were
not so much exploited not much taken in
consideration when it comes to privilege
escalation
so some techniques of manipulation are
not well documented and I decided to dig
deeper one day I ran in this fantastic
article with such a perfect resume of
privileges and I shared useful
informations with the authors of this
paper the agenda after a small in a very
short introduction we will see in more
detail some very interesting privileges
some powerful privileges which which are
called God privileges and then how to
use them and then some final thoughts
sorry for my bad english I hope you
understand me but as Italian I always
speak my with my hands and maybe this
can help you to understand me better I
don't want to bore you with privileges
and theories so first of I spend just
two words about it - what are privileges
privileges as Microsoft says are special
rights granted to users to perform some
high privilege the operations on the
operating system such as shutting down
the system changing the system time and
so on in Windows and environments some
users and groups have already predefined
privileges obviously administrator
system has all privileges not all
privileges but most of them some users
have special privileges they can be
assigned or managed via the
security added the console of the GP
edit for Microsoft but you can also play
with privileges using directly the
native our AP is another interesting two
thing to mention is that some privileges
totally overwrite the permission which I
set on to an object and this is very
very cool
another thing is that the most god
privileges are only available in high
integrity level process in a high shell
process otherwise you won't see these
privileges this is the first thing that
we should do try to spawn an high
integrity level process like the CMD
shell and if if you are able to spawn it
probably we have some privileges how do
we discover our privileges simply with
who am i / premium windows access tokens
why I speak about windows access token
because they are closely linked
privileges and tokens big bill because
privileges are assigned to the token
when I log on to the system because when
I log on to the system a special token
will be assigned to me and each time I
spawn a process or a thread a copy of
this token will be made what does this
token contain a lot of information
members group memberships and so on
interesting is that in the token is
included the list of privileges which
are granted to me so when I have a token
with elevated privileges I can if I can
impersonate this token I will
automatically have all these privileges
a token can be of different types again
I don't want to bore you primarily
impersonation token a primary process in
primary token is mainly used for
supporting processes and impersonation
token for spawning threads it's a little
bit more complicated but keep it simple
the only useful type of token for us are
the last one security impatient
impersonation or security delegation
token these are the only two types
of tokens we can abuse from the other
tokens are very beautiful have a lot of
privileges but we cannot use them
important thing is that once a token has
been generated from the logon process it
the primary token frozen bit will be set
this mean that I cannot add other
privileges to make token otherwise it
would be too simple to elevate my
privileges now but I can change the
token I can duplicate the token and for
example from a primary token create a
impersonation token in order to
impersonate the trade for example ok
that's it everything is clear up to now
yeah ok good which account have special
privileges as I told you before
obviously administrator local system
they have got privileges they are the
god on the machine some built-in users
group for example backup operators have
impaired backup and restore privilege
printer operators have the low driver
privilege on a domain controller local
and network service accounts they have
always impersonate and sometime assign
primary privileges and we will see that
this is very very interesting one also
managed service and neutral accounts
third party application users because in
order to use install some applications
the software renders ask us to grant to
the user which will impersonate this
application to grant him special
privileges or sometimes and it really
happens I I you can believe me some
misconfigured users which have been
granted unnecessary privileges so if you
are able to compromise an account of
such misconfigured users you have done
it without compromising that min account
for example
I for example the this Becca program
Backup Exec
requires for the user who launches the
program obviously backup and restore
privilege because it's his task but also
the act as part of operating system the
TCB privilege granting these privileges
means granting to this user the complete
control over the system so ok we have to
separate the the risk the duties we have
to grant only to the users the right
privileges to perform the task but even
to a user this privilege is like telling
him he had the key the keys of the
kingdom do whatever you want
how can we round this privileged
accounts well there are so many
techniques and I don't want to speak
about it but simply miss misconfigured
service which I can impersonate or
simple remote code execution via an CMD
shell on a server or a command execution
VRMs SQL and so on intercepting
man-in-the-middle attacks so ntlm
authentication or stealing credentials
Kerberos ting etcetera etc another
important thing to get these privileges
is to abuse from exploits in the past
have been many exploits which
manipulates tokens and especially that
last two one techniques partial right
and arbitrary words are very very
interesting because they permit as a
normal user from the userland to
overwrite the a process structure in
kernel mode okay and to grant to add to
himself other privileges and these
techniques are successfully being
demonstrated like the first one and the
other one we will I show you is the load
driver privilege
okay let's start with the privileges the
first one and probably the most common
and most well known is the debug
privilege and debug privilege simply
grants you to attach your debugger to
any process when I say any process any
process also administrator system
process obviously this is the simplest
way to elevate to make privilege
escalation debug processes the the
privilege of debug normally should be
granted to developers okay but sometimes
this is not always the case and if you
have this privilege
you can attach and you can write code
your own shy code for example in a
process which is running with a high
privilege there are so many techniques
from write process create remote read
and so on these are well documented so
it's only important to say that with
with these debug privileges as written
here guy from Microsoft modded 10 years
ago said if you grant somebody that
debug privilege you gave away the farm
because you grant him all privileges he
is the system on this machine another
interesting way to exploit the debug
privilege without making it too complex
with creating remote Reds etc etc it's
simply setting the parent process
creating a process and setting the
parent process of my process privilege
process and in this manner I will
impersonate the user who is the owner of
the parent bill there are many ways to
do it to do it the simple API calls I
have wrote some time ago a PowerShell
script you can find it on my github
which does this exactly which spawns
which sets the parent process privilege
process you can choose which is the pit
you want to set as parent process as as
and as you can see in the screenshot a
simple user becomes
system and he owned he also can become
trusted installer because if I take the
pit of the trust then trusted installer
I can impersonate trusted installer
which is very very dangerous the rest or
privilege we are performing backup so we
need to backup and restore and we need
special privileges in order to overwrite
overrides claw sorry
in order to override the permission sets
we just had an object if a file is
accessible only by a special group or
administrator a backup operator could
not access this file okay but if he has
restored Beca privilege he can override
these security settings so there are two
API calls which I can use as with these
privileges in order to perform these
nasty things the first one is create
file and I only have to specify a
special flag with this file flag backup
semantics so if I'm doing some
operations windows checks if the flag if
I'm doing some operation I want to
access a file which I could not access
windows checks if I have this flag
active and I have the right privilege
please go on I won't I won't stop you
okay and the same thing I can do it on
the registry keys so I can override
registry keys ok so I can write files
everywhere even in system 32 even files
owned from trusted installer and as you
can imagine there are countless
possibilities so the rest are privileges
from if I have restor privilege gaining
system rights is just as drinking a
bottle of good Italian wine ok
I have just an example but just of one
of the many examples to show you how to
perform this task for example I will
modify a service configuration and in
this case is the WAP Push message
routing service which is present on all
on each Windows installation starting
from 2016 if I don't
yes 2016 this service is interesting
because because a standard user can
start the service ok because obviously
even if even if I have all the rights on
the service I can write overwrite the
service but if I cannot launch it I'm I
have no possibilities so what's the idea
first of all I create a simple service
DLL which will run the batch file and
these bad files I will spawn a reverse
shell okay and then I will overwrite the
service configuration telling him that
the service DLL is not the service that
the original service DLL but the service
DLL which I quit copying systems and 32
directory this is possible because I use
the backup Symantec flag the restore
flag in this case after that I copy the
DLL I could even overwrite the original
DLL because it even if it's owned by a
trust and installer I am performing a
backup operation and I can overwrite
everywhere I have also a short video
about this I hope it will work I have a
restore privilege I created a simple
executable by kudos superior script in
which I will modify a registry key and
will overwrite a fly the file and then
launch my service
and I get the rest the vest back shell
and as you can see I am system so it's
very very easy to do to implement the
backup privilege is very similar it's
the opposite but it's very similar I can
perform backup operation this means that
I can access file for a backup purpose
which could normally I could not access
one interesting thing is obviously to
hash to dump the hash of the local and
@lm database I can do it in many ways in
this in this way I am doing it now with
simply operating system commands the Reg
utility which can allows me to perform a
backup if I have backup privileges so I
will simply backup copy the system hive
and then with one of the tools in X this
example mimic adds I will dump the
hashes and obtain the hash of
administrator for example I can read
files everywhere in this case I can read
the file which only administrator can
access always with the special flag and
then obviously copy it elsewhere
members of Beck apparatus can access the
domain controller to perform backups so
I as in backup operator without other
privileges or other groups I can start a
backup operation damn the NTDs database
and then obtain the hashes in this first
example I use vs admin which is an
utility with Windows but you have to
install it okay and then with one of the
tools available in this case I am using
yes internals I get the boot key and
then obtain the hashes from
administrator dumping the database and
tdst the Active Directory database or I
can do it I don't know how many of you
you know this utility is this shadow the
shadow
unlike VSS permits to perform operations
even if you are not administrator so I
can make a backup of the entity SD tab
database with the shadow copied in
another location and then perform the
dump of the hashes
if you have backup and restore
privileges you are member by the of the
backup of latest group there is another
interesting opportunity because you can
set permission on each object even if
you can't do it okay and this is very
cool and as you can see here via
PowerShell I have this folder which only
admin has full control and no one else
has other access as a backup operator I
can change the permission and add myself
full count grant to myself full control
to this directory this is what I call a
very special bonus given to the backup
operators very similar is this one the
take ownership privilege what does this
privilege says these privileges grants
you the possibility to take ownership of
file renewals you see it also in the GUI
interface of the Explorer of Windows you
can take ownership of a file this is
what user with this special privilege
can do okay again two simple API calls
set security info or set name security
info in the first one I will pass him
the handle of the object I want to take
ownership in the second case the name of
the object object can be of any type not
only file but of any type how could we
use this for privilege escalation the
concept is the same like the rest or
privilege but first of all I have to
take ownership of the registry key of
the service I wish to modify one I took
ownership of this register key I will
grant to myself or for the sake of
simply nice to everyone full control on
this register key and then I will alter
the for example the bin the executable
part of the service in this case the MSI
service I will let him launch another
executable which can contain my
malicious code them
should be here okay I take the ownership
with the owners this flag owners owners
security information obviously I have to
the right privilege and then once I took
the ownership using some API calls I
will set the permissions on this key
grant to everyone the full permission on
its key and then change the
configuration of the service start the
service Ebola
I'm the Navigant system because ability
disservice I have to choose a service
which runs with a high privilege system
administrator and so now okay this one
as I mentioned before is a special
special privilege normally a minstrel
doesn't have this one you have to grant
him this special privilege these
privileges microsoft says act as not act
as operating system what this mean okay
but what does this mean exactly well
with these privileges a user is ultra
authorized to act as another user
without specifying credential and to
grant to this user other special
privileges or group memberships so
imagine if I have this privilege I can
log on as another user or as myself and
tell to this function Allah say Logan
field user function using the as for you
logon service tell to this function hey
put me in the administrator group and
grant me the debug privilege and this is
possible because I have this special
privilege okay
so and a let's say logon few the user
gives me back my precious token my am
token my very powerful token but we have
a problem because I have this code token
so I would like to spawn a process or a
thread using this token otherwise what
should I do is this token we have a
problem in order to impersonate the
thread I have I need a special privilege
which is the impersonal privilege but if
I only have TCB privilege in theory I
could not impersonate the thread so I
have this token and I can do anything
with it but there is good news that is
these statements which say which says
that impersonal privileges is not needed
as long as the token is for you the user
and the owner of the token is myself and
the integrity level of the process at
which I will or the thread I want to
spawn is less or equal as my integrity
level as the parent process okay this is
what we need but Microsoft starting from
Windows 10 added more constraints really
really in this case I just need to
respect the original constraint and as
you can see I created a token for my
user with the back with two powerful
memberships which are the audio where
are they the backup operators okay and
what I did
what is this possible because as long as
the authentication ID of the originating
of the writing token equals as for you
token origin ID all other checks will be
bypassed and when I create a token with
the
we privilege these two conditions always
match so even if Microsoft adds other
constraints what wins is this one and
with the TCP privilege I can impersonate
the thread without problems this is what
I want it to say okay I will show you
just some examples on how to abuse from
these privileges in the first one we
will use the Kerberos authentication
domain okay
and with this privilege I will
impersonate domain admin in the other
two I will use an TLM authentication
okay and in the first one I will create
a token for myself and add myself the
debug privilege in the other example I
will create a token for administrator
and then act myself in local
administrator group using G sharp and
Kerberos authentication is very very
easy as you can see only to write two
lines of code and I'm able to write in a
protected directory as the user which is
not that mean but as the TCP privilege
because I assume the identity of domain
admin very very easy in the other one I
can alter using until an authentication
I can alter the username parameter
myself or administrator put me in extra
groups for example in an administrator
group call my function my API call and
the resulting token h4u token will have
all the privileges to do what I wanted
to for example in the left side adding
me as a supplementary privilege or
adding me directly to the local
administrator group I have also a video
about this because maybe I was not so
clear
but I would like to show you another
with video because this is more a joke I
made with my system in colleagues
because we made the bet and I told them
I logged on as a local administrator on
a machine honest window server act as a
guest account to impersonate a guest
account and act as the domain admin they
told me you are crazy so possible we
make a bet of a good Italian bottle of
wine and when I showed them that it was
possible the day after I was drunk so
the guest account is disabled I'm lock
administrator now I learn lounge my
magic program silly program ok and now I
am guest but the cool thing is that if I
make a where meislish groups I belong to
the domain admin group is this true what
is it just a joke because they didn't
believe me ok I will read the file well
unlock administrators have the
possibility to read
as you can see only administrator can
access this file and if I can act as
administrator I can see the contents of
this file okay it was more a joke but
just to show you what sort of nasty
things you can do with this privilege
alors we were here
the create token privilege is also
considered a God privilege because as
the word says with if I have this
privilege I can create a token I can
create a token and I can a token like a
wand with all the memberships the
privileges I want to have this is very
very pure useful and powerful as you can
imagine but again here we have a problem
because even if I create this token I
cannot impersonate it because I don't
have the rights to impersonate but as I
told you before if the integrity level
of the process is less or equal etcetera
etcetera I can impersonate it but this
is not more true because starting from
Windows 1809 and Windows Server 2019
extra controls when may were took made
in place which blocks this possibility
and as you can see I have this powerful
token with membership of trusted
installer ok so it's a very very
powerful token but if I want if I try to
for example write a file in system32
directory I get an access denied exactly
the impersonation level is invalid what
does this mean that probably windows
checks what you are wanting to do and if
you are trying to impersonate a token
even if you don't have impersonation
privileges and this token is considered
a go to a God token and is in this case
yes because it has the membership of
trusted installers it will demote token
to an identification token with a very
beautiful token but it's useless I can
do anything with it
so came over not exactly because if you
do this third dirty trick you said the
login ID to anonymous and not to system
and with the create token API you can
set the
authentication ID of the token you said
it no no miss Addie magically it works
not all API call words but some worse
and it's sufficient for us to make
privilege escalation why this because
probably the checks which when the
windows made are too late if windows see
that the token is anonymous probably
thinks oh it's an annoyance token it's
harmless
let's go on no because this token has
full as powerful memberships and so it's
possible to it I noticed this to
Microsoft and they say oh yeah that you
are you are right that's true but we are
not going to fix it in this equivalently
it already is
so enjoy ok this is the API call I can
go on very shortly the load driver
privilege load arrival is also a special
privilege which is granted to load
drivers and normally printed operators
on the domain controller have this
powerful privilege what can we do with
this privilege load driver assigned
driver obviously but to add some bugs
and then exploit this bug in order to
gain a system shell for example you have
to trick the driver the Windows kernel
to load the driver from a different
location known from the system hive
because as a printer operator even if I
have the load driver privilege I cannot
write in the system hive so I will
create the configuration of this law of
this device under mad my Accokeek
current user hive and then told to the
load driver API that he has to load it
from my hive and this works and I am
able to load the driver for example here
I loaded successfully this driver this
is a vulnerable driver of the stopzilla
stopzilla is an anti-malware utility we
Ted which
the serious bug and using this bug and a
modified version of the bow of the
exploit I was able to load the driver
grant me the create token privilege okay
and then add myself to the administrator
group just for example the last two one
impersonation and assign primary
privileges these are very very powerful
because they are more easier to obtain
because if you compromise the service
account you have these privileges
impersonate and assign primary what can
you do with these privileges a lot of
things you have to obtain a talk and a
powerful token and then impersonate this
token is that dangerous of impersonate
and assign primary privileges how can we
obtain this token for example forcing a
privileged process to write into a nine
pipe under my control impersonate name
pipe and then have the token impersonate
it and I am system for example or via a
security context in a Nutella note
integration we will see it later or via
the command PC callbacks Co impersonate
client rpcm personal client ok
the killer exploit for this privilege
assists rotten potato Explorer you know
it everybody knows it never heard about
it ok in short it's a little bit
complicated if you in initializing a
tecum object running and as an out of
process server like bits for example if
you needed this object via a stick a
fake storage object and you can tell him
that the old oxid resolving has to be
done under an end point under your
control so when the object has been
initialized it will contact the oxytocin
resolver which not it's not new normal
running on port 135 but on a listener
under my control intercept the local and
@lm identification this whites called
ntlm reflection alter it get the token
in person at the token and
out of process come service running a
system you are system there are some
variants because the original exploit
worked only with metasploit or incognito
me too I wrote two variants two
standalone variants but we had a problem
because it was fixed at the port 666 was
fixed the object bits was fixed and so
it had if and it happened if you disable
the service or you firewall support this
exploit wouldn't work so with my friend
we try to weaponize this product this
exploit and we produced what we call
juicy potato juicy potato is allows you
to configure everything so you can
choose the clsid of the out of process
come server you want to use the port
listener
there are pc port for example if you
have a Windows machine under your
control
you can reflect the authentication on
your PC server and in the even viewer
you want nothing about authentication
very very stealth and so on other
interesting sleep reduce the list of
very very interesting CLS IDs for each
operating system some of them are very
interesting because they impersonate the
user logged on on the first session if
domain yumminess logged on I can
impersonate domain admin these are the
settings an ideal service should have
for exploiting it ok and this is our
tool you can download it here and there
is also a variant of Metasploit it has
been ported also as a Metasploit module
disease are there are some examples of
CLS IDs ok video but I will skip it you
believe it you trust in what I'm saying
a video about exploiting this ok
so how can we stop this
I asked Microsoft more than one year ago
and Microsoft has sponsored in the
current implementation model we are not
able to stop this this is very very bad
ok so it it continues work can we do
something not so much
obviously protect sensitive accounts
that is the best and disable unnecessary
services but for the defense side there
is good news but because finally
Microsoft decided was able to fix it in
version
18:09 of Windows 10 and inverse and 2019
of Windows Server so but if you have
Windows 2016 server or Windows version
meaner than 1809 this exploit works so
if you have this privilege you are
automatically system and that is very
very bad final thought obviously never
underestimate these privileges this is
what I told you this patch works only on
newer versions older version and there
are plenty of Windows 2016 service it
continues to work maybe there are other
privileges not so well known we can
abuse from and as a side note it has
nothing to do with privileges I know
don't know how many of you knew that
that for more than one year that there
was a service which was misconfigured
trusting from certain Windows versions
which grant full control to a service
account so as you can see if you
compromised a service account using the
orchestrator service it was possible to
gain system access and this lasted for
more than one year we notified it with
my team to Microsoft and finally in the
September Patch Tuesday update they fix
it ok ok that's all I hope you enjoyed
my enjoyed my talk and sorry for not
having
but time was stealin okay any questions
everything's clear what thank you again