2

What are the windows privileges that deserve to pay attention to prevent a user (non-admin) to escalate his privileges to the local admin group ? I know SeDebugPrivilege, but what else ?

Thanks.

Edit for clarification : I am looking for a list of privileges that can be abused during escalation attempts. The goal is to check user's privileges to prevent escalade.

closed as unclear what you're asking by GdD, Adi, Xander, TildalWave, AviD Jan 8 '14 at 9:38

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I'm not sure what you're asking, but if you have UAC on, you don't need to worry in 99% of the cases. (The other 1% are from maybe exploits..) – SomeNickName Jan 7 '14 at 14:20
  • 1
    @SomeNickName err, no. If you have the requisite privileges UAC won't do anything to protect from a malicious user. – Steve Jan 7 '14 at 18:05
2

Aside from SeDebugPrivilege, the other major privilege that is abused during escalation attempts is SeImpersonatePrivilege (leveraged in tools like Incognito). This privilege can allow the user to steal impersonation and/or delegation tokens that are present on the machine.

That being said, there are a number of administrative privileges that theoretically have the potential to assist during privilege escalation attempts, including:

  • SeAssignPrimaryTokenPrivilege
  • SeTakeOwnershipPrivilege (owning and modifying objects to elevate privileges)
  • SeCreateTokenPrivilege
  • SeTcbPrivilege
  • SeRestorePrivilege (write access to any file)
  • SeLoadDriverPrivilege
  • SeSecurityPrivilege

An exhaustive list would be difficult to compose, and I couldn't say with any degree of certainty that any administrative privilege could not be somehow leveraged in this way.

Furthermore, similar to how SeTakeOwnershipPrivilege and SeRestorePrivilege might be abused, a common method of escalation from Domain User that I see regularly involves overwriting binaries or other code that will be executed by a higher-privileged account. As such, write access to service binaries, System32, the All Users 'Startup' directory, application executables etc can lead to other accounts (Local System, Administrators) executing an attacker's code. I have personally found that poorly configured file permissions are a more common attack vector when escalating from basic users.

A good overview of different methods, including some of those above: https://www.netspi.com/blog/entryid/112/windows-privilege-escalation-part-1-local-administrator-privileges

  • 1
    SeLoadDriverPrivilege and SeSecurityPrivilege are also sensitive. But really a skilled attacker could potentially leverage almost any privilege to at least get closer to admin access. – Mark Burnett Jan 7 '14 at 21:53
  • @MarkBurnett Agreed and edited post accordingly. – itscooper Jan 7 '14 at 22:34
  • Thank you @itscooper. I thought I could write a batch file to look after the odd privileges of my users according to a list like you did. It seems to be a bad idea as @"Mark burnett" said that any privilege could be abused ? – Jeremy Jan 8 '14 at 15:05
  • @Jeremy I think the difficulty is that privilege escalation is a category of attack in which there are a number of different vectors that might abuse various granted privileges. This makes it difficult to definitively categorise any of these privileges as not being helpful to an attacker for escalation. – itscooper Jan 8 '14 at 15:21
  • @Jeremy Given your scenario (the batch file), maybe you could check for any privileges that you know should only be assigned to administrators? You could use the recommendations here as guidance to generate a list: technet.microsoft.com/en-us/library/dd277311.aspx This means you will be checking for any overly-privileged users, not just those who might be able to escalate. – itscooper Jan 8 '14 at 15:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.