whoami priv - show me your privileges and I will lead you to SYSTEM
summary
Detailed walkthrough of which Windows privileges actually lead to SYSTEM: SeImpersonate, SeAssignPrimary, SeDebugPrivilege, and SeRestorePrivilege are shown abused end-to-end. Tools and artifacts include editable service DLL overwrite to spawn SYSTEM, Vssadmin/DiskShadow and mimikatz to dump NTDS, a Stopzilla driver exploit to get CREATE_TOKEN, and the Juicy Potato/Rotten Potato RPC reflipping (now a Metasploit module). Demos work reliably on pre-1809/2016 builds; Microsoft patches mitigate some attacks in 1809/2019 but many older machines remain vulnerable.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker background
- 3:23What are Windows privileges
- 9:54Abusing debug privilege
- 12:11Abusing restore privilege
- 16:07Abusing backup privilege
- 19:49Abusing take ownership privilege
- 21:58Abusing TCB privilege
- 29:01Abusing create token privilege
- 32:18Abusing load driver privilege
- 34:27Abusing assign primary token
- 41:37Prevention and final thoughts
related talks
42mThe Rise of Potatoes: Privilege Escalations in Windows Services
50mAutomated Discovery Of Logical Priv. Esc. Bugs In Win10
21mBattle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
49mPowerShell for Security Incident Response
58mHacking in 2016 - How is our systems broken?
56m"Easy LPEs and Common Software Vulnerabilities"
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them