#HITB2021AMS
Privilege escalation is a required step for an attacker in order to get full control of a system starting from a lower privileged access.
In Windows there are many ways to reach this goal. The first part of the talk will be focused on showing all the recent techniques used to do privilege escalation starting from a service account. The second part is dedicated to a new 0day in NTLM relay attack which we reported to MSRC and will be fixed in April, 13th.
This scenario is quite common when attacking web applications hosted on Windows servers. When a web server is compromised (through code execution or arbitrary file write) it is possible to run commands on behalf of the web server that is running as a service. MSSQL servers are another example of services that could be compromised by a malicious attacker.
WSH (Windows Service Hardening) is a feature enabled since Windows Vista with the goal of hardening services. These “isolation” techniques are often not applied and, in some cases, can be abused too. As an example, the famous Rotten/JuicyPotato exploit uses the DCOM/NTLM reflection vulnerability.
Those techniques require SeImpersonatePrivilege which is considered a God privilege by MS. The impersonation privilege is assigned by default to any service account and that opens a hole that could be abused by the attackers in order to escalate privileges. MS does not consider this boundary (going from SERVICE with SeImpersonate to SYSTEM ) as a security boundary but just a safety boundary. For this reason, those vulnerabilities are classified as “won’t fix” by MS.
We will describe all the recent techniques, showing how it is still possible to escalate privileges from SERVICE to SYSTEM in multiple ways.
Even if NTLM relaying is a quite old technique but always current, we recently discovered a new attack vector based on our previous researches discussed in this talk which led to privilege escalations when combined with relaying, the RemotePotato0.
===
I am an IT Architect – Security Manager and independent Security Researcher with long-term experience and in-depth knowledge covering all aspects of IT: from SW development to systems administration; networking administration and IT security. I define myself an “it security enthusiast”, interested in all emerging technologies in offensive and defensive security and like writing and speaking about IT security and bug hunting.
I had talks at various national and international conferences and published several CVE’s. ?ve been rewarded in 2020 by Microsoft in top 100 most valuable MSRC Security Researchers Program.
Blog : https://decoder.cloud
twitter: @decoder_it
---
Antonio Cocomazzi “splinter_code” is a system engineer at SentinelOne with a particular interest in malware analysis. He also conducts independent research with a focus on discovering new vulnerabilities and, more in general, in digging into Windows OS internals. The main focus of his activities is on researching new ways of attacking Windows operating systems and finding cutting edge techniques to reach stealthiness in heavily monitored environments. He enjoys reversing any kind of binaries from packed malwares to Windows internal components. He likes playing online CTFs and writing/publishing offensive tools and security research on his GitHub channel mostly based on Windows OS.