A sugared version of RottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM.
Switch branches/tags
Nothing to show
Clone or download
Latest commit 0ef294e Sep 18, 2018
Permalink
Failed to load latest commit information.
CLSID Update Windows 10 Pro Aug 24, 2018
JuicyPotato Update JuicyPotato.cpp Aug 25, 2018
Test Ignoring exe in test folder Aug 20, 2018
assets Update README.md Aug 13, 2018
.gitignore Update Windows 10 Pro Aug 24, 2018
LICENSE Initial commit Jul 27, 2018
README.md Added to BlackArch Aug 27, 2018
_config.yml Update _config.yml Aug 20, 2018
appveyor.yml AppVeyor commit filtering Aug 27, 2018

README.md

Juicy Potato (abusing the golden privileges)

A sugared version of RottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM

Summary

RottenPotatoNG and its variants leverages the privilege escalation chain based on BITS service having the MiTM listener on 127.0.0.1:6666 and when you have SeImpersonate or SeAssignPrimaryToken privileges. During a Windows build review we found a setup where BITS was intentionally disabled and port 6666 was taken.

We decided to weaponize RottenPotatoNG: Say hello to Juicy Potato.

For the theory, see Rotten Potato - Privilege Escalation from Service Accounts to SYSTEM and follow the chain of links and references.

We discovered that, other than BITS there are a several COM servers we can abuse. They just need to:

  1. be instantiable by the current user, normally a "service user" which has impersonation privileges
  2. implement the IMarshal interface
  3. run as an elevated user (SYSTEM, Administrator, ...)

After some testing we obtained and tested an extensive list of interesting CLSID's on several Windows versions.

Juicy details

JuicyPotato allows you to:

  • Target CLSID
    pick any CLSID you want. Here you can find the list organized by OS.

  • COM Listening port
    define COM listening port you prefer (instead of the marshalled hardcoded 6666)

  • COM Listening IP address
    bind the server on any IP

  • Process creation mode
    depending on the impersonated user's privileges you can choose from:

    • CreateProcessWithToken (needs SeImpersonate)
    • CreateProcessAsUser (needs SeAssignPrimaryToken)
    • both
  • Process to launch
    launch an executable or script if the exploitation succeeds

  • Process Argument
    customize the launched process arguments

  • RPC Server address
    for a stealthy approach you can authenticate to an external RPC server

  • RPC Server port
    useful if you want to authenticate to an external server and firewall is blocking port 135...

  • TEST mode
    mainly for testing purposes, i.e. testing CLSIDs. It creates the DCOM and prints the user of token. See here for testing

Usage

T:\>JuicyPotato.exe
JuicyPotato v0.1

Mandatory args:
-t createprocess call: <t> CreateProcessWithTokenW, <u> CreateProcessAsUser, <*> try both
-p <program>: program to launch
-l <port>: COM server listen port


Optional args:
-m <ip>: COM server listen address (default 127.0.0.1)
-a <argument>: command line argument to pass to program (default NULL)
-k <ip>: RPC server ip address (default 127.0.0.1)
-n <port>: RPC server listen port (default 135)
-c <{clsid}>: CLSID (default BITS:{4991d34b-80a1-4291-83b6-3328366b9097})
-z only test CLSID and print token's user

Example

Final thoughts

If the user has SeImpersonate or SeAssignPrimaryToken privileges then you are SYSTEM.

It's nearly impossible to prevent the abuse of all these COM Servers. You could think to modify the permissions of these objects via DCOMCNFG but good luck, this is gonna be challenging.

The actual solution is to protect sensitive accounts and applications which run under the * SERVICE accounts. Stopping DCOM would certainly inhibit this exploit but could have a serious impact on the underlying OS.

Binaries Build status

An automatic build is available. Binaries can be downloaded from the Artifacts section here.

Also available in BlackArch.

Authors

References