A sugared version ofRottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM
RottenPotatoNG and its variants leverages the privilege escalation chain based on BITSservice having the MiTM listener on 127.0.0.1:6666 and when you have SeImpersonate or SeAssignPrimaryToken privileges. During a Windows build review we found a setup where BITS was intentionally disabled and port 6666 was taken.
We discovered that, other than BITS there are a several COM servers we can abuse. They just need to:
be instantiable by the current user, normally a “service user” which has impersonation privileges
implement the IMarshal interface
run as an elevated user (SYSTEM, Administrator, …)
After some testing we obtained and tested an extensive list of interesting CLSID’s on several Windows versions.
JuicyPotato allows you to:
Target CLSIDpick any CLSID you want.Hereyou can find the list organized by OS.
COM Listening portdefine COM listening port you prefer (instead of the marshalled hardcoded 6666)
COM Listening IP addressbind the server on any IP
Process creation modedepending on the impersonated user’s privileges you can choose from:
CreateProcessWithToken (needs SeImpersonate)
CreateProcessAsUser (needs SeAssignPrimaryToken)
Process to launchlaunch an executable or script if the exploitation succeeds
Process Argumentcustomize the launched process arguments
RPC Server addressfor a stealthy approach you can authenticate to an external RPC server
RPC Server portuseful if you want to authenticate to an external server and firewall is blocking port 135…
TEST modemainly for testing purposes, i.e. testing CLSIDs. It creates the DCOM and prints the user of token. Seehere for testing
-t createprocess call: <t> CreateProcessWithTokenW, <u> CreateProcessAsUser, <*> try both
-p <program>: program to launch
-l <port>: COM server listen port
-m <ip>: COM server listen address (default 127.0.0.1)
-a <argument>: command line argument to pass to program (default NULL)
-k <ip>: RPC server ip address (default 127.0.0.1)
-n <port>: RPC server listen port (default 135)
If the user has SeImpersonate or SeAssignPrimaryToken privileges then you are SYSTEM.
It’s nearly impossible to prevent the abuse of all these COM Servers. You could think about modifying the permissions of these objects via DCOMCNFG but good luck, this is gonna be challenging.
The actual solution is to protect sensitive accounts and applications which run under the * SERVICE accounts. Stopping DCOM would certainly inhibit this exploit but could have a serious impact on the underlying OS.
Oftentimes, the default CLSID that JuicyPotato uses doesn't work and the exploit fails. Usually, it takes multiple attempts to find a working CLSID. To get a list of CLSIDs to try for a specific operating system, you should visit this page:
First, you will need some executables apart from juicypotato.exe.
Download Join-Object.ps1 and load it into your PS session, and download and execute GetCLSID.ps1. That script will create a list of possible CLSIDs to test.
Then download test_clsid.bat (change the path to the CLSID list and to the juicypotato executable) and execute it. It will start trying every CLSID, and when the port number changes, it will mean that the CLSID worked.