svc_mssql
Checking for privileges of the mssql user after making the lateral movement
PS C:\Windows\system32> whoami /all
whoami /all
USER INFORMATION
----------------
User Name SID
================ ============================================
access\svc_mssql S-1-5-21-537427935-490066102-1511301751-1104
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Group used for deny only
NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ================================ ========
SeMachineAccountPrivilege Add workstations to domain Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeManageVolumePrivilege Perform volume maintenance tasks Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
USER CLAIMS INFORMATION
-----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.The svc_mssql user has the SeManageVolumePrivilege privilege
SeManageVolumePrivilege
/Practice/Access/4-Post_Enumeration/attachments/{98EF482B-03D7-447F-8CCE-B297DA6380E8}-1.png)
According to the Microsoft documentation, the SeManageVolumePrivilege privilege deals with volume-level management operations
Vulnerabilities
/Practice/Access/4-Post_Enumeration/attachments/{AD102B77-E021-4DC0-AF2A-28DEC7CFFF8C}.png)
Looking further into it reveals that the SeManageVolumePrivilege privilege can be abused for privilege escalation
/Practice/Access/4-Post_Enumeration/attachments/{44A8C211-D319-45B2-81A4-05F5C72FF321}.png)
It would appear that there are several methods available
Moving on to the Privilege Escalation phase