Heist_OffSec_Privilege_Escalation

SeRestorePrivilege

---

It has been identified that the compromised svc_apache$ account has SeRestorePrivilege ENABLED on the dc01.heist.offsec(192.168.198.165) host. SeRestorePrivilege grants privilege write access to all objects.

utilman.exe Trick

---

One common method to escalate privilege is to

1. replacing the cmd.exe binary to the utilman.exe binary
2. Launching the modified utilman.exe by pressing the Windows key with U
   • This will launch cmd.exe instead
   • as SYSTEM

utilman.exe is present in the C:\Windows\System32 directory, which is a restricted directory.

However, SeRestorePrivilege grants the access to modify the utilman.exe binary here.

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/heist]
└─$ rdesktop dc01.heist.offsec

I can then launch the GUI session over RDP.

This button right here launches utilman.exe, which was replaced by cmd.exe

System level compromise Dumping credentials..