![](https://cdn-0.reconshell.com/wp-content/uploads/2022/12/LPEE-1024x572.png)
Some Service DCOM Object and SeImpersonatePrivilege abuse.
Exploit collection for some Service DCOM Object local privalege escalation vulnerability(by SeImpersonatePrivilege abuse)
writeup
DCOM use RPC_C_IMP_LEVEL_IDENTIFY
as default impersonation level, for the default out-bound IUnknown
call, see https://learn.microsoft.com/en-us/windows/win32/com/com-security-defaults. Of course, COM Server can override by call CoInitializeSecurity
explicitly.
We known most windows service register their DCOM Server to provide features, Shared Process Service was hosted by svchost
, read the default impersonation level from registry.
If we pass a malicious IUnknown
object as parameter at some DCOM call, service process will call IRemUnknown::RemQueryInterface/RemRelease/RemAddref
on the ProxyObject, now we can got a SecurityImpersonation
token by CoImpersonateClient
because we are DCOM Server
at this time.
Follow was the explicit setting ImpersonationLevel
as RPC_C_IMP_LEVEL_IMPERSONATE
in default installation:
#after 12r2 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\print@ImpersonationLevel #2022 only HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\McpManagementServiceGroup@ImpersonationLevel
The services are PrinterNotify
and McpManagementService
, running as SYSTEM
.
build
Note this code was supports x64 and NetFX 4.x only, but you can do a little change for FX2.0/x86 compatibility(IUnknown vtbl hook, see McpManagementPotato
).
csc /unsafe PrinterNotifyPotato.cs csc /unsafe McpManagementPotato.cs
usage
McpManagementPotato/PrinterNotifyPotato <command>
![McpManagementPotato](https://cdn-0.reconshell.com/wp-content/uploads/2022/12/McpManagementPotato.png)
![PrinterNotifyPotato](https://cdn-0.reconshell.com/wp-content/uploads/2022/12/PrinterNotifyPotato.png)
Thanks for UnmarshalPwn!
(and love my cat, Vanilla, can someone make it nekogirl?)
The DCOMPotato is a github repository by zcgonvh
Leave a Reply