# Using Exploits

## Application-Based Vulnerabilities

## Windows Kernel Exploits

The vulnerability research and related exploit techniques are, in most cases, quite advanced and require an in-depth understanding of the Windows operating system. For the purposes of this Module, it is enough to understand that Windows kernel exploits exist and can be used for privilege escalation.

### Check Assigned Privileges

```powershell
PS C:\Users\steve> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                          State
============================= ==================================== ========
SeSecurityPrivilege           Manage auditing and security log     Disabled
SeShutdownPrivilege           Shut down the system                 Disabled
SeChangeNotifyPrivilege       Bypass traverse checking             Enabled
SeUndockPrivilege             Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set       Disabled
SeTimeZonePrivilege           Change the time zone                 Disabled
```

### Enumerate Windows Version

```powershell
PS C:\Users\steve> systeminfo

Host Name:                 CLIENTWK220
OS Name:                   Microsoft Windows 11 Pro
OS Version:                10.0.22621 N/A Build 22621
...
PS C:\Users\steve> Get-CimInstance -Class win32_quickfixengineering | Where-Object { $_.Description -eq "Security Update" }

Source        Description      HotFixID      InstalledBy          InstalledOn
------        -----------      --------      -----------          -----------
              Security Update  KB5025239                          5/4/2023 12:00:00 AM
              Security Update  KB5025749                          5/4/2023 12:00:00 AM
              Security Update  KB5017233                          9/25/2022 12:00:00 AM
```

## Abusing Windows Privileges

Non-privileged users with assigned privileges, such as **SeImpersonatePrivilege** can potentially abuse those privileges to perform privilege escalation attacks.  **SeImpersonatePrivilege** offers the possibility to leverage a token with another security context.  Meaning, a user with this privilege can perform operations in the security context of another user account under the right circumstances.  By default, Windows assigns this privilege to members of the local *Administrators* group as well as the device's *LOCAL SERVICE*, *NETWORK SERVICE*, and *SERVICE* accounts. Microsoft implemented this privilege to prevent unauthorized users from creating a service or server application to impersonating clients connecting to it.

Other privileges that may lead to privilege escalation are *SeBackupPrivilege*, *SeAssignPrimaryToken*, *SeLoadDriver*, and *SeDebug*. In this section, we'll closely inspect privilege escalation vectors in the context of *SeImpersonatePrivilege*.

In penetration tests, we'll rarely find standard users with this privilege assigned. However, we'll commonly come across this privilege when we obtain code execution on a Windows system by exploiting a vulnerability in an *Internet Information Service* (IIS) web server. In most configurations, IIS will run as *LocalService*, *LocalSystem*, *NetworkService*, or *ApplicationPoolIdentity*, which all have *SeImpersonatePrivilege* assigned. This also applies to other Windows services.

{% embed url="<https://jlajara.gitlab.io/Potatoes_Windows_Privesc>" %}
