+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] [POC] From Administrator to Nt Authority\System (/showthread.php?tid=6025964)
Pages: Pages
1
2
[POC] From Administrator to Nt Authority\System - Paskowsky - Nov 18, 2019
From Administrator To Nt Authority\System
If you want check out my blog where I explain how it works!
https://blog.dreamsoftwares.cc/2019/11/18/from-standard-user-to-nt-authoritysystem/
Code :
Hope you enjoy and if you have any question or suggestion please comment down here!
RE: [POC] From Administrator to Nt Authority\System - gigajew - Nov 18, 2019
Cool post, but it's no exploit just basic token cloning to gain other privileges?
RE: [POC] From Administrator to Nt Authority\System - Paskowsky - Nov 19, 2019
(Nov 18, 2019 06:06 PM)gigajew Wrote: Cool post, but it's no exploit just basic token cloning to gain other privileges?
Yes, I've never mentioned exploiting 🤣
Have a good day 🤝
RE: [POC] From Administrator to Nt Authority\System - Accord - Nov 21, 2019
Your blog is a good read for a begginer like me. I followed everything and what is being happened.
RE: [POC] From Administrator to Nt Authority\System - Kallu609 - Nov 21, 2019
This is great repo too: GitHub - rootm0s/WinPwnage: UAC bypass, Elevate, Persistence and Execution methods
There's 7 different elevation techniques there.
RE: [POC] From Administrator to Nt Authority\System - Đạt Phan - Nov 22, 2019
please can you give me pass
RE: [POC] From Administrator to Nt Authority\System - Kallu609 - Nov 22, 2019
(Nov 22, 2019 12:24 AM)Đạt Phan Wrote: please can you give me pass
What pass? Password? Where? Are u ok? 👹
RE: [POC] From Administrator to Nt Authority\System - Fr3eD0M - Nov 22, 2019
I have read your blog.Very nice tutorial.
Thanks for share
RE: [POC] From Administrator to Nt Authority\System - 0x414243ffffff - Nov 28, 2019
ermm you can do the same in metasploit i guess for token stealing
RE: [POC] From Administrator to Nt Authority\System - BadByte - Nov 30, 2019
Nice and Thanks, i'll try this!
RE: [POC] From Administrator to Nt Authority\System - tux1 - Dec 1, 2019
Very interesting, thanks for sharing!
RE: [POC] From Administrator to Nt Authority\System - Hannah - Dec 12, 2019
Nice, thanks for sharing. Will use this soon
RE: [POC] From Administrator to Nt Authority\System - BadByte - Jan 9, 2020
escalation doesn't work for me!
I integrated it into my client, it all seems to be performing as it should be but nothing is happening on the side escalation!.
Tested on Win7(32) for moment and nothing and without AV.
Always working? It's me (my code..)?
Just to known or to understand where is my error, just to advance..
Ty.
Cap1
Spoiler (Click to View)
![[Image: 0R8dJMM.png]](https://i.imgur.com/0R8dJMM.png)
Cap2
Spoiler (Click to View)
![[Image: TrzDe9l.png]](https://i.imgur.com/TrzDe9l.png)
Cap3
Spoiler (Click to View)
![[Image: lTIsFy6.png]](https://i.imgur.com/lTIsFy6.png)
Cap4
Spoiler (Click to View)
![[Image: cgC5j65.png]](https://i.imgur.com/cgC5j65.png)
I just modified in the Class the PathFileName, isn't "winlogon", the name of target_process is sended by the server (see capture) but i think all is OK, my code seem just, then i don't know...
RE: [POC] From Administrator to Nt Authority\System - Paskowsky - Jan 9, 2020
You have to be atleast in the administrator group to escalate to ntauthority.
This is not an exploit!
Regards,
Paskowsky
RE: [POC] From Administrator to Nt Authority\System - BadByte - Jan 9, 2020
(Jan 9, 2020 11:23 AM)Paskowsky Wrote: You have to be atleast in the administrator group to escalate to ntauthority.
This is not an exploit!
Regards,
Paskowsky
Ok, but my user is the admin, i haven't verified but i think this account is in admin group!
I'll apply the modifications and i'll add an function to be sure the user is in good group..
Thx for reply, i'll try so later, i'm in pause ^^ :p
Re.
I'm already in admin groupe :(
I spent the night on it, it's not that the class is complex, it's just that it works with a client suddenly every time I have to recompile, test and it's boring serious: p
I checked the membership of the user in the admin group admin it is, ok, I get all the SIDs of the user, I checked if it is a SID / adm_grp and if not then I add it to the group and if yes then: escalation (filepath), but none of this allows you to see this Class escalate cmd.exe ..
In any case it gave me ideas, I will work on SIDs (cloning, copying, new ..)