PrivEsc Issue getting hashes

[wiseguy01]

Hello,

I recently found a device vulnerable to CVE-2022-26134(Confluence) and I use powershell base64 to get reverse shell and loaded Cobalt beacon(one liner) on it. When I try to dump hashes with cobalt I get error ERROR kuhl_m_sekurlsa_acquireLSA ; Handle on memory (0x00000005).
I tried dumping lsass.exe and got no where.
Please tell me your ideas?

Thanks,
WG01

 

[zuna34]

(0x00000005)

error 5 = access denied

 

[RocketRacoon]

if you are nt/authority why dont just create users with admin or domain rights?

 

[wiseguy01]

I tried creating with reverse shell but it doesn't work.

 

[r1z]

use webshell --> powershell.

I tried creating with reverse shell but it doesn't work.

 

[seidziwhitehat]

Hello,

I recently found a device vulnerable to CVE-2022-26134(Confluence) and I use powershell base64 to get reverse shell and loaded Cobalt beacon(one liner) on it. When I try to dump hashes with cobalt I get error ERROR kuhl_m_sekurlsa_acquireLSA ; Handle on memory (0x00000005).
I tried dumping lsass.exe and got no where.
Please tell me your ideas?

Thanks,
WG01

Looks like RunAsPPL is enabled on the server, try to use a few Mimikatz techniques to bypass this feature. Google is your friend here.
Also, some av software can be involved when you see such error. You should probably perform a basic system recon before hashdump.

 

[zuna34]

the confluence runs as nt\auth networkservice, not system. you need system, to dump hashes, which explains the error that mimik can't get handle on lsass (0x00000005) (error 5 = access denied) execute whoami /priv. you will see that SeImpersonatePrivilege is enabled. Just use https://github.com/crisprss/PrintSpoofer to get to system, then even if PPL is enabled, you can use nanodamp.

 

[wiseguy01]

zuna34 thank you very much but nanodump gave error [-] Could not connect to pipe: 2

 

[r1z]

zuna34 thank you very much but nanodump gave error [-] Could not connect to pipe: 2

You may need to inject your beacon with authorized process to make nanodump works, simple bypass the DLLblocks by running this command before dumping nano.

blockdll start

then

nanodump

 

[wiseguy01]

Still get error [-] A privilege is missing: SeDebugPrivilege. Are you elevated?

 

[wiseguy01]

thank you r1z for helping me!