Remote Desktop (RDP) (3389)

PrivEsc

Utilman.exe Abuse with RDP

If you have access to write into the C:\Windows\System32 folder then we can abuse that privilege to gain access as NT_USER by abusing the RDP session.

The utilman.exe is a built-in Windows application that is designed to allow users to configure system accessibility options such as the Magnifier, High Contrast Theme, Narrator, and On Screen Keyboard before they log in to the system.

This application is triggered by issuing the WIN + U key combination while on the Windows Logon screen. It's important to note that the application runs with SYSTEM privileges.

We can leverage our write access in the system directory C:\Windows\System32 to replace utilman.exe with cmd.exe.

*Evil-WinRM* PS C:\Users\svc_apache$\Documents> move C:\Windows\System32\utilman.exe C:\Windows\System32\utilman.old
*Evil-WinRM* PS C:\Users\svc_apache$\Documents> move C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe
*Evil-WinRM* PS C:\Users\svc_apache$\Documents>

If we can now trigger the application, it should grant us a SYSTEM shell. Let's give this a try using Remote Desktop Protocol with rdesktop.

rdesktop -u enox -p california -g 1920x1080 -z heist.offsec

We'll issue WIN + U (CMD + U on Mac keyboards) on the logon screen to trigger the execution of utilman.exe. We can also just click the support tools icon on the lower right. If all went well, the application should run cmd.exe with system-level integrity.