Detecting LocalPotato (CVE-2023-21746) Privilege Escalation Attacks on Windows

Показать описание

You've probably heard about potatoes on Windows -- starting with HotPotato in 2016, followed by RottenPotato, JuicyPotato, and SweetPotato, among many others Potatoes are a collection of privilege escalation attacks on Windows that typically abuse authentication mechanisms, credentials/tokens and services with impersonation privileges. LocalPotato (CVE-2023-21746) is the newest in the potato family, and abuses flaws in the NTLM authentication challenge process that allow arbitrary file reads and writes as system. We'll demonstrate two ways to use LocalPotato to escalate privileges: by copying the SAM/SYSTEM files and dumping password hashes, and a new privilege escalation against the StorSvc service. As always, we'll discuss detection and threat hunting strategies for these attacks.

References:

SnapAttack Content:

SnapAttack

Рекомендации по теме

Комментарии

Awesome channel. Please keep posting technical news on infosec related matters. It's not for everyone but in time your channel will be sure to grow.

flyingllama

Hello, I'm the co-author of LocalPotato. Just wanted to point out that the arbitrary file read (in this case does not work unless you're an administrator (as shown in your demo lab) or the machine was not patched against an old vulnerability which permitted a standard user to access the SAM/SYSTEM hive form a shadow copy. Minute 3.21

andreapierini

Detecting LocalPotato (CVE-2023-21746) Privilege Escalation Attacks on Windows

Detecting LocalPotato (CVE-2023-21746) Privilege Escalation Attacks on Windows

LocalPotato (CVE-2023-21746) | Windows Privilege Escalation | TryHackMe

Windows Privilege Escalation Technique ( CVE-2023-21746 - LocalPotato )

0patching Windows 'LocalPotato' NTLM Elevation of Privilege (CVE-2023-21746)

Hunting for Local Privilege Escalation via CVE-2023-21768 | Threat SnapShot

Hacking QuickTip 19 - LocalPotato -NTLM Privilege Escalation

LocalPotato Tryhackme

CVE 2023 29336 - Exploit on Windows Server 2016 - Win32k Privilege Escalation Vulnerability

LocalPotato TryHackMe

Rooting out Juicy, Sweet, Efs, and Rotten Potatos from your Windows Environment

LocalPotato by THM [RU]

Path traversal / RCE on TitanFTP 1.94.1205 - CVE-2023-22629

'ctftool' Privilege Escalation on Windows 10

User Profile Service Local Privilege Escalation (CVE-2022-26904) | Threat SnapShot

Exploiting Windows 11 with Ancillary Function Driver vulnerability CVE-2023-21768

Certifried Active Directory Privilege Escalation (CVE-2022-26923) | Threat SnapShot

Exploiting Sudo -A Journey into Privilege Escalation|CVE-2023-22809

[HINDI] CVE-2023-4911 Looney Tunables | Buffer Overflow and Local Privilege Escalation | PentestHint

Yet Another Local Privilege Escalation Attack via Razer Synapse Installer (CVE-2021-44226)

January 2023 Patch Tuesday: Breakdown of CVE-2023-21674 (Zero-Day)

Exploiting PrintNightmare | Privilege Escalation CVE-2021-1675

Russian Malicious Outlook Calendar Invites Targeting Ukraine (CVE-2023-23397) | Threat SnapShot

ThemeBleed Exploit Analysis (CVE-2023-38146)

0patching the 'Remote Potato0' Local Privilege Escalation