github/metasploit-payloads
1
Fork 0
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-03-24 18:16:24 +01:00
Code Releases Activity

Land , Fix getprivs permissions set

Browse Source 
Fix getprivs permissions that are grabbed on C Meterpreter and Python Meterpreter So That They Match
This commit is contained in:
Spencer McIntyre 2023-02-28 14:32:47 -05:00
commit 9f2491bac4
No known key found for this signature in database
GPG Key ID: 58101BA0D0D9C987
2 changed files with 42 additions and 34 deletions
c/meterpreter/source/extensions/stdapi/server/sys/config
config.c
python/meterpreter
ext_server_stdapi.py

6
c/meterpreter/source/extensions/stdapi/server/sys/config/config.c

@ -7,6 +7,11 @@
typedef NTSTATUS(WINAPI *PRtlGetVersion)(LPOSVERSIONINFOEXW); typedef NTSTATUS(WINAPI *PRtlGetVersion)(LPOSVERSIONINFOEXW);
// This may not be defined on some older systems in the header files, so lets define it here manually.
#ifndef SE_DELEGATE_SESSION_USER_IMPERSONATE_NAME
#define SE_DELEGATE_SESSION_USER_IMPERSONATE_NAME TEXT("SeDelegateSessionUserImpersonatePrivilege")
#endif
/*! /*!
* @brief Add an environment variable / value pair to a response packet. * @brief Add an environment variable / value pair to a response packet.
* @param response The \c Response packet to add the values to. * @param response The \c Response packet to add the values to.
@ -294,6 +299,7 @@ DWORD request_sys_config_getprivs(Remote *remote, Packet *packet)
SE_CREATE_SYMBOLIC_LINK_NAME, SE_CREATE_SYMBOLIC_LINK_NAME,
SE_CREATE_TOKEN_NAME, SE_CREATE_TOKEN_NAME,
SE_DEBUG_NAME, SE_DEBUG_NAME,
SE_DELEGATE_SESSION_USER_IMPERSONATE_NAME,
SE_ENABLE_DELEGATION_NAME, SE_ENABLE_DELEGATION_NAME,
SE_IMPERSONATE_NAME, SE_IMPERSONATE_NAME,
SE_INC_BASE_PRIORITY_NAME, SE_INC_BASE_PRIORITY_NAME,

70
python/meterpreter/ext_server_stdapi.py

@ -1258,40 +1258,42 @@ def stdapi_sys_config_getprivs(request, response):
return error_result_windows(), response return error_result_windows(), response
priv_list = [ priv_list = [
"SeAssignPrimaryTokenPrivilege", "SeAssignPrimaryTokenPrivilege", # SE_ASSIGNPRIMARYTOKEN_NAME
"SeAuditPrivilege", "SeAuditPrivilege", # SE_AUDIT_NAME
"SeBackupPrivilege", "SeBackupPrivilege", # SE_BACKUP_NAME
"SeChangeNotifyPrivilege", "SeChangeNotifyPrivilege", # SE_CHANGE_NOTIFY_NAME
"SeCreatePagefilePrivilege", "SeCreateGlobalPrivilege", # SE_CREATE_GLOBAL_NAME
"SeCreatePermanentPrivilege", "SeCreatePagefilePrivilege", # SE_CREATE_PAGEFILE_NAME
"SeCreateTokenPrivilege", "SeCreatePermanentPrivilege", # SE_CREATE_PERMANENT_NAME
"SeDebugPrivilege", "SeCreateSymbolicLinkPrivilege", # SE_CREATE_SYMBOLIC_LINK_NAME
"SeIncreaseBasePriorityPrivilege", "SeCreateTokenPrivilege", # SE_CREATE_TOKEN_NAME
"SeIncreaseQuotaPrivilege", "SeDebugPrivilege", # SE_DEBUG_NAME
"SeLoadDriverPrivilege", "SeDelegateSessionUserImpersonatePrivilege", # SE_DELEGATE_SESSION_USER_IMPERSONATE_NAME
"SeLockMemoryPrivilege", "SeEnableDelegationPrivilege", # SE_ENABLE_DELEGATION_NAME
"SeMachineAccountPrivilege", "SeImpersonatePrivilege", # SE_IMPERSONATE_NAME
"SeProfileSingleProcessPrivilege", "SeIncreaseBasePriorityPrivilege", # SE_INC_BASE_PRIORITY_NAME
"SeRemoteShutdownPrivilege", "SeIncreaseQuotaPrivilege", # SE_INCREASE_QUOTA_NAME
"SeRestorePrivilege", "SeIncreaseWorkingSetPrivilege", # SE_INC_WORKING_SET_NAME
"SeSecurityPrivilege", "SeLoadDriverPrivilege", # SE_LOAD_DRIVER_NAME
"SeShutdownPrivilege", "SeLockMemoryPrivilege", # SE_LOCK_MEMORY_NAME
"SeSystemEnvironmentPrivilege", "SeMachineAccountPrivilege", # SE_MACHINE_ACCOUNT_NAME
"SeSystemProfilePrivilege", "SeManageVolumePrivilege", # SE_MANAGE_VOLUME_NAME
"SeSystemtimePrivilege", "SeProfileSingleProcessPrivilege", # SE_PROF_SINGLE_PROCESS_NAME
"SeTakeOwnershipPrivilege", "SeRelabelPrivilege", # SE_RELABEL_NAME
"SeTcbPrivilege", "SeRemoteShutdownPrivilege", # SE_REMOTE_SHUTDOWN_NAME
"SeCreateGlobalPrivilege", "SeRestorePrivilege", # SE_RESTORE_NAME
"SeCreateSymbolicLinkPrivilege", "SeSecurityPrivilege", # SE_SECURITY_NAME
"SeEnableDelegationPrivilege", "SeShutdownPrivilege", # SE_SHUTDOWN_NAME
"SeImpersonatePrivilege", "SeSyncAgentPrivilege", # SE_SYNC_AGENT_NAME
"SeIncreaseWorkingSetPrivilege", "SeSystemEnvironmentPrivilege", # SE_SYSTEM_ENVIRONMENT_NAME
"SeManageVolumePrivilege", "SeSystemProfilePrivilege", # SE_SYSTEM_PROFILE_NAME
"SeRelabelPrivilege", "SeSystemtimePrivilege", # SE_SYSTEMTIME_NAME
"SeSyncAgentPrivilege", "SeTakeOwnershipPrivilege", # SE_TAKE_OWNERSHIP_NAME
"SeTimeZonePrivilege", "SeTcbPrivilege", # SE_TCB_NAME
"SeTrustedCredManAccessPrivilege", "SeTimeZonePrivilege", # SE_TIME_ZONE_NAME
"SeDelegateSessionUserImpersonatePrivilege" "SeTrustedCredManAccessPrivilege", # SE_TRUSTED_CREDMAN_ACCESS_NAME
"SeUndockPrivilege", # SE_UNDOCK_NAME
"SeUnsolicitedInputPrivilege" # SE_UNSOLICITED_INPUT_NAME
] ]
for privilege in priv_list: for privilege in priv_list:
luid = LUID() luid = LUID()