0

The simple skill to escalate the process to SYSTEM privilege is using SeDebugPrivilege :

  1. Write the program which enable the SeDebugPrivilege value of the process.
  2. After enable the SeDebugPrivilege the process can open any other process token such as winlogon.exe which is launched by system account.
  3. When get the winlogon.exe access token then impersonate the token and use it to lauch the other process , and the process will have system privilege.

The above skill needs the program to be launched by the account that already has SeDebugPrivilege but just not enable.

However, the PSExec could launch the process by the account which doesn't have SeDebugPrivilege. Why ? Does it use the SeDebugPrivilege skill ?

If i remove the SeDebugPrivilege from the admin account. The skill will fail , because it need to enable the SeDebugPrivilege but current admin account doesn't have it.

Does PSExec create the local system service and use this service to lauch the process ? On the other hand , is there any skill can lauch the process with system account without SeDebugPrivilege ?

Improve this question
3
  • What's the question here? Whether the system has any built-in functionality to make it easy to implement privilege escalation? For anyone? Commented Jul 30, 2024 at 10:52
  • at first SeDebugPrivilege not need. what is need - be able open process and it token. have the SeDebugPrivilege help do this, but in most case have admin group in token is enouth. Commented Jul 30, 2024 at 13:30
  • "Does PSExec create the local system service and use this service to lauch the process ?" - yes, it does. See itprotoday.com/server-management-tools/… for details Commented Jul 30, 2024 at 14:53
Related questions
1
Running Process in system context
0
PsExec could not start app: The system cannot find the file specified
0
Windows launch process with/without console
Load 5 more related questions Show fewer related questions

0

Reset to default

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.