> For the complete documentation index, see [llms.txt](https://duc193.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://duc193.gitbook.io/notes/redteam/window-privilege-escalation/communication-with-processes.md). # Communication with Processes Có 1 phương pháp đơn giản để Privilege Escalation là leo từ các service đang chạy trong máy đã foothold được. Bởi vì có thể 1 service đang chạy dưới 1 user có quyền cao hơn, như admin chẳng hạn thì chúng ta từ user quyền thấp có thể tìm cách để chiếm cái process đang chạy service đó. ### Enumerating Network Services ```powershell netstat -ano ``` ```shellscript Active Connections Proto Local Address Foreign Address State PID TCP 0.0.0.0:21 0.0.0.0:0 LISTENING 3812 TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 836 TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4 TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING 936 ``` map sang service đang chạy bằng ```powershell tasklist /svc /FI "PID eq " ``` Sau đó có thể enum coi nó chạy bằng user gì, nếu user quyền cao mà chạy các service bị lỗ hổng thì có thể exploit nó để leo quyền. ### Named Pipes Thì pipe trong Window là đường ống giao tiếp giữa các process với nhau, ví dụ có 2 process A và B Thì chúng giao tiếp, truyền tải dữ liệu với nhau bằng pipe (giống như kiểu 1 file để 2 process có thể ghi dữ liệu vào, đọc nó,...) Và khi có quyền để sửa file pipe thì chúng ta có thể chèn malicious data vào để attack nếu process sử dụng pipe đó. **Listing Named Pipes with Pipelist** 
pipelist.exe /accepteula
```shellscript PipeList v1.02 - Lists open named pipes Copyright (C) 2005-2016 Mark Russinovich Sysinternals - www.sysinternals.com Pipe Name Instances Max Instances --------- --------- ------------- InitShutdown 3 -1 lsass 4 -1 ntsvcs 3 -1 scerpc 3 -1 Winsock2\CatalogChangeListener-340-0 1 1 Winsock2\CatalogChangeListener-414-0 1 1 epmapper 3 -1 Winsock2\CatalogChangeListener-3ec-0 1 1 Winsock2\CatalogChangeListener-44c-0 1 1 LSM_API_service 3 -1 atsvc 3 -1 Winsock2\CatalogChangeListener-5e0-0 1 1 eventlog 3 -1 Winsock2\CatalogChangeListener-6a8-0 1 1 spoolss 3 -1 Winsock2\CatalogChangeListener-ec0-0 1 1 wkssvc 4 -1 trkwks 3 -1 vmware-usbarbpipe 5 -1 srvsvc 4 -1 ROUTER 3 -1 vmware-authdpipe 1 1 ``` **Listing Named Pipes with PowerShell** ```bash gci \\.\pipe\ ``` ```bash Directory: \\.\pipe Mode LastWriteTime Length Name ---- ------------- ------ ---- ------ 12/31/1600 4:00 PM 3 InitShutdown ------ 12/31/1600 4:00 PM 4 lsass ------ 12/31/1600 4:00 PM 3 ntsvcs ------ 12/31/1600 4:00 PM 3 scerpc Directory: \\.\pipe\Winsock2 Mode LastWriteTime Length Name ---- ------------- ------ ---- ------ 12/31/1600 4:00 PM 1 Winsock2\CatalogChangeListener-34c-0 Directory: \\.\pipe Mode LastWriteTime Length Name ---- ------------- ------ ---- ------ 12/31/1600 4:00 PM 3 epmapper ``` **Reviewing LSASS Named Pipe Permissions** ```bash accesschk.exe /accepteula \\.\Pipe\lsass -v ``` ```bash Accesschk v6.12 - Reports effective permissions for securable objects Copyright (C) 2006-2017 Mark Russinovich Sysinternals - www.sysinternals.com \\.\Pipe\lsass Untrusted Mandatory Level [No-Write-Up] RW Everyone FILE_READ_ATTRIBUTES FILE_READ_DATA FILE_READ_EA FILE_WRITE_ATTRIBUTES FILE_WRITE_DATA FILE_WRITE_EA SYNCHRONIZE READ_CONTROL RW NT AUTHORITY\ANONYMOUS LOGON FILE_READ_ATTRIBUTES FILE_READ_DATA FILE_READ_EA FILE_WRITE_ATTRIBUTES FILE_WRITE_DATA FILE_WRITE_EA SYNCHRONIZE READ_CONTROL RW APPLICATION PACKAGE AUTHORITY\Your Windows credentials FILE_READ_ATTRIBUTES FILE_READ_DATA FILE_READ_EA FILE_WRITE_ATTRIBUTES FILE_WRITE_DATA FILE_WRITE_EA SYNCHRONIZE READ_CONTROL RW BUILTIN\Administrators FILE_ALL_ACCESS ``` #### Example Attack : [WindscribeService Named Pipe Privilege Escalation](https://www.exploit-db.com/exploits/48021)\ \ \
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://duc193.gitbook.io/notes/redteam/window-privilege-escalation/communication-with-processes.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.