crisprss/magicnetdefsSimilar to Petitpotam, the netdfs service is enabled in Windows Server and AD environments, and the abused RPC method allows privileged processes to access malicious pipes for exploitation
https://github.com/Wh04m1001/DFSCoerce
Further updates are being considered; for now this only verifies the exploitability of the RPC method. Specific exploitation of the SYSTEM token is planned for later.
Utilizes the MS-DFSNM protocol https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dfsnm/95a506a8-cae6-4c42-b19d-9c1ed1223979
It provides the RPC method NetrDfsRemoveStdRoot, which can perform UNC spoofing to make privileged processes access a custom pipe:
The limitations mainly lie in two aspects. First, this service only targets Windows Server or domain environments:
Second, the token privileges of dfssvc.exe are very limited:
Later, we plan to consider abusing SeRestorePrivilege or SeBackupPrivilege to perform some sensitive operations.
