Abstract

Back in early 2014, a new privilege escalation vulnerability was publicly disclosed, detailing a new way of performing a local NTLM reflection attack leveraging a DCOM trigger. Since then, a new Pandora's box has been opened, starting the "dynasty" of a series of exploits known as "Potatoes". Each exploit in this series relies on the DCOM trigger as its core exploitation method.

Most of these exploits allow an attacker to break the WSH (Windows Service Hardening) boundary, enabling privilege escalation from a limited service to SYSTEM: a common scenario when dealing with web services like IIS or MSSQL.

Interestingly, Microsoft does not consider WSH a security boundary but rather a safety boundary; for this reason, many Potato exploits work (and have been working) on fully updated Windows systems. Moreover, recent iterations of the Potato exploits enable privilege escalation even from an unprivileged user, eliminating the prerequisite of running as a service. Among these, our latest Potato exploit, LocalPotato (also known as CVE-2023-21746), stands out. This exploit employs a specific type of NTLM reflection attack targeting local authentication, and it allows for arbitrary file read/write and privilege escalation, all starting from an unprivileged user account.

In this talk, we will present our journey into the discovery of our Potato exploits, including RoguePotato, RemotePotato0, JuicyPotatoNG and LocalPotato. We'll delve into the vulnerabilities, the fixes, and the bypasses of those fixes, unfolding an intricate story of how a single unfixed bug has led to a long-running history of privilege escalation vulnerabilities on Windows systems.

As a bonus demo for the conference, we will release a new variant of LocalPotato that exploits the HTTP protocol and has been classified as "won't fix" by Microsoft, so it still works on updated systems.