SweetPotato icon indicating copy to clipboard operation
SweetPotato copied to clipboard

Added trigger for remotePotat0 exploit

Open MrAle98 opened this issue 2 years ago • 0 comments

I've added the possibility to trigger the NTLM authentication of a computer/user account against a remote endpoint, in order to relay the NTLM messages towards an LDAPS/LDAP endpoint on a DC and then elevate privileges. Running this attack doesn't even require to have SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege. This technique was described here: https://www.sentinelone.com/labs/relaying-potatoes-another-unexpected-privilege-escalation-vulnerability-in-windows-rpc-protocol/

A possible use case of this feature is described in this PR on the impacket library: https://github.com/SecureAuthCorp/impacket/pull/1299

MrAle98 avatar Apr 20 '22 18:04 MrAle98