Add 'CanRestart' to output and Pester tests

Pester tests to the function 'Test-ServiceDaclPermission' were added in
order to increase confidence in its reliability. In general, my
intention was to replace the current functionality of the service
management functions such as Invoke-ServiceStart, to not use blindly
'sc.exe start' but rather consult with the DACL permissions and base the
decision on that. Unforunately, further investigation lead me to the
conclusion that retrieval of the service's DACL permissions requires
that an additional DACL permission (RC) be set. This may lead to an edge
case that could miss a potential privilege escalation condition and
thereby the original idea was discarded. Nonetheless,
'Test-ServiceDaclPermission' can be used for less critical tasks.
Therefore, a 'CanRestart' property was added to the output of the
service enumeration functions such as 'Get-ServiceUnquoted' as I think
that it will add value to redteamers/pentesters by helping them
prioritise which service should be abused for escalation of privileges.
Services that can be restarted by a low privileged user will probably be
prioritised first. Additionally, manual checking whether the vulnerable
service can be restarted would not be required in most cases.

1 files changed, 131 insertions, 0 deletions

diff --git a/Tests/Privesc.tests.ps1 b/Tests/Privesc.tests.ps1
index 095c946..56dfd2c 100644
--- a/Tests/Privesc.tests.ps1
+++ b/Tests/Privesc.tests.ps1
@@ -74,6 +74,137 @@ Describe 'Get-ModifiableFile' {
     }
 }
 
+Describe 'Test-ServiceDaclPermission' {
+
+    if(-not $(Test-IsAdmin)) { 
+        Throw "'Test-ServiceDaclPermission' Pester test needs local administrator privileges."
+    }
+    
+    It "Should fail finding 'sc.exe'." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        $DirectoryName = Get-RandomName
+        $env:SystemRoot = 'C:\\' + $DirectoryName
+        { Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' } | Should Throw "sc.exe not found"
+        
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+        $env:SystemRoot = 'C:\Windows'
+    }
+    
+    It "Should succeed finding 'sc.exe'." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        $DirectoryName = Get-RandomName
+        New-Item -Path $env:Temp -Name "$DirectoryName\System32" -ItemType Directory
+        New-Item -Path $env:Temp -Name "$DirectoryName\System32\sc.exe" -ItemType File
+        $env:SystemRoot = $env:Temp + "\$DirectoryName"
+        Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' | Should Be $True
+        
+        Remove-Item -Recurse -Force "$env:Temp\$DirectoryName"
+        $env:SystemRoot = 'C:\Windows'
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+    }
+    
+    It "Should fail querying WMI for a non-existent service." {
+        $ServiceName = Get-RandomName
+        { Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' } | Should Throw "not found on the machine"
+    }
+    
+    It "Should succeed querying WMI for an existenting service." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' | Should Be $True
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+    }
+    
+    It "Should fail querying WMI for an existing service due to insufficient DACL permissions." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        $UserSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.value
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        sc.exe sdset $ServiceName "D:(A;;CCDCSWRPWPDTLOCRSDRCWDWO;;;$UserSid)" | Should Match "SUCCESS"
+        { Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' } | Should Throw "not found on the machine"
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+    }
+    
+    It "Should succeed querying WMI for an existing service due to sufficient DACL permissions." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        $UserSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.value
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        sc.exe sdset $ServiceName "D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$UserSid)" | Should Match "SUCCESS"
+        Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' | Should Be $True
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+    } 
+    
+    It "Should fail running 'sc.exe sdshow' due to insufficient permissions." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        $UserSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.value
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        sc.exe sdset $ServiceName "D:(A;;CCDCLCSWRPWPDTLOCRSDWDWO;;;$UserSid)" | Should Match "SUCCESS"
+        { Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' } | Should Throw "Could not retrieve DACL permissions"
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+    }
+    
+    It "Should succeed running 'sc.exe sdshow' due to sufficient permissions." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        $UserSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.value
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        sc.exe sdset $ServiceName "D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$UserSid)" | Should Match "SUCCESS"
+        Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' | Should Be $True
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+    }
+    
+    it "Should fail finding the service DACL value of 'WP' for the current user." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        sc.exe sdset $ServiceName "D:(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;S-1-5-4)" | Should Match "SUCCESS"
+        Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'WP' | Should Be $False
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+    }
+    
+    it "Should succeed finding the service DACL value of 'WP' for the current user." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        sc.exe sdset $ServiceName "D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-4)" | Should Match "SUCCESS"
+        Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'WP' | Should Be $True
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+    }
+}
 
 ########################################################
 #