RpcSsImpersonator

December 10, 2021 ยท View on GitHub

Privilege Escalation Via RpcSs svc

You can also use this via Metasploit Framework. https://github.com/rapid7/metasploit-framework/pull/14030

  1. Administrator to SYSTEM

  2. Network Service Account to SYSTEM

test1

Based On:

https://www.tiraniddo.dev/2020/04/sharing-logon-session-little-too-much.html
https://windows-internals.com/faxing-your-way-to-system/

Credit to: @tiraniddo (James Forshaw) and Yarden Shafir & Alex Ionescu (@aionescu)