Lab 10.2: Exploitation of IPC Services

Learning Objectives

By the end of this lab, you will be able to:

• Understand vulnerabilities related to Windows IPC
• Identify misconfigured IPC services
• Understand "Potato" type attacks
• Analyze token impersonation risks
• Implement appropriate defenses

Estimated Duration

50 minutes

Prerequisites

• Lab 10.1 completed
• Windows 10/11 VM
• Administrator rights
• Basic knowledge of Windows tokens

Professional Context

IPC vulnerabilities are exploited in:

• 70% of Windows privilege escalations
• Potato-type attacks (JuicyPotato, PrintSpoofer, etc.)
• Lateral movement in Active Directory environments
• Advanced malware and APTs

---

ETHICAL AND LEGAL WARNING

This lab is strictly educational.

The techniques presented are used by:

• Pentesters during authorized tests
• Red Teams for attack simulations
• Security teams to understand threats

PROHIBITED without explicit authorization:

• On production systems
• On machines you do not own
• For malicious purposes

---

Part 1: Understanding Windows Tokens

Step 1.1: Types of tokens

Windows uses tokens to manage identity and privileges:

Type	Description	Usage
Primary Token	Main process token	Process identity
Impersonation Token	Temporary token	Act on behalf of another user

Impersonation levels:

• SecurityAnonymous: No client information
• SecurityIdentification: Can identify but not act
• SecurityImpersonation: Can act locally
• SecurityDelegation: Can act over the network

Step 1.2: View your current token

# Current token information
whoami /all

# Token privileges
whoami /priv

Questions:

1. What privileges do you have?
2. Is the SeImpersonatePrivilege present?

Step 1.3: Who has SeImpersonatePrivilege?

By default, this privilege is granted to:

• LOCAL SERVICE
• NETWORK SERVICE
• Administrators
• Windows Services

# Check if you have the privilege
(whoami /priv) | Select-String "SeImpersonate"

---

Part 2: Impersonation Vulnerability via Pipes

Step 2.1: The attack concept

1. Attacker creates a named pipe with weak permissions
2. A privileged process (SYSTEM) connects to the pipe
3. The attacker "impersonates" the SYSTEM token
4. The attacker executes code as SYSTEM

Step 2.2: Necessary conditions

To exploit this vulnerability:

• Have SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege
• Be able to create a named pipe
• Be able to force a privileged process to connect to it

Step 2.3: Historical vulnerable services

Service	Vulnerability	CVE
Print Spooler	SpoolFool, PrintNightmare	CVE-2021-1675
BITS	Token impersonation	Multiple
WMI	DCOM activation	Multiple
MSDTC	Token impersonation	Multiple

---

Part 3: "Potato" Attack Family

Step 3.1: Overview

"Potato" attacks exploit IPC for privilege escalation:

Name	Year	Method
Hot Potato	2016	NBNS + WPAD spoofing
Rotten Potato	2016	DCOM + NTLM relay
Juicy Potato	2018	DCOM CLSID abuse
Rogue Potato	2020	Fake OXID resolver
Sweet Potato	2020	Combination techniques
PrintSpoofer	2020	Print Spooler pipe
GodPotato	2022	New DCOM technique

Step 3.2: General operation

[Service with SeImpersonate]
        |
        v
[Create a pipe or listener]
        |
        v
[Force SYSTEM to connect via DCOM/Spooler/etc.]
        |
        v
[Capture the SYSTEM token]
        |
        v
[Execute command as SYSTEM]

Step 3.3: PrintSpoofer - Conceptual example

PrintSpoofer exploits the Print Spooler service:

1. The spooler has a feature that connects to pipes
2. Create a pipe with a specific name
3. Trigger the spooler's connection
4. Impersonate the spooler's SYSTEM token

Note: We do not execute the exploit, but understand the mechanism.

---

Part 4: Detecting IPC Attacks

Step 4.1: Indicators of Compromise (IOC)

Suspicious pipes:

# Search for pipes with unusual names
Get-ChildItem \\.\pipe\ | Where-Object {
    $_.Name -match "(spoof|potato|pipe[0-9]|test)"
}

Suspicious processes:

# Processes with SeImpersonatePrivilege that shouldn't have it
Get-Process | ForEach-Object {
    $proc = $_
    try {
        $token = [System.Security.Principal.WindowsIdentity]::GetCurrent()
        # Privilege analysis...
    } catch {}
}

Step 4.2: Sysmon Events

# Event ID 17: Pipe Created
Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-Sysmon/Operational'
    ID = 17
} -MaxEvents 50 | Where-Object {
    $_.Message -match "(spoof|potato)"
} | Format-Table TimeCreated, Message -Wrap

# Event ID 18: Pipe Connected
Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-Sysmon/Operational'
    ID = 18
} -MaxEvents 50 | Format-Table TimeCreated, Message -Wrap

Step 4.3: Security Log Events

# Event ID 4688: Process Creation with impersonation
Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    ID = 4688
} -MaxEvents 100 | Where-Object {
    $_.Message -match "Impersonation"
}

Questions: 3. What events did you find? 4. How would you detect a Potato attack?

---

Part 5: Defenses and Hardening

Step 5.1: Reducing the attack surface

Disable unnecessary services:

# Check the status of the Print Spooler
Get-Service Spooler

# Disable if not needed (CAUTION in production!)
# Stop-Service Spooler
# Set-Service Spooler -StartupType Disabled

Step 5.2: Restrict SeImpersonatePrivilege

Via Local Security Policy:

1. secpol.msc
2. Local Policies > User Rights Assignment
3. "Impersonate a client after authentication"
4. Remove unnecessary groups

Step 5.3: Enable protections

Windows Defender Credential Guard:

# Check if Credential Guard is active
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard

LSA Protection:

# Check LSA Protection
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL"

Step 5.4: Security check script

# IPC configuration security check script
Write-Host "=== IPC SECURITY CHECK ===" -ForegroundColor Cyan

# 1. Print Spooler
$spooler = Get-Service Spooler -ErrorAction SilentlyContinue
if ($spooler.Status -eq "Running") {
    Write-Host "[!] Print Spooler is active" -ForegroundColor Yellow
} else {
    Write-Host "[OK] Print Spooler is inactive" -ForegroundColor Green
}

# 2. Unusual pipes
$suspectPipes = Get-ChildItem \\.\pipe\ | Where-Object {
    $_.Name -match "(spoof|potato|test[0-9])"
}
if ($suspectPipes) {
    Write-Host "[!] Suspicious pipes detected:" -ForegroundColor Red
    $suspectPipes | ForEach-Object { Write-Host "    $_" }
} else {
    Write-Host "[OK] No suspicious pipes" -ForegroundColor Green
}

# 3. SeImpersonatePrivilege
if ((whoami /priv) -match "SeImpersonate.*Enabled") {
    Write-Host "[INFO] SeImpersonatePrivilege is active" -ForegroundColor Yellow
}

Write-Host "`n=== END OF CHECK ===" -ForegroundColor Cyan

Questions: 5. Is your system vulnerable to Potato attacks? 6. What measures would you implement?

---

Part 6: Practical Exercise

Step 6.1: Complete audit

Perform an audit of your VM:

1. List all services with SeImpersonatePrivilege
2. Identify active pipes and their owner
3. Check the status of risky services (Spooler, BITS, etc.)
4. Analyze logs for suspicious pipe connections

Step 6.2: Audit report

Create a report including:

• Current IPC security status
• Identified risks
• Remediation recommendations

---

Deliverables

1. Audit report (2-3 pages):

   • Inventory of risky services
   • Privilege analysis
   • Recommendations

2. Screenshots:

   • whoami /priv
   • List of pipes
   • Executed verification script

3. Answers to the 6 questions

---

Evaluation Criteria

Criterion	Points
Understanding of tokens	20%
Analysis of Potato attacks	25%
Detection implementation	25%
Security recommendations	30%

---

Reference Commands

# Privileges
whoami /priv
whoami /all

# Services
Get-Service Spooler, BITS, WMI

# Pipes
Get-ChildItem \\.\pipe\

# Events
Get-WinEvent -FilterHashtable @{LogName='Security';ID=4688}
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational';ID=17,18}

# Configuration
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"

---

Additional Resources

• Token Manipulation - MITRE ATT&CK
• Potato Family Exploits
• PrintSpoofer Analysis

---

Lab developed as part of the Operating Systems course - MODULE 10