PSExec Privilege Escalation

PsExec is a Sysinternals utility designed to allow administrators to perform various activities on remote computers, such as launching executables and displaying the output on the local computer or creating reverse shells.

Due to the tool’s versatility, threat actors commonly use PsExec in their post-exploitation toolkits to spread laterally to other machines on a network, execute commands on a large number of devices simultaneously, or deploy malware such as ransomware.

Last year, Tenable researcher discovered a vulnerability in the PsExec’s named pipe communications that allow local users to elevate to SYSTEM privileges.

“This local privilege escalation allows a non-admin process to escalate to SYSTEM if PsExec is executed locally or remotely on the target machine. This works from Windows 10 all the way back to XP and from my investigation, it affects PsExec v2.2 all the way back to v1.72 (2006)

Microsoft released PsExec version 2.30 to resolve the vulnerability. However, Wells stated that minor adjustments to his PoC could bypass the fix. But that version too has the issue.

Microsoft released PsExec v2.33, which includes a new fix for the named pipe local privilege elevation vulnerability.

“This update to PsExec mitigates named pipe squatting attacks that can be leveraged by an attacker to intercept credentials or elevate to System privilege. the -i command line switch is now necessary for running processes interactively, for example with redirected IO,” reads the PsExec v2.33 release notes.

Tenable has confirmed with BleepingComputer that this release has fixed the vulnerability.