ServiceUI.exe

0:00Penetration testers and ethical hackers,

0:02I have a few tricks to share with you to

0:05add to your toolkit. So, credit where

0:07credit is due. This one comes from a

0:09blog post that I've seen previously on

0:11secureyouit.co.uk,

0:14just another pentesting site. And this

0:16blog is put together by Richard Davyy.

0:19The contact page on his blog references

0:21his handle or alias rd_pentest.

0:24And you can find that on Twitter or X.

0:26I'll leave the link to this post in the

0:28video description. And I will preface,

0:29maybe you might consider this old

0:31because it was released on November 2nd

0:33of 2024 last year. So old for what you

0:36might call it and maybe folks are

0:38familiar with this, but I did wanted to

0:39bring to your attention. While the title

0:41here is living off the land, I think

0:43there are some other tricks to this.

0:45Previously, he was performing a laptop

0:47build review, just trying to see what

0:49was possible if any potential employees

0:51or new onboarded team members might

0:53actually end up being able to break out

0:55of what was supposed to be a secure

0:57build. Now, he was exploring the

0:59Microsoft Software Center that you might

1:01be used to and maybe you've seen in

1:02organizations or different businesses.

1:05But this post isn't specifically about

1:07vulnerabilities while looking at the

1:09Microsoft Software Center. It's more of

1:11one of the unique binaries or programs

1:14that he's found while looking at that

1:15that has been a little bit more useful.

1:18This is service.exe.

1:21ServiceU.exe

1:23is a Microsoftsigned binary. It's coming

1:26from Microsoft. So, it's legitimate.

1:28It's signed. It's got the code

1:30certificate there and it looks as valid

1:32as possible cuz it's from Microsoft.

1:35That I think is the nod to living off

1:37the land as we might be accustomed to

1:39with LOLS or LOL bins like binaries that

1:42aren't native and installed on your

1:43computer, but this might not be. So, we

1:46could pull this binary in and you're

1:48still using a trusted legitimate signed

1:51Microsoft program. Anyway, service

1:53UI.exe exe is included inside of a

1:56Microsoft deployment toolkit. So, we

1:58have a link here and again I'll share

2:00that in the video description for you to

2:01reference as well. So, let's go ahead

2:03and download this Microsoft deployment

2:05kit. And you'll note this actually

2:07includes different MSI or Microsoft

2:09installer packages. You can choose

2:11whatever is pertinent for a 32-bit

2:13architecture or 64-bit architecture, x86

2:16or x64, respectively. I'll go for the

2:1964-bit one. And while that is

2:21downloading, I do want to show you

2:22something else super cool. So, for our

2:25penetration tester friends, please let

2:26me take just a few moments to tell you

2:28about the sponsor of today's video,

2:30Attack Forge. Overwhelmed with pentest

2:33data and reporting, chaotic workflows

2:35slowing down your offensive security

2:37testing? If only there were a single

2:39source of truth, bringing teams and

2:41stakeholders together. That's Attack

2:44Forge. With Attack Forge, you can

2:46delegate tasks to team members, monitor

2:49testing progress, and align your testing

2:51coverage for both internal and external

2:54compliance mandates. Track testing

2:57outcomes, link vulnerabilities to action

2:59tests, and collaborate on red team and

3:02purple team assessments, and let it do

3:04the work for you. Leverage centralized

3:07libraries for fast and easy registration

3:09of vulnerabilities with unlimited custom

3:12reports on demand and leveraging your

3:15existing templates. Attack Forge Flows

3:18automates offensive security workflows

3:20integrating with ticketing, messaging,

3:23bug bounty, threat intelligence

3:24platforms, and so much more. Using

3:27flows, you can trigger scans,

3:29notifications, and custom actions. All

3:32to save time and enhance enterprise

3:34collaboration. Attack Forge is your

3:36central platform for managing

3:38penetration tests with real-time

3:40reporting, collaboration, and full

3:43visibility. It brings all your offensive

3:45security data and workflows into one

3:48place for faster tests, better reports,

3:51and total control. You can get started

3:54with Attackforge with an ondemand and

3:56self-service free trial with my link

3:58below in the video description,

4:00jh.live/attackforge.

4:03Huge thanks to Attackforge for

4:05sponsoring this video.

4:07All right, now I've got the Microsoft

4:10Deployment Toolkit downloaded and

4:11available here on my desktop in a

4:13Windows 11 virtual machine. And I want

4:16to go ahead and get this cruising. I'll

4:18click through all the next next. Let

4:20this thing install. And let me please

4:22say that this is the MSI package that

4:25contains all of this info. That includes

4:27the service UI.exe exe binary, but that

4:30doesn't mean that you have to bring in

4:32or ship this entire MSI and then follow

4:35through the installation steps just to

4:36get the binary. Once you have this set,

4:38maybe even download it on a separate

4:40computer, a completely different host,

4:42then you could go grab the actual

4:45executable that is now available in your

4:47program files, Microsoft Deployment

4:50Toolkit in the templates directory under

4:53the distribution here, and then the

4:55tools that follow suit in either x64 or

4:58x86. I'll get x64 and I'll scroll down

5:02to find our service UI.exe.

5:04This is really all we need. In fact, I

5:07could just copy this, go put it on our

5:10desktop, and then it doesn't need to be

5:11in that entire folder or directory that

5:14this came from from the MSI package.

5:16Anyway, I say that just that you know,

5:18you don't need that full MSI. You just

5:21need service UI.exe. Now, this is one

5:24though that might very well require some

5:27graphical user interface and like actual

5:29interaction with the desktop

5:31environment. uh you might have some

5:33difficulty scripting this or automating

5:35this from a command line procedural

5:37method but let me show you some other

5:39tricks that could still let this happen

5:40in that desktop. Let me try and run our

5:42service UI.exe and it gives us some of

5:45the help information execute a program

5:48interactively in a target session. It

5:50says it must run from the system

5:52context. Let's go back to the blog post

5:55and read more about this. Now if you've

5:57got this downloaded and you're following

5:58along, they note executing service

6:00UI.exe exe gives the following options

6:02just as we saw a simple test for code

6:05execution. We can run service UI and

6:08then the full path. They're using the

6:10command line or cmd.exe

6:13environment variables here. You'll

6:14notice the percent signs wrapping around

6:16the variable name for the Windows

6:18directory that fills in the absolute

6:20path C back/ Windows back/notepad.exe.

6:25That would launch Notepad. So, this

6:28truth be told is pretty simple and easy,

6:30right? I'm in PowerShell right now. So,

6:33without needing to use the percent signs

6:35as you would in cmd.exe or use the

6:37dollar sign, envir

6:41C back/ Windows notepad.exe. Now, this

6:45errors because it needs a loon session

6:48like a valid interactive graphical user

6:50interface and logical session. They had

6:53success when they ran this, but that was

6:55because they ran it as the local

6:57administrator. Now, my user account is

6:59in the administrators group, but I did

7:01not open up this terminal with

7:03administrator privileges. Opening up

7:04with like control shift enter. Let me

7:06show you. Control shift enter. As I open

7:09up the terminal and going through the

7:10user account control popup, if I were to

7:12do this very same thing, let me see if

7:14that will behave. Let's run with our

7:17Windows Notepad.exe test. That executes

7:20and Notepad opens up. Now, there are a

7:22couple of gimmicks and some nuance that

7:23I want to talk about because if we were

7:25to use a command like query user, we'd

7:28be able to see that there is in fact an

7:30actual session with session ID1 for my

7:34user. When we tried to run service

7:36UI.exe with our low privilege that

7:38didn't happen, even though there is

7:40something that should be there. So, this

7:42is usually when people in the YouTube

7:44comments tend to roll their eyes and

7:45say, "Well, yeah, if you have local

7:47admin privileges to be able to run and

7:49do whatever than you're already admin,

7:51what more is there? You could do

7:52whatever you want." Well, sort of. There

7:54is an element of truth to that, and I

7:56won't deny it, but we could go even

7:58higher, like gaining privileges as anti-

8:01authority system or in some cases

8:03trusted installer. And let me uh ramble

8:06and rant for a second because I think

8:08it's often overlooked that it is usually

8:10easy to get to local admin privileges in

8:14the offensive security or pentesting

8:16context because usually I mean even for

8:18just your own personal laptop if you're

8:20the only user of this laptop you're more

8:24often than not the local admin. And way

8:27too often in IT industry, security

8:30businesses and companies, maybe

8:32individuals that are given their own

8:33laptop are again the local admin there.

8:36Or way too often users have privileges

8:39and permissions being the admin when

8:41they shouldn't be. Anyway, I think that

8:43always has a worthwhile grain of salt to

8:46uh be included in that conversation. So

8:48on the basis that we've achieved local

8:50administrator privileges, again, we use

8:52that as a starting point. even eentire

8:55in a recent thread intel write up in a

8:56blog post for uh night shade C2 and this

8:59is an anecdote I'm sorry but they cover

9:01how they use this UAC prompt bombing

9:04they will repeatedly pop open the UAC

9:07prompt over and over and over again

9:10until the user clicks yes and allows the

9:13malware or payload to run as admin sorry

9:16say we want to gain an interactive

9:19system shell now we've covered this in a

9:21couple other videos normally noting okay

9:23you to do this via the taskuler or

9:26scheduled tasks on Windows. And Richard

9:29Davyy walks through this operation where

9:31you can do this via the graphical user

9:33interface. Just setting up a new task

9:35and then having it run service UI with

9:38whatever you want and then it'll execute

9:39as system and he showcases this query

9:42user technique as you would to be able

9:43to find a specific loon session but that

9:46would get you where you want to go. So

9:47on its own service UI.exe exe still can

9:51act as like a sort of execution cradle.

9:55And I think that's a point worth

9:56mentioning. If we were to run service

9:59UI.exe with Windows Notepad.exe,

10:03that will fire and execute. And if I

10:05were to go take a look at process

10:07explorer, that service UI.exe trusted

10:11legitimate Microsoft binary is the

10:13parent of the child process, of course,

10:16right? Oh, and I should be sure to run

10:18this as admin. So let's get UAC prompt

10:20for process explorer. Now let me go hunt

10:22for notepad. Notepad here checks the

10:27parent with pit 4304

10:29which is just what it suggests in

10:32service UI output. Let me try to run

10:34this with like car map. So that way we

10:36might have a process that exists. Oh

10:39system 32. My bad. Okay. Now that will

10:41maintain its execution because there

10:44wasn't like some Microsoft app in the

10:46way. Now let's get back to process

10:47explorer. Here it is. ServiceUI.exe with

10:50carmap.exe as the parent, excuse me, the

10:54child. Here it is. Service UI.exe. And

10:57that is a super teeny weeny small and

11:00tiny trit trivial thing where it could

11:03potentially break some detections,

11:06detection rules, hunting for execution

11:08of malicious binary out of the blue.

11:10Well, now if it's coming from trusted,

11:12legitimate real Microsoft signed binary

11:14that is not something you have rules

11:16for. Eh, just one thing staging that

11:19could still mean a really simple proxy

11:22execution context so that you don't have

11:24a child process out of explorer.exe or

11:27wherever whatever that's more usually

11:30caught and signature. But anyway, let's

11:32get to running this as system using the

11:36taskuler or a scheduled task. Now again,

11:39if you were able to do this via the

11:41graphical user interface, this is the

11:43worthwhile showcase to see how that's

11:45done. But you might more interestingly

11:47want to run this as an automated thing

11:50as commands or scripts or things that

11:52you can stage. Obviously, we'll run this

11:55as system while I change the user and

11:57group with that button click there.

11:58Check the name for system and then run

12:01with highest privileges. The actions

12:03we'll want to create a new startup of a

12:05program from our desktop and the service

12:07UI binary. You could put that wherever.

12:10and the arguments that we would want to

12:11run. Let's do uh car map again just so

12:14we can see that child parent process

12:16chain. carmap.exe. Click okay. Okay. Now

12:20that that's created, let me get to our

12:22library. Let's go go ahead and manually

12:25run or trigger our system cmd. And with

12:29that, you should now see car map

12:31executed while it was hidden and tucked

12:33away from me. But getting back to

12:35process explorer, that should now be

12:37running as system. Can I get to car map?

12:40Yeah, here it is. Service UI.exe.

12:43Carmap.exe. Taking a look at the

12:45properties. And I should have ran this

12:46as admin. I keep forgetting. All right.

12:49Now you can see of course the properties

12:52here. The user executing this is NT

12:54authority system and car map child

12:56process consequently is NT authority

12:59system. You could of course run cmd.exe

13:02to get an interactive shell. You could

13:03run your payload. You could get a

13:05reverse shell. You could drop whatever

13:06you want and that will still have that

13:08entity authority system level

13:10permissions, but that I know is the

13:13graphical user interface method that

13:16might not be as slick and as sexy as we

13:19want. Now, a previous video of mine

13:21walked through going even higher than NT

13:23authority system and elevating to

13:25trusted installer. Now, that had bits

13:28and pieces of the manual steps that you

13:31might walk through, but I just recently

13:33received an email from someone who

13:34watched that video and then took things

13:36a little bit further to try and automate

13:38or streamline that. Now, I did ask

13:40permission if I could share their work

13:41and they said yes, they did want to be

13:43credited as Matthew. So, thank you,

13:45Matthew. And he says, "Hey, I watched

13:46your video on becoming trusted installer

13:48and I took a closer look at the source

13:50behind NTO object manager. I ended up

13:52creating a wrapper for the trust

13:54installer command prompt that not only

13:55spawns the command prompt process but

13:57also enables all privileges like when

14:00you run who am I/priv and you see all

14:02the like se impersonate seed debug se

14:05all the different security tokens or

14:07privileges you might have within Windows

14:09he did something interesting he says for

14:10safety is password protected on a

14:12separate shell to prevent any remote

14:14code execution at the trusted installer

14:16level here's how I did it I took the

14:17ntobject managerdll compressed it and

14:20then converted its contents to base 64.

14:23Then I reversed the process at runtime,

14:25loading the DL into memory so I can use

14:27the raw function calls from NT object

14:29manager. He did this all in PowerShell

14:31and then compiled it into an executable

14:33with PS to exe. And you could do the

14:35very same, but he included a triage

14:37report for the.exe wrapper and then a

14:39zip archive for the source code. I'll

14:41include those links in the video

14:43description. All credit to Matthew. But

14:45this is the PowerShell source code. So

14:47simple trusted cmd.ps1 PS1 where there

14:50are command line arguments to bypass or

14:52force. Looks like it sets the title of

14:54the window to trusted cmd password lock

14:56and he has a couple registry keys

14:58reference and even like a max number of

15:00attempts or lockout for the password

15:03protection. Then he includes a big long

15:05list of all the different SE privileges

15:07or all again all the capability that

15:09this higher elevated command prompt in

15:11session should have. A lot of this is

15:13some boilerplate to be able to test if

15:15it is being used safely with the uh

15:18registry key that's been used to track

15:20all the operations and runtime to use a

15:22password protection on this which are

15:23just kind of nicity bells and whistles

15:25thing. If you wanted to turn this into

15:26an even more automated streamline

15:28tooling you could ignore those cut those

15:30out. But if I turn word rap off then you

15:33can see or on whichever one of those.

15:36Obviously this is the giant base 64 dump

15:38of nobject manager.dll. I think this is

15:42actually very clever. Uh, we did this

15:43exact same thing when we were working

15:44with the print nightmare exploit years

15:46ago. I think that's like 2021. I don't

15:48even remember, but we crammed a whole

15:50DLL inside of a PowerShell script so

15:52that it could then be uh unraveled and

15:55loaded at runtime. Some commented code

15:57here that we could probably again cut

15:59out if we wanted to. But then he brings

16:01in some net or Capability to add in a

16:05bunch of the different variables and

16:07boilerplate that's necessary to be able

16:09to spawn a process. Then it asks for a

16:11password, which we could skip over if we

16:13were to use that force and bypass

16:16command line switch. And then he starts

16:17to work through the things that were

16:19pertinent in that trusted installer

16:21video that will give you even higher

16:22privileges than NT authority system. And

16:24truthfully, that's it. PowerShell script

16:27that just gives you all that power. Once

16:30you have local admin, you can jump up to

16:32system and jump up to trusted installer.

16:35So let's play with it. Let's get back

16:36into our Windows 11 virtual machine.

16:39I'll open up the Windows PowerShell ISE

16:41editor just so I could slap in all of

16:44this code and let's save this again on

16:46our desktop as that trusted cmd.ps1

16:50PowerShell script. Now let's try this in

16:52both cases. Let's open up a terminal and

16:54have that command line access even as a

16:56lowprivilege user. I doubt this will

16:58work but it's worth trying. Can I run

17:01our trusted cmd.ps1 and I'll use the

17:04force and bypass switches. Now this

17:06shouldn't work. Yeah, pretty bloody lot

17:09of different PowerShell errors.

17:11Obviously, uh can't handle HKLM because

17:13you need the permissions to be able to

17:15do that run as admin if you were

17:17modifying the registry. And I don't

17:19think it'd even start or play with the

17:21trusted installer service because it

17:22doesn't have those permissions. So, was

17:24fun, but again, want to draw that point.

17:27Want to make sure that's clear. Knowing

17:28that you need the administrator

17:30privileges is just part of the

17:32operations. Run trusted cmd force and

17:35bypass. And that should pop open a shell

17:39for us. Obviously, this is running as

17:42anti- authority system, but we are in,

17:45if I go take a look at the groups, the

17:48trusted installer group. And if I were

17:51to take a look at my privileges, we have

17:54all of the ones that were included in

17:56that sweet little streamlined script.

17:58So, full control. That's pretty cool.

18:01You might have noticed while we were

18:02playing with that though that that did

18:04start a new console window. So that

18:07might get in the way if you're trying to

18:08operate on like oh a command and control

18:11thing metas-ploit sliver cobalt strike

18:14whatever. You don't have to have this

18:15run cmd.exe.

18:18You could make it run service UI.exe or

18:20anything else that you wanted to or a

18:22payload that could get another

18:23connection, make another call back,

18:25anything there. So you don't require or

18:27need or have the necessity of that

18:29interactive graphical user interface

18:32gooey display. I honestly think this is

18:34pretty slick though. Like being able to

18:35take like from PowerShell code just copy

18:37paste slap it in there and then you own

18:39the whole thing. That's kind of neat.

18:41Hey, thanks so much for watching

18:43everybody. Please do all those YouTube

18:44algorithm things. Like, comment,

18:45subscribe. I'll see you in the next

18:46video. Please do give some love to our

18:48sponsors. There's a link in the video

18:49description. Tac Forge is a new member

18:50of the family and I really appreciate

18:51all their support and yours. See you in

18:53the next video.