> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/processes-and-pipes.md).

# Processes and Pipes

Processes may yield one of the best places in terms of privilege escalation. Even if a process isn't running with administrator, it may lead to additional privileges. For example, if you can place an `aspx/php` shell on an IIS or XAMPP web server, you can gain access as the web server user. Often, this user will have a `SeImpersonate` token, allowing for `Rogue/Juice/Lonely Potato` to provide SYSTEM permissions.

#### Session Manager Subsystem (smss.exe)

The Session Manager Subsystem is the first user-mode process started by the kernel. It's responsible for starting the kernel and user modes of the Win32 subsystem.

Once started it creates additional paging files with configuration data from `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management,`[<sup>\[1\]</sup>](https://en.wikipedia.org/wiki/Session_Manager_Subsystem#cite_note-Troubleshooting-1) the environment variables located at the registry entry `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment`, and [DOS](https://en.wikipedia.org/wiki/DOS) device mappings (e.g. [CON:](https://en.wikipedia.org/wiki/CON:), [NUL:](https://en.wikipedia.org/wiki/NUL:), [AUX:](https://en.wikipedia.org/wiki/AUX:), [COM1:](https://en.wikipedia.org/wiki/COM1:), [COM2:](https://en.wikipedia.org/wiki/COM2:), [COM3:](https://en.wikipedia.org/wiki/COM3:), [COM4:](https://en.wikipedia.org/wiki/COM4:), [PRN:](https://en.wikipedia.org/wiki/PRN:), [LPT1:](https://en.wikipedia.org/wiki/LPT1:), [LPT2:](https://en.wikipedia.org/wiki/LPT2:), [LPT3:](https://en.wikipedia.org/wiki/LPT3:), and drive letters) listed at the `HKLM\System\CurrentControlSet\Control\Session Manager\DOS Devices` registry key. This can be used to create permanent [subst](https://en.wikipedia.org/wiki/Subst) drives.

#### Client Server Runtime Subsystem (csrss.exe)

#### WinLogon (winlogon.exe)

#### Local Security Authority Subsystem Service (LSASS)

#### Service Host (svchost.exe)

{% code title="List running processes and by PID" %}

```batch
tasklist /svc 
tasklist /FI "PID eq 1234"
```

{% endcode %}

### **Named Pipes**

Processes may communicate with one another via Named Pipes. These are in-memory files that get cleared out after being read. For example, Cobalt Strike uses Named Pipes for every command (excluding BOF). If the command was flagged by AV or crashed, it wouldn't affect the beacon process. Often users masquerade their pipes as another program, such as mojo (associated with Chrome) instead of msagent.

1. Beacon starts a named pipe of `\.\pipe\msagent_12`
2. Beacon starts a new process and injects command into that process directing output to `\.\pipe\msagent_12`
3. Server displays what was written into `\.\pipe\msagent_12`

Named Pipes can run in either half-duplex or duplex mode:

* Half-Duplex: one-way channel where client writes data to server
* Duplex: two-way channel

Every new connection made to a Named Pipe results in a new pipe being created, however, they all may have the same name (e.g. `\\.\PipeName\\ExampleNamedPipeServer`).&#x20;

{% code title="Listing Named Pipes with Sysinternals Suite PipeList" %}

```batch
pipelist.exe /accepteula
```

{% endcode %}

* <https://docs.microsoft.com/en-us/sysinternals/downloads/pipelist>

{% code title="Listing Named Pipes with PowerShell" %}

```powershell
gci \\.\pipe\
```

{% endcode %}

{% code title="Review LSASS Named Pipe Permissions" %}

```batch
accesschk.exe /accepteula \\.\Pipe\lsass -v
```

{% endcode %}

* <https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk>

Accesschk can allow us to enumerate the permissions of named pipes by reviewing the Discretionary Access List (DACL). &#x20;

Most notoriously, the [WindscribeService Named Pipe Privilege Escalation](https://www.exploit-db.com/exploits/48021) allowed everyone to have `READ` and `WRITE` access to all files

| DACL                                       | PURPOSE                                  |
| ------------------------------------------ | ---------------------------------------- |
| `FILE_READ_DATA`                           | read messages from the pipe              |
| `FILE_WRITE_DATA`                          | write messages to the pipe               |
| `FILE_CREATE_PIPE_INSTANCE`                | create a new server instance of the pipe |
| `READ_CONTROL`, `WRITE_DAC`, `WRITE_OWNER` | manage the security descriptor           |