Windows SeTakeOwnershipPrivilege Can Enable SYSTEM Escalation Through Accessibility Binaries
Summary
A lab tutorial shows how misdelegated SeTakeOwnershipPrivilege can let a standard domain user replace Utilman.exe or osk.exe and obtain SYSTEM access on a Windows domain controller; it also recommends policy restrictions, integrity monitoring, NLA and WDAC.
Key points
- The lab grants a standard domain user SeTakeOwnershipPrivilege through Group Policy, allowing the user to take ownership of protected files and change their permissions.
- Replacing Utilman.exe with cmd.exe lets the login-screen accessibility control open a command prompt running as SYSTEM; the demonstration uses it to reset the built-in Administrator password.
- A second demonstration replaces osk.exe with a reverse-shell payload, which returns a SYSTEM shell when launched from the login screen.
- The article recommends limiting the privilege to administrators and tightly scoping any operational exceptions.
- Suggested detection includes auditing ownership and permission changes, monitoring writes to System32, checking binary integrity, and alerting on unusual winlogon.exe child processes.
- NLA can block the demonstrated remote RDP login-screen path; WDAC and restricting remote-management access to domain controllers are also recommended.
Article Details
- Topic
- Abuse of SeTakeOwnershipPrivilege to replace Windows accessibility binaries and escalate privileges to SYSTEM
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 192[.]168[.]1[.]17 | Kali attacker host configured to receive the reverse-shell callback from the replaced osk.exe in the demonstration. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe operator uses RDP to reach the login screen and trigger the replaced accessibility binary.T1021.006 · Windows Remote ManagementThe operator uses Evil-WinRM to access the Domain Controller through a remote PowerShell session.T1059.001 · PowerShellThe operator uses an authenticated remote PowerShell session through Evil-WinRM to issue commands on the Domain Controller.T1059.003 · Windows Command ShellThe replaced accessibility binary launches cmd.exe, providing a Windows command shell running as SYSTEM.T1105 · Ingress Tool TransferThe operator uploads the generated shell.exe payload to the target before replacing osk.exe with it.T1222.001 · Windows PermissionsThe operator takes ownership of System32 binaries and changes their DACLs with icacls to enable replacement.T1546.008 · Accessibility FeaturesThe operator replaces Utilman.exe or osk.exe so invoking an accessibility feature at the login screen launches a SYSTEM shell or reverse-shell payload.
Products
Group PolicyA misconfigured Group Policy granted the right to the domain user raaz.Microsoft WindowsA single delegated Windows right, SeTakeOwnershipPrivilege, can be abused to take ownership of protected System32 binaries on a Domain Controller and escalate a standard domain user to SYSTEM.Windows Defender Application ControlWindows Defender Application Control policies that enforce a signature-based allow-list detect on-disk substitutions of signed Microsoft binaries.Windows Server 2019The banner identifies the target as Windows Server 2019, and a whoami confirms the shell is running as nt authoritysystem.
Tools
Evil-WinRMThe attacker operates from a Kali Linux host at 192.168.1.17 using Evil-WinRM for remote PowerShell access and rdesktop for RDP interaction with the login screen.msfvenomThe payload is generated on the Kali attacker host with msfvenom.netcatOn the Kali host, a Netcat listener wrapped in rlwrap has been waiting on port 443.rdesktopThe attacker operates from a Kali Linux host at 192.168.1.17 using Evil-WinRM for remote PowerShell access and rdesktop for RDP interaction with the login screen.