Windows Privilege Escalation Name Pipes

Windows Privilege Escalation: High Integrity to SYSTEM via Named Pipes

This skill teaches you how to escalate from a high integrity process to SYSTEM using Windows named pipes and service impersonation.

When to Use This Technique

Use this approach when:

• You have a high integrity process (e.g., from a vulnerable service running as Administrator)
• You need SYSTEM privileges for further operations
• The target is a Windows system (Windows 7 through Windows 11)
• You can create and start services on the target system

Prerequisites

• High integrity process (not just medium/low integrity)
• Ability to create Windows services (requires SeCreateGlobalPrivilege or similar)
• No AppLocker or similar restrictions blocking service creation
• The target system must allow named pipe connections

How It Works

The exploit follows this flow:

1. Create a named pipe - Your process creates a named pipe server
2. Create a service - A new service is created that will connect to your pipe
3. Service executes PowerShell - The service connects to the pipe and sends data
4. Impersonate the connection - Your process calls ImpersonateNamedPipeClient() to steal the service's SYSTEM token
5. Spawn SYSTEM shell - Use the stolen token to launch cmd.exe as SYSTEM

Usage

Step 1: Compile the Exploit

# On Windows with MinGW or Visual Studio
gcc -o priv_esc.exe priv_esc_named_pipes.c -ladvapi32 -lkernel32

# Or with Visual Studio
class priv_esc_named_pipes.c /link advapi32.lib kernel32.lib

Step 2: Run from High Integrity Context

priv_esc.exe

If successful, a new cmd.exe window will open running as SYSTEM.

Step 3: Verify Privileges

In the new command prompt:

whoami

Should return: nt authority\system

The Exploit Code

The compiled exploit is available at scripts/priv_esc_named_pipes.c. Key components:

• ServiceGo(): Creates and starts a service that connects to the named pipe
• main(): Creates the pipe, waits for connection, impersonates the client, spawns SYSTEM shell

Important Warnings

WARNING: If you don't have sufficient privileges, the exploit may hang indefinitely. The ConnectNamedPipe() call will block waiting for a connection that may never come.

WARNING: This is an offensive security technique. Only use on systems you own or have explicit authorization to test.

Troubleshooting

Alternative Approaches

If this technique doesn't work, consider:

• Token manipulation - If you can find a SYSTEM token in memory
• Service binary replacement - If you can modify a service's executable path
• DLL hijacking - If a service loads from an insecure path
• Unquoted service paths - If services have unquoted installation paths

References

• HackTricks - Windows Privilege Escalation
• MSDN - ImpersonateNamedPipeClient
• MSDN - CreateProcessWithTokenW