Additionally, this group has the capabilities to authenticate itself in a domain controller, so it is of special interest to verify the membership of users in this group. NOTE: The print operators group may seem quite innocuous to the naked eye, however it has the ability to load device drivers in domain controllers as well as manage printer-type objects in the active directory. The following table shows the default values, according to the documentation: Given its implications, the default values of this policy include only the group of “ administrators” and “ print operators“. “ Load and unload device drivers” policy is accessible from the local group policy editor (gpedit.msc) under the following path: “Computer configuration-> Windows settings-> Security Settings -> User Rights Assignment”

0x02 – SeLoadDriverPrivilege and Access Tokens The activation of this policy in the context of non-privileged users implies a significant risk due to the possibility of executing code in kernel space.Īlthough this is a well known technique, it can not be found in post-exploitation and privilege escalation tools, and there are no tools which carry out automatic exploitation neither. Today, we will analyze the impact associated to the assignment of the “ Load and unload device drivers” policy, which specifies the users who are allowed to dynamically load device drivers. Although Microsoft’s documentation is quite clear about it, throughout several pentests we have found privilege assignment policies assigned to ordinary users, that we have been able to exploit to take full control over a system. In Windows operating systems, it is well known that assigning certain privileges to user accounts without administration permissions can result in local privilege escalation attacks. SeLoadDriverPrivilege privilege activation.0x03 – Seloaddriverprivilege exploitation procedure.0x02 – SeLoadDriverPrivilege and Access Tokens.Dynamic Risk Assessment and Threat Prioritization.Compliance Security Verification Automation.SAST (Static Application Security Testing) Vulnerability Management.IT infrastructures and Web applications (DAST) Vulnerability Management.

Advanced Bank Infraestructures Security Assessment.

Technologies and Operating Systems Hardening.

Ntloaddriver