{"id":21078165,"url":"https://github.com/itm4n/cdpsvcdllhijacking","last_synced_at":"2025-05-16T08:31:29.212Z","repository":{"id":107951807,"uuid":"227211440","full_name":"itm4n/CDPSvcDllHijacking","owner":"itm4n","description":"Windows 10 CDPSvc DLL Hijacking - From LOCAL SERVICE to SYSTEM","archived":true,"fork":false,"pushed_at":"2019-12-12T15:45:13.000Z","size":2704,"stargazers_count":114,"open_issues_count":0,"forks_count":42,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-03-25T03:54:03.937Z","etag":null,"topics":["dll-hijacking","windows-exploitation","windows-privilege-escalation"],"latest_commit_sha":null,"homepage":null,"language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/itm4n.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2019-12-10T20:39:59.000Z","updated_at":"2024-12-27T09:10:09.000Z","dependencies_parsed_at":null,"dependency_job_id":"58aa0f75-ae8f-4157-a636-3701fbca3151","html_url":"https://github.com/itm4n/CDPSvcDllHijacking","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/itm4n%2FCDPSvcDllHijacking","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/itm4n%2FCDPSvcDllHijacking/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/itm4n%2FCDPSvcDllHijacking/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/itm4n%2FCDPSvcDllHijacking/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/itm4n","download_url":"https://codeload.github.com/itm4n/CDPSvcDllHijacking/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254496160,"owners_count":22080663,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dll-hijacking","windows-exploitation","windows-privilege-escalation"],"created_at":"2024-11-19T19:39:30.399Z","updated_at":"2025-05-16T08:31:24.192Z","avatar_url":"https://github.com/itm4n.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CDPSvc DLL Hijacking - From LOCAL SERVICE to SYSTEM\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"/demo.gif\"\u003e\n\u003c/p\u003e\n\n\n## Description \n\nFor more information please visit this [blog post](https://itm4n.github.io/cdpsvc-dll-hijacking/).\n\n/!\\ __This technique works only if the target machine has less than 3.5GB of RAM__! Otherwise each service runs in a separate process and the Token Kidnapping technique is therefore useless.\n\n## How to compile \n\n1) Open Visual Studio and create a new __C++ Console Application__ project.  \n2) Replace the content of the main source file with the content of __cdpsgshims.cpp__.  \n3) Select __Release__ and __x86__/__x64__ depending on the architecture of the target machine.  \n4) Open __Project__ \u003e __Properties__ (and make sure the selected platform - __Win32__/__x64__ - is correct)   \n    - __General__ \u003e __Configuration Type__ -\u003e `Dynamic Library (.dll)`  \n    - __C/C++__ \u003e __Code Generation__ \u003e __Runtime Library__ -\u003e `Multithread (/MT)`  \n5) __Build solution__  \n\n\n## Usage \n\n1) __Rename__ the output file as __cdpsgshims.dll__.  \n2) Copy it into a __PATH directory__ where you have __Write access__.  \n3) __Reboot__ (or stop/start CDPSvc as an administrator).  \n4) Use a tool such as `nc.exe` to __connect to the local port 1337__.  \n\n```\nC:\\TOOLS\\\u003enc64.exe 127.0.0.1 1337\n[*] Searching for a SYSTEM token...\n[+] SYSTEM token found.\n[+] CreateProcessAsUser() OK\nMicrosoft Windows [version 10.0.18362.476]\n(c) 2019 Microsoft Corporation. All rights reserved.\n\nC:\\Windows\\system32\u003ewhoami\nnt auhtority\\system\n```\n\n/!\\ At this point, I'd suggest to stop the service, delete the DLL and restart the service. Otherwise you won't be able to delete the file. Your shell won't die because it runs in a separate process. \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fitm4n%2Fcdpsvcdllhijacking","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fitm4n%2Fcdpsvcdllhijacking","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fitm4n%2Fcdpsvcdllhijacking/lists"}