I will get an exception if I use this module thus no job is started.

(Empire: ***) > usemodule privesc/ms18-999
(Empire: powershell/privesc/ms18-999) > set [...]
(Empire: powershell/privesc/ms18-999) > run
[>] Module is not opsec safe, run? [y/N] y
[!] Exception: Module instance has no attribute 'sessionID'

Hi there,

I wasn't able to replicate this issue the agent name is used to grab the session ID so it should work. Here is where the session ID is set;
https://github.com/OneLogicalMyth/Empire/blob/2216484bc94eaa8a1a9511788549418ab1425a72/lib/modules/powershell/privesc/ms18-999.py#L186

Is the agent name valid?
Try spawning a new agent and see if that helps.

When I tested this it worked, but I have noticed an error on lines;

• 202
• 206
• 211

Can you replace self.sessionID with sessionID and try again?

replacing self.sessionID with sessionID did the job.

Thank you very much.

//(Empire: powershell/privesc/ms18-999) > [*] Agent ZL6XTVD2 returned results. Exploit Successful, you just need to trigger the XPS print job. shell $a=Start-Process C:\Windows\Tasks\TriggerXPSPrint.exe -PassThru;sleep 5;Stop-Process -Id $a.Id -Force [*] Valid results returned by 192.168.0.200
Still normal user

Same error as @Kruxinator, but your workaround is ok 👍
A little bit unrelated but on my W10 lab machine, i can't test the full chain because the .bat is flagged by Defender.

Mine didn't get detected by defender, I left safe checks as False by default which normally triggers the detection on Windows 10. Did you enable safe checks?

Glad replacing the string worked for you both, I will update the files.

Indeed, with Safecheck False, it's ok...well almost because now, I figure out that my VM seems to be patched against the exploit.
Maybe you can add a check for patched target ?

EDIT : Just try on my unpatched lab, works like a charm, nice work. If I have some time, I'll looking for a solution to use native code instead of your .exe

🌻

Just tried it out.. keep getting this error:

Exploit Failed, most likely SYSTEM has insufficent permissions on 'C:\windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_995df3a27d527cea\Amd64\PrintConfig.dll'. Exploit Failed, most likely SYSTEM has insufficent permissions on 'C:\windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_995df3a27d527cea\Amd64\PrintConfig.dll'.

I've tried it with SafeChecks True and False, no difference.

Try killing spoolsv.exe

@Clemenzah are you sure your system is vulnerable ?