 Hello again! Yesterday I showed you a privilege escalation in Excel. Today I'm going to show you another privilege escalation in Excel. It's actually the same one but I'm running it from a macro inside Excel and then I'm going to follow that up with Mimicats also running from a macro in Excel. So let's log on with my normal user account and in documents I have my spreadsheet and process explorer. Now let me start process explorer. This way I can show you the process is running and also running it as administrator allows me to enter the administrator password and this way it will be in memory and Mimicats will be able to find it. Okay so you see I'm not an administrator. I need to type in the password of the root account. Okay and this is here process explorer running as administrator. So let's start the spreadsheet. So I have three commands that I can run from the spreadsheet. I can open the command line. I can run this exploit which will perform a privilege escalation and then I can run the Mimicats all from memory without creating new processors or touching the disk. You can see Excel running here. Now let me open the command line. Okay here I have another command line. As you can see here for Excel there are no sub-processes so I did not start a new process and if I select this window you see that it actually belongs to the Excel process. So I'm running here as a normal user. Then I run the exploit and now I am a system user. By this privilege escalation now I can run the Mimicats and extract the passwords for memory. The version here for Mimicats and then no this is failed on command. Okay this is the command. So you can see here for my aloe account the password here is password and for the root account administrator the password is super secret.