3 PrivEsc

Priority

Kernel and privesc links

LOLBas

General:

Strategy:

  • Dont chase your first finding

  • Look over the enumeration

  • Make notes from winPEAS

  • Avoid Rabbit holes

  • Exploitable service that can be edited ..but cant be stop/started.. isnt very good for us

  • Take a look around for interesting files

    • C:\

    • C:\Program Files

  • Look for easy-steps first:

    • Registry Exploits

    • Services

    • Admin Processes

    • Get versions and search exploit

  • No admin?

    • Dont panic. Keep practicing.

    • Go back through yours enum results

PrivEsc Class

Perms

  • User Accounts

    • Logon rights

    • files/folders/desktop/etc

  • Service Accounts

    • SYSTEM is highest priv of any local acct

    • Cant login with these

    • Also: network service, local service

  • Perms are controlled by ACL

    • Access Control List

    • user/group/svc/registry/etc

Misconfigs

  1. Insecure Service Properties

  2. Unquoted Service Path

  3. Weak Registry Permissions

  4. Insecure Service Executables

  5. DLL Hijacking

Best Practices:

  • Use 'allowed commands' (ie: whitelist) instead of 'disallowed'

  • Use a pager like 'most' instead of less/more

  • Avoid allowing programming languages

  • or harden, pty(), system(), exec()

smbserver.py

Unquoted Paths

Passwords: Unattended Install Files

Passwords: Group Policy Prefs (GPP)

  • We used to set the 'default' admin password

  • Old and patched but still has traces

Metasploit:

Domain:

gpp-decrypt

Enable SMB v1

  • Just to prep your Lab:

  • v1 is a really bad idea.. EternalBlue exploitable!

Basic Venom Reverse Shell:

RDP Trick

psexec

Escalate from admin to SYSTEM https://docs.microsoft.com/en-us/sysinternals/downloads/psexec

From Kali: Make Windows connect-back

Kernel Exploits from Sysinfo

  • Method: systeminfo > wes > cve > shell

  • Look up results:

  • PrivEsc:

    • Kali: listener: nc -nvlp 53

    • Windows: Run the exploit, and the program to execute (ie: rev shell)

    • c:\PrivEsc\cve-2018-8120-x64.exe C:\PrivEsc\reverse.exe

    • Kali - Connected!!

Services

  • We can exploit.. If they are running with SYSTEM privs and are misconfigured

Service: Modify

You could repoint the executable to our Reverse-Shell Must be able to stop/start the service to apply Maybe force a reboot, if you have to

Service: Unquoted Path

  • Unquoted paths can give ambiguity

  • whoami.exe ..same as: whoami

  • Example:

    • C:\Program Files\Some Dir\SomeProgram.exe

  • Could be:

    • "C:\Program" with "Files\Some" as argument

  • Windows will do a check to test options when run.

Service: Exec Swap

  • If "myservice.exe" is modifiable, we can just replace it!

  • Be sure to make a backup, in prod

Registry: Weak Perms

  • Registry keeps detail for each service.

  • ACL is bad = we can edit the registry.

  • Even if the service cant be modified.

  • We can update the registry of a service that has 'system' and point to our reverse

Registry: AutoRuns

Could be useful, but difficult Since it would require a reboot

winPEASany.exe quiet appliationinfo

Autorun Applications ..Found! C:\Program Files Autorun Program\program.exe FilePerms: Everyone ..yikes

Manually check for AutoRuns: reg query HKLM\SOFWARE\Microsoft\Windows\CurrentVersion\Run found!

Verify, can we write to it?

accesschk.exe /accepteula -wvu "C:\Program Files Autorun Program\program.exe" RW Everyone ALL_ACCESS

Backup the .exe copy "C:\Program Files Autorun Program\program.exe" C:\Temp

Overwrite the .exe copy /Y reverse.exe "C:\Program Files Autorun Program\program.exe" kali listener: nc -nvlp 53 On a restart, Windows will auto-run as the 'last-user' So, lets get admin prepped and reboot: windows: login as admin windows: restart whoami admin!

DLL Missing Hijack

  • If a Service loads a DLL

  • The DLL will get same permission as executed

  • If DLL is missing, and we can write to that dir...

  • Then we can add our evil-dll in that location!

  • Often a very MANUAL process to discover this exploit

  • In a real engagement: we would copy the .exe and analyze it in another environment

  • REF: DLLHijackWithMSF

MSI: Install Elevated

  • AlwaysInstallElevated Windows will allow installers to run w/elevated

  • Lets make a malicious MSI file that contains reverse-shell

  • Catch: Only works if 2 registry values are set:

    • HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer

    • HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer

Passwords: Registry

  • Reused, Readable, or Insecure

  • Registry: Apps or Windows may store plaintext

Passwords: stored creds: runas

  • Saved Creds with "runas"

  • You can runas 'admin'

Passwords: Search Configs

  • Unattend.xml file

  • To help install a pc, but passwords often left behind

Passwords: SAM

  • REF: WindowsPW

  • SAM - holds windows password hashes

  • SYSTEM - encrypted hash key

  • Locked while Windows is running

  • If you can read both, then you can extract

Located: C:\Windows\System32\config

Backups: C:\Windows\Repair C:\Windows\System32\config\RegBack

pwdump

  • Crack Windows PW using SAM/SYSTEM

  • Get the latest pwdump

Pass the Hash

  • Use hash instead of the PW

  • winexe ..normal

  • pth-winexe ..passthehash

Scheduled Tasks

  • If we can edit a current Scheduled Task

  • We can append our evil entry

GUI Admin Apps

  • AKA: "Citrix Method"

  • Since we also use this to Citrix Escaping

  • If an app is setup to run as Admin

  • You can use it to also do other things! - Like open a CMD!

Startup Apps

  • If we can edit, we can add:

  • C:\ProgramData\Microsofot\Windows\Start Menu\Programs\StartUp

  • When Admin logs in - it will execute as Admin !!

Installed Apps

  • Is it exploitable?

  • www.exploit-db.com

  • Filter: local, windows search: priv esc

  • Examples:

    • KioWare Server.. based on weak privs

    • IObiot .. unquoted service path

    • IperiusBackup .. file permissions

  • Other good ones:

    • Buffer Overflows

Hot Potato

  • Spoofing attack, with NTLM, to get SYSTEM

  • Like: Responder

  • Works : Windows 7, 8, early 10

  • Intercepts requests, Spoofs, runs our Payload

Potato

Potato Family

PrintSpoofer

Print Spooler Exploit https://github.com/itm4n/PrintSpoofer Requires: vc_redist.x64.exe (if not present)

Metasploit: Looking Around

getsystem

Metasploit Meterpreter - genius! Wont work on patched newer-windows-boxes Should NOT be considered for user>admin escalation method in modern systems

  • rapid7/metasploit-payloads

    • elevate.c

    • namedpipe.c

    • tokendup.c

3 techniques getsystem can use Will try all 3 till success

  1. Named Pipe Impersonation impersonates access token to get SYSTEM

  2. Named Pip Impersonation but uses DLL to disk as SYSTEM DLL connects to named pipe limited to x86 arch

  3. Token Duplication requires SeDebugPrivilege finds service as SYSTEM and injects DLL in Memory

churrasco

  • REF: Granny/Grandpa-HTB

  • https://technet.microsoft.com/library/security/ms09-012

  • Token impersonation via churrasco

  • To escalate privs to System - developed by Cesar Cerrudo.

  • Server 2003 allows Network Service and Local Service to impersonate 'System'

  • Patched by Microsoft in Windows 2012 (MS09-12).

  • On newer systems Juicy Potato works fine.

  • But on older systems, token impersonation is abused via the churrasco exploit.

  • If you have access to a box as nt authority\network service

  • IE: You managed to upload ASP.NET shell

  • You can easily elevate your privileges on the box.

  • You can download the exploit here and compile by yourself

  • or you can use the one from sqlninja which is located at /usr/share/sqlninja/apps/churrasco.exe

  • It’s used by sqlninja in cases when we bruteforced sa password.

  • After uploading you can easily

    • Elevate your privileges.

    • Create an Admin account

chimichurri

Python to Exe

  • Windows privledge escalation exploits are often written in Python.

  • You can compile the using "pyinstaller.py" into an executable

Powershell Exploits

  • You may find that some Windows privledge escalation exploits are written in Powershell. You may not have an interactive shell that allows you to enter the powershell prompt. Once the powershell script is uploaded to the server

  • Powershell Priv Escalation Tools:

  • One liner to run a powershell command from a basic (cmd.exe) shell:

Powershell RunAs

  • PowerShell can also be used to launch a process as another user.

  • Simple script will run a reverse shell as the specified username and password.

useradd.exe

Previous2 EnumsNext4 Kernel Exploits

Last updated

Was this helpful?