4 - Privilege Escalation
Last updated
Last updated
In order to elevate your privileges on Windows, you must first, identify privilege escalation vulnerabilities that exist on the target system.
This process will differ greatly based on the type of target you gain access to. Privilege escalation on Windows can be performed through a plethora of techniques based on the
version of Windows
system’s unique configuration.
This process can be quite tedious and time consuming and as a result, it is recommended to automate the processes of identifying privilege escalation vulnerabilities. This can be done through the use of various automation scripts like PrivescCheck.
PrivescCheck - This script aims to enumerate common Windows configuration issues that can be leveraged for local privilege escalation. It also gathers various information that might be useful for exploitation and/or post-exploitation.
The script needs to be executed on the target machine.
In this lab you are also provided with access to a victim' session via GUI.
Exploit the target
Since the target system doesn't have vulnerable services and we can directly interact with the target system, we can exploit the latter with the module
which will start a web server (on LHOST) hosting a malicious payload. Running the exploit will generate a Powershell command that, executed on the target system, will download the payload from the said web server and then executed, providing you with a session on the target machine.
Set:
target
PSH\ (Binary)
payload
windows/shell/reverse_tcp
PSH-EncodedCommand
false
LHOST
eth1
Run the script, copy the Powershell command it generates and run in over to the target machine: on your msfconsole you should get a shell (nonn-interactive).
Upgrade the shell
Put the shell in background and use the module
to upgrade the shell to a meterpreter session, setting
LHOST
eth1
SESSION
1
WIN_TRANSFER
VBS
Run PrivescCheck
After obtaining the meterpreter session, migrate to explorer.exe to have a more stable session, then navigate to C:\Users\student\Desktop\PrivescCheck and switch from meterpreter to "shell mode".
Then run the ps1 script following the instructions on the repository page, in our case
and let it run. You will find a pair of credentials adminstrator/hello_123321.
Login to the target system and find tha flag
We can login to the target system via PsExec using
python script (psexec.py)
metasploit module
You can then find the flag with the command
This command will search for the file "flag.txt" in the current directory and all subdirectories (/s option). The /b option is used to display only the file names without additional information.
If the file is found, the command prompt will display the full path to the file. If the file is not found, there will be no output.
To identify Linux vulnerabilities you can use LinEnum.
Checks to do first:
identify yourself (whoami)
cat /etc/passwd to find out other user account
list all groups your user belongs to (groups)
list all groups in the system (cat /etc/group)
The goal here is to identify those files that should have root permissions (r+w) but that are instead misconfigured, allowing reading and/or writing to non-root users.
To find these files, run the command
find: It is the command used to search for files and directories within a given directory hierarchy.
/: It specifies the starting point for the search. In this case, it is the root directory, indicating that the search will cover the entire file system.
-not: It is a logical operator that negates the expression that follows it.
-type l: This specifies the type of file to search for. In this case, it looks for symbolic links.
-perm -o+w: This expression specifies the permissions of the files to search for. It searches for files that have write permission for others (users who are not the owner or in the same group).
2>/dev/null: discard result lines with errors
Putting it all together, the command find / -not -type l -perm -o+w searches for files within the entire file system, excluding symbolic links, that have write permission for others.
From the results of the previous command, we found that /etc/shadow was misconfigured: it means we can change the password of the root user.
To generate a new password (in our case password), use the command
openssl: It is a command-line tool used for various cryptographic operations and handling SSL/TLS protocols.
passwd: It is a subcommand of OpenSSL used for generating password hashes.
-1: This option specifies the algorithm to use for password hashing. In this case, -1 indicates the MD5-based algorithm (the weakest one).
-salt abc: This option sets the salt value to be used in the password hashing process. The salt is a random value that adds complexity to the password hash.
password: This is the password for which the hash will be generated.
In summary, the command openssl passwd -1 -salt abc password generates an MD5-based password hash for the password "password" using the salt value "abc."
Now copy the generated hash and paste it in place of the * after root:
Switch to the root user with the su command and that's it!
Check what commands the current user can execute with SUDO privileges:
In this example, the user student can run the man command with SUDO privileges without entering the root password.
As you can see from here, you can spawn a shell within man: doing it as you were root, will start a privileged shell!
An excellent resource to find out privesc vectors on binaries is GTFOBins.
Windows
