Post-Exploitation Modules
In addition to native commands and actions
there are several post-exploitation module we can deploy against an active session.
Sessions that were created through attack vectors
such as the execution of a client-side attack
will likely provide us only with an unprivileged shell
But if the target user is a member of the local administrators group,
we can elevate our shell to a high integrity level
if we can bypass User Account Control or (UAC).
In the previous section,
we migrated our Meterpreter shell to a OneDrive.exe process
that is running at (presumably) medium integrity.
For this section, let’s repeat the steps from the previous section
and then bypass UAC with a Metasploit post-exploitation module
to obtain a session in the context of a high integrity level process.
As before, we connect to the bind shell on port 4444 on ITWK01,
download and execute met.exe,
and enter getsystem to elevate our privileges.
Then, we use ps to identify the process ID of OneDrive.exe,
and migrate to it.
The output shows that we are now running in the context of offsec again.
While this is an administrative account,
UAC prevents us from performing administrative operations
as we learned in previous Topics.
Before we attempt to bypass UAC,
let’s confirm that the current process has the integrity level Medium.
To display the integrity level of a proces
we can use tools such as Process Explorer
or third-party PowerShell modules such as NtObjectManager.
Let’s assume the latter is already installed on the system.
Once we import the module with Import-Module,
we can use Get-NtTokenIntegrityLevel
to display the integrity level of the current process
by retrieving and reviewing the assigned access token.
The output shows that we are currently performing operations
in the context of integrity level Medium.
Next, let’s background the currently active channel and session
to search for and leverage
UAC post-exploitation modules.
We’ll note our session ID for the next step.
Now let’s search for UAC bypass modules.
The search yields quite a few results.
One very effective UAC bypass on modern Windows systems is
exploit/windows/local/bypassuac_sdclt,
which targets the Microsoft binary sdclt.exe.
This binary can be abused to bypass UAC
by spawning a process with integrity level High.
To use the module, we’ll activate it,
set the SESSION,
and LHOST options.
Setting the SESSION for post-exploitation modules
allows us to directly execute the exploit on the active session.
Then, we can enter run to launch the module.
The output shows that our UAC bypass post-exploitation module
created a new Meterpreter session for us.
Let’s check the integrity level of the process as we did before.
Nice!
The output shows that the process our payload runs in
has the integrity level High
and therefore we have successfully bypassed UAC.
Besides being able to background an active session
and execute modules through it,
we can also load extensions directly inside the active session
with the load command.
One great example of this is Kiwi,
which is a Meterpreter extension providing the capabilities of Mimikatz.
Because Mimikatz requires SYSTEM rights,
let’s exit the current session,
start the listener again,
execute met.exe as user luiza in the bind shell,
and enter getsystem.
Now, let’s enter load with kiwi as argument to load the Kiwi module.
Then, we can use help to display the commands of the Kiwi module.
Finally, we’ll use creds_msv to retrieve LM and NTLM credentials.
The output shows that we could successfully retrieve the NTLM hash
of luiza.