Windows Kernel Exploits.
Now that we've taken a look at how to exploit Windows services
and protocols, let's turn our attention to performing
or elevating our privileges on a Windows target, right?
So this is the Windows privilege escalation section
of this course.
And to begin, we will be taking a look at Windows kernel
exploits, all right?
Before we actually get started with how to essentially elevate
our privileges through the use of a kernel exploit,
let's get an understanding of what privilege escalation is.
All right, so privilege escalation
is the process of exploiting vulnerabilities
or misconfigurations in systems to elevate privileges
from one user to another, typically,
to a user with administrative or root access on a system.
All right, so again, I'll just be using a very simple analogy
to explain this.
So let's say I gain access to a system,
and in this case, a Windows system,
and I realize that the privileges that I currently
have access to are very limited, which means that I can't really
do much in terms of data exfiltration or pivoting
onto another system on that network.
In order for me to do anything that
requires administrative privileges,
I would need to elevate my privileges
to the privileges of the administrator user
or to obtain NT authority system privileges
in the case of Windows, right?
It's very important to understand
what privilege escalation is and the various privilege
escalation techniques that can be performed
both on Windows and on Linux.
And privilege escalation is a vital element of the attack
lifecycle and is a major determinant
in the overall success of a penetration test.
And the reason for that is quite simple.
If you're contracted to actually perform a penetration
test on a company's network, and you only obtain initial access
on one system, and you aren't able to elevate
your privileges, well, you can't make your way
through the network or obtain any data that's potentially
damaging to the company.
And again, a good penetration test--
or a good penetration tester is an individual
who is able, to some extent, to be
able to actually elevate their privileges across a network.
And, of course, it isn't required,
but if the actual company's network is secured properly
and the hosts have been secured correctly,
and you are not able to elevate your privileges,
well, that's just a testament as to how good the company has
actually implemented the security policy
or how good they're able at detecting attacks.
But again, as I said, if you're working
on a very simple network and you're
dealing with Windows systems, there
should be at least one privilege escalation attack
vector that you can use.
All right, so after gaining an initial foothold on a target
system, you will be required to elevate your privileges
in order to perform tasks and functionality that
require administrative privileges,
and for obvious reasons, right?
So the importance of privilege escalation in the penetration
testing process cannot be overstated or overlooked.
Developing your privilege escalation skills
will mark you out as a good penetration tester.
So this is pretty much one of the most important areas
within this course for both Windows and Linux
because exploitation is fairly simple in that there
are various exploitation vectors that one can use,
and in addition to that, there are
multiple exploit modules or exploit code available
that can simplify that process.
Now, given the fact that we're targeting the Windows kernel,
we need to have an understanding of what a kernel is.
Well, firstly, a kernel is a computer program
that is the core of an operating system
and has complete control over every resource
and hardware on a system.
So it really just acts as a translation layer
between hardware and software and facilitates
the communication between these two layers.
So a kernel is essentially the core of the operating system
and is responsible for various pieces
of functionality like IO, arithmetic memory management,
et cetera, et cetera.
Now, what kernel does Windows run?
Well, Windows runs a kernel called Windows NT, all right?
So Windows NT is the kernel that comes pre-packaged
with all versions of Microsoft Windows
and operates as a traditional kernel with a few exceptions
based on user design philosophy.
And it consists of two main modes of operation
that determine access to system resources and hardware.
So this is very, very common--
this particular architecture is very common on both Windows
or Unix based operating systems, where you have your user
mode, whereby programs and services running in user mode
have limited access to system resources and functionality,
and user mode is typically left for third-party applications
or programs that an end-user would be running.
You then have your kernel mode.
Kernel mode has unrestricted access to system resources
and functionality with the added functionality of managing
devices and system memory.
So again, if we're targeting the Windows kernel,
or we are trying to elevate our privileges by exploiting
the Windows kernel, the reason why we are doing
that is because if we get any code executed in the kernel
mode or in kernel space, then we are essentially
going to obtain--
or that particular code or shellcode
will be executed with the highest
level of privileges available on the operating system.
So that's why we're targeting the kernel.
Now, in terms of Windows kernel exploitation,
kernel exploits on Windows will typically
target vulnerabilities in the Windows kernel
to execute arbitrary code in order
to run privilege system commands or obtain a system shell.
And, of course, there are multiple vulnerabilities
within the Windows kernel, as we'll be exploring shortly.
And it's very important to note that this process will differ
based on the version of Windows being targeted
and the kernel exploit being used.
So kernel exploitation is not a privilege escalation vector
that I would recommend just running in an ad hoc fashion
because, as I said, once you start interacting
with the kernel, there's an increased likelihood that you
can cause system crashes that would consequently lead to loss
of data, and it's not something that I recommend running
in an enterprise environment.
Now, Windows privilege escalation
will typically follow the following methodology.
So it's a 2-step process, whereby the first step will
involve identifying kernel vulnerabilities
for this specific version of Windows
that you're trying to elevate your privileges on.
And we can do that through the use of various tools
or various automation scripts.
And secondly, the second part of this process
will involve downloading, compiling,
and transferring kernel exploits onto the target
system for execution.
And this process, again, will differ
based on the version of Windows we are targeting,
as well as the kernel exploit that's being used.
Now, as for the tools and the environment
that I'm going to be using to demonstrate the kernel
exploitation process, we are going
to be utilizing a tool called the Windows exploit suggester.
This is a Python tool that compares a target's patch
levels against the Microsoft vulnerability database
in order to detect potential missing patches on the target.
It also notifies the user if there are public exploits
and Metasploit modules available for the missing bulletins
or for the missing patches.
All right, so the GitHub repository
has been linked to this particular slide,
and, of course, I'll be showing you how to get the tool setup
and how to use it.
And then we have another GitHub repository
called Windows kernel exploits.
This is essentially a collection of Windows kernel exploits
sorted by CVE.
And the great thing about this GitHub repository
is it actually sorts out the actual kernel exploits based
on CVEs or the Microsoft vulnerability identification
ID or rather the Microsoft vulnerability ID.
So, in this case, the link I've posted
is a link to the MS16-135 vulnerability, which
is a kernel or a vulnerability within the Windows kernel
that allows for local privilege escalation.
And we'll be taking a look at how
to do this both automatically with Metasploit as well
as manually.
All right.
Now, it's very important to note that the techniques
demonstrated in this video are performed on a Windows service
pack 1 virtual machine.
And, of course, you already should
have noticed this particular lab,
or this particular video doesn't have an associated lab
environment.
The reason for that is because kernel exploitation
is extremely nuanced, depending on the type of target
that you're dealing with.
And the objective of this video is to show you the tools
that you can use to enumerate vulnerabilities
within the Windows kernel for a specific version of Windows.
And secondly, I'll take you through the process
of how you can take a look at the exploit code,
how you can compile it, how you can transfer
the actual compiled binary or executable onto the target
system, and how to execute it.
And, of course, this will essentially
encapsulate the privilege escalation process
through the use of a Windows kernel exploit.
So I'm going to switch over to my Kali Linux VM,
and we can begin the kernel exploitation
process for Windows.
All right, so I'm back on my Kali Linux virtual machine,
and I've already gained access to the target system,
so I'm currently within the Metasploit framework console.
And if I say sessions, you'll see that I have a PowerShell
session on the target, as well as a Meterpreter session,
so there we are.
You can see it's running Windows 7,
and the user count that I currently have access
to is the accountant user.
So again, if I say sessions 3 to interact with that session,
and I type in get user ID, you can
see that I'm currently logged on as the accountant,
and this particular account does not have elevated privileges,
and I can actually demonstrate that by saying getprivs,
and if I hit Enter, you can see that the amount of privileges
that we have is extremely limited
and we essentially want to elevate
our privileges to anti-authority system, right?
So again, depending on the type of access
you have on the target, whether it be through a Meterpreter
session or a typical command shell session,
it really doesn't matter.
We're going to start off by taking a look at how
we can identify kernel vulnerabilities
within the Windows kernel with Metasploit first.
So I've already obtained a Meterpreter session.
And, of course, many of you who have used Metasploit before
know that there is an inbuilt Meterpreter command that allows
you to automatically elevate your privileges on the target
system, and that command is just get system.
And if I hit Enter, it would essentially
go through a plethora of techniques
in order to elevate the privileges and, in this case,
you can see that all of them have actually failed.
So it tries various techniques like token duplication,
named pipe impersonation, et cetera, et cetera, and all
of these fail.
Well, let me just put this Meterpreter session
in the background.
There is a really, really useful Metasploit module
that will essentially enumerate all vulnerabilities
pertinent to this particular version of Windows,
and the name of that module is--
I'm just going to search for a module called suggester,
and this is the module here.
You can see that it is a post-exploitation module,
and it's called local exploit suggester,
and it works for multiple operating systems,
whether it be Linux, Windows, macOS, et cetera.
So I can say use this module here,
and if we show the options here, you
have the ability-- because this is a post-exploitation module,
you need to specify the session that you
want to run this module on.
So, in this case, I've already set the session
to 3, which in my case, is the Meterpreter session.
If I can actually type that in, you can see that is the case,
and all you need to do is hit Run.
This will bring up--
or will essentially enumerate all the vulnerabilities
within this particular version of Windows.
And furthermore, it will display the Metasploit modules
that you can use to elevate your privileges.
So again, the best way to show this is
or to actually demonstrate this is to just hit Run,
and it's going to say collecting local exploits for x64/windows.
So give this a couple of seconds to a couple of minutes,
as will I. So I'm going to just wait for this to complete,
and I'll get back to you when it's done.
All right, so the local exploit suggester module is complete,
and you can see it's going to tell you 31 exploit checks are
being tried, and then it'll provide you
with a list of exploit modules that you can
use to elevate your privileges.
So starting off, we have the typical bypass
UAC exploit module, which we will be covering later
on in this section when we'll be taking a look at how to elevate
our privileges through the--
or through bypassing UAC.
And then you have a few others here,
for example, the shchelevator exploit, as well as
this one right over here.
So again, this particular exploit
or these particular exploit modules,
again, can be used if you've performed enough research
on them in regards to what versions of Windows
they will actually be successful on.
So, for example, I can search for this particular--
I can search for it on Google here.
So I'll just open up my browser, and I'll just
paste that in there.
And I can utilize the links here,
for example, the Rapid7 link, to learn more
about what this exploit does or this particular exploit module
does.
So you can see this is Rapid7.
Rapid7 is the company that developed the Metasploit
framework, or rather acquired the Metasploit framework
and is currently responsible for developing it.
So you can see that this module exploits the Task Scheduler 2.0
XML 0day exploited by Stuxnet.
When processing task files, the Windows Task Scheduler
only uses a CRC32 checksum to validate that the file has not
been tampered with.
Also, in a default configuration,
normal users can read and write the task files
that they have created.
By modifying the task file and creating the CRC32 collision,
an attacker can execute arbitrary commands.
So this really isn't a kernel exploit.
So if we take a look at this one right over here, MS16_014,
and let's just search for this here.
I'll just paste this in here, and we'll
perform a Google search.
So we'll open up the Rapid7 link right over here.
All right, so there we are.
You can see that this exploits the Windows WMI subsystem.
And you can see right over here, this module has
been tested on vulnerable builds of Windows 7 Service Pack 0
and Windows 7 Service Pack 1 64-bit,
so this might be a good starting point.
And, of course, if we want to use it,
we can simply just copy the exploit name,
the exploit module name here, and we'll hit Use
and paste that in there.
There we are.
So it's going to use the default payload, which
is a 64-bit version of the Meterpreter.
So I'll say show options.
We need to specify the actual session,
so we'll say set session, and I'm
going to set my Meterpreter session as that
is the session I want to run this particular exploit module
on.
There we are.
And then, I need to specify my L port
option because my sessions are currently
using one of these ports.
There we are.
So might PowerShell session is currently using port 4444,
so I'll say set L port to, maybe, 4422,
and then I can hit exploit.
So let's hit Enter.
All right, so it looks like this was successful.
So it's going to say, reflectively
injecting the DLL into process 3240 or the process ID 3240.
Exploit finished, waiting for hopefully
privileged payload execution to complete.
So it's going to send the stage, and hopefully, the stage
is executed on the target, and we consequently
receive a Meterpreter session with elevated privileges.
So again, the reason I'm demonstrating this
is to show you that whenever you're using Metasploit modules
for the purpose of local privilege
escalation on a Windows target, the process can
be a little bit tedious in regards
to your chances of success.
And the reason for that is fairly simple, and, of course,
it all comes down to your ability
to identify vulnerabilities within this specific version
of Windows that you're targeting.
In this case, we get a Meterpreter session,
and if I say Get user ID, you can see that it is privileged,
and we have successfully been able to elevate our privileges
by utilizing a kernel exploit for this specific version
of Windows 7.
Right now, this is how to do it automatically with Metasploit.
You can see that it's fairly straightforward.
You can utilize just one module to enumerate
a list of exploit modules that you
can use against this specific version of Windows.
And using the exploit module is fairly simple.
You just need to set the session ID, as well
as the payload options like your IP addresses,
as well as the port that you want to listen on.
So I'll put this in the background.
There we are.
And if I list out my sessions again, you
can now see I have Meterpreter-- my Meterpreter session 3, which
is unprivileged, and then I have another Meterpreter session,
which is currently privileged.
And we're just going to maintain access to both of them
as we are now going to perform manual privilege escalation.
So I'm going to switch over to session 3, which
is unprivileged.
And, of course, I'll verify that is the case, getuid.
We're currently logged on as the accountant, right?
So this is where we can start exploring tools
like the Windows exploit suggest.
All right, so as I said, the GitHub repository or the link
to this GitHub repository is posted in the slides,
and if we take a look at the description, you can see,
as I mentioned in the slides, this tool
compares a target's patch level against the Microsoft
vulnerability database in order to detect potential missing
patches on the target.
It requires the system info command output
from a Windows host in order to compare
to that of the Microsoft security bulletin database
and determine the patch level of the host.
So what this means is that firstly,
you need to clone this repository.
As you can see, it's a Python 2 script.
You then need to run the script with the update flag.
That will download the Microsoft Vulnerability Database
and it's going to be stored in an XLSX file
format, after which you can then run the Windows exploit
suggester Python script.
Specify the database that you just downloaded,
and that, of course, is the vulnerability database.
You then need to specify the system info argument
and then specify a text file that contains the system
info or the output of the system info command
that you've obtained from the Windows target.
All right, so I have already cloned this repository
on my system, and let's get started firstly
by getting the actual system info output.
So I currently have access via Meterpreter,
and I'll just open up a shell session here
to obtain a Windows command prompt or a Windows command
shell session.
There we are.
So you can see, that's a command shell session,
and I can then say sysinfo, or system info rather,
and we'll hit Enter.
And this is the information that you
need to copy into a text file.
So the reason this information is very important
is because it actually contains a list of hotfixes that have
been installed right over here.
And based on this, the Windows exploits suggester
will determine what exploits can be
used against this specific version of Windows
with these hotfixes installed, which is fantastic.
So I'll just copy this information, like so.
There we are.
Copy, so I'll just copy it there.
And what I'll do is I'll terminate that channel,
and I'll go back into my Meterpreter session,
and I'll open up a new terminal here.
And I'll head over onto my desktop,
and I'm going to create a new text file with Vim.
So I'm going to just call this Windows 7 dot txt,
and within this file, I'm going to paste in what I copied.
There we are.
You can see all the information has been copied successfully.
I'll then write in quit, and you can
see that it's stored on my desktop right over here.
All right, so now that we have that,
I'm just going to navigate to the directory
where I stored the Windows exploits suggester script,
or where I cloned the GitHub repository 2, which
is under-- in my case, under Windows-Enum,
and then Windows exploit suggester right over there.
All right, and as I said, within this particular directory,
disregard these TXT files here as these
are TXT files that contain system information
for my previous engagements.
So you'll really just have the Python script here.
You'll not have the database at all.
So in your case, during your first run,
you want to run Windows exploit suggester dot py
and then update, and that's going
to download a new vulnerability database.
There we are.
You can see it's going to be written
to the latest date or the date when you actually
run the command.
In this case, I'm recording this on the 26th of December, 2021.
So in order to run this now, I can simply
say Windows exploits suggester dot py,
and then I specify the database, which, in this case,
is going to be the latest one, so that I'm going to say 2021,
and we are currently in December, so December the 26th.
And then I specify the system info file, which we just
created, which is stored on my desktop under the name
Windows 7 dot txt, and that's pretty much it.
So once you hit Enter, it's going
to say initiating winsploit.
The database file detected as XLS
and it's then going to essentially enumerate
a list of vulnerabilities here that this particular version
of Windows is vulnerable to.
So there are quite a few in this case.
Now, in this particular case, or in the case of this tool,
the exploits listed at the very top
are the ones that have the highest chances of successfully
being exploited.
So let me just zoom out a little bit here,
so the actual text is rendered correctly.
You can see right over here the system info input
file read successfully, querying the database
file for potential vulnerabilities,
comparing the two hotfixes against the 386
potential bulletins with a database of 137 known exploits,
and then, of course, you can see that it will sort it
based on the ExploitDB proof of concept code,
and that can be identified using the E option.
If you see the M option, that tells you
that there is a Metasploit module available,
and if there is an asterisk, that tells you that there
is a missing bulletin.
All right, so starting off with the first most vulnerability,
this is the MS16-135 vulnerability.
So it gives you a bit of a description here.
It says this is a security update for Windows kernel mode
drivers.
So this is indeed a kernel exploit or a vulnerability
within the Windows kernel.
And you can see it provides you with ExploitDB code
here that you can use to essentially exploit
the target, as well as a GitHub repository that contains more
information about this particular exploit
or this particular vulnerability,
and then, of course, this has the CVE code.
So this vulnerability was discovered or disclosed
in 2016, as we can tell from the Microsoft vulnerability ID as
well as the CVE code here.
If we take a look at the ExploitDB code,
we can see that in this particular case,
this is for the Microsoft Windows kernel,
and this allows us to perform privilege escalation right
over here.
So we can learn more about this exploit
by copying the Microsoft vulnerability ID there and just
performing a quick Google search on it.
There we go.
So we can click on the GitHub repository here,
which I wanted to demonstrate.
So I already have the Windows kernel exploits GitHub
repository open by SecWiki.
This is a verifiable source of Windows kernel exploits
that actually contains a list of Windows kernel exploits,
as well as the actual CVE.
So if I just take a step back here,
you can see that they're sorted based
on CVE as well as the Microsoft vulnerability identifier code.
And, in this case, we're looking for the MS16-135 exploit,
so MS16-135.
There we are.
That's the one here.
And the great thing about this GitHub repository
is it provides you with the c code
that you can actually go through and verify
that indeed this particular executable
or this particular exploit code does what it's supposed to
and isn't doing anything malicious, which is
why I'm recommending it to you.
And you can then utilize this code and compile it yourself.
I will not be covering the actual compilation
of exploits within this course.
As I said, I'll be working on that in another course
where we will be taking a look at exploiting Windows
from the context of buffer overflows
and how to write your own exploits.
In this case, we'll be utilizing the pre-built executable right
over here, so for 41015.exe and the documentation
for this vulnerability provides you
with information regarding how to use it.
You can see it tells you this exploit works
on all 64-bit vulnerable targets,
and we can essentially obtain a system shell.
So, in this case, it's utilizing the PowerShell script,
which you can also utilize.
All you need to do is just execute it,
after which it'll then provide you with an elevated command
shell session.
And it provides you with instructions
for multiple versions of Windows, ranging from Windows 7
to a specific version of Windows 10.
All right, so to use this exploit,
I'm just going to download the prebuilt binary
or the compiled binary here.
So I'll click on that here, and we'll
give this a couple of seconds.
All right.
We'll then click on Download, and I'm just
going to save it within my downloads directory.
So we know that this specific version of Windows
that I'm targeting is vulnerable to this particular exploit,
so realistically, all I need to do
is transfer this executable onto the target system
and execute it, and I should have elevated privileges.
Now, it's very important to note that this, again, really
does not take into consideration antivirus detection,
so you have to be very cognizant of that.
As I said, we'll be covering antivirus detection
in its own--
or bypassing antivirus in its own course because that is
quite a lengthy subject, one that I cannot cover in-depth
right now.
All right.
So, again, you can go through the list of vulnerabilities
displayed or enumerated with the Windows exploit suggester,
and you can take a look at some of the other vulnerabilities
and exploits, and you can test them out for yourself.
In my case, what I'll do is I'll use my Meterpreter access
to upload this into the temp directory within the Windows
system.
So the temp directory is stored within the root of the Windows
file system.
So I can navigate to the root of the C drive,
and then I can create the temp directory
if it doesn't exist already.
However, in this case, if I list out
of the contents of the C drive, you
can see we have the temp directory right over here.
So I can navigate into the directory,
into the temp directory, so I'll say, cd Temp.
There we are.
List out the contents of the temp directory.
We have nothing within that directory, right?
And the reason why I'm using the temp directory
is because you never want to use the home directory of a user
account because if you're transferring your exploit code
or exploit files into a directory that's frequently
accessed by legitimate users on the target system,
then there's a good chance that you'll be detected.
So always store any files that you're
transferring onto a Windows system into the temp directory.
And the same goes for Linux systems,
and we'll be exploring that once we get there.
So I can say upload and I stored--
or we downloaded the prebuilt or precompiled
exploit or executable in the downloads folder.
So I'll say upload that particular executable.
There we are.
So that's uploaded, and I can also say shell.
And again, I've used I've utilized this particular kernel
exploit before, and it really is effective,
and in my experience, it hasn't crashed any Windows system
that I've run it on.
Using it is fairly simple.
If I say dir, you can see it's successfully been uploaded.
To execute it, we'll use--
we'll just say-- we'll execute it through the Windows command
prompt.
So I'll say 41015.exe, and if I hit Enter,
you'll see that it will provide me
with documentation as to how to use
this particular kernel exploit.
So it says please enter an operating system version.
The following operating system versions
are supported, Windows 7, Windows 8.1, Windows 10 prior
to build release 14393, and Windows Server 2012 R2.
So to use it, you simply just execute the executable
and specify the version of Windows that you're exploiting.
So again, I can simply just say 41015.exe, and, of course,
you can rename this to anything you want.
And I can hit seven.
I'll hit Enter.
Now, don't worry if it doesn't give you any output.
This is exactly how this works.
So I'm going to give this a couple of seconds
to actually complete, after which you should
be provided with a command shell session
with elevated privileges.
All right, so after a couple of seconds,
you will see that you'll be provided with a new command
shell session here, and I can simply say who am I,
and you can see anti-authority system.
So we've successfully been able to elevate our privileges
by utilizing a kernel exploit that we
obtained from a public source.
And, of course, as I said, you can also
utilize the Metasploit framework,
and that will automate this entire process.
But as you can see, if you perform it manually
and you enumerate the vulnerabilities that
affect the specific version of Windows that you're targeting,
you'll be able to get a much broader scope in regards
to what types of exploits are available for you
or what types of exploits are available at your disposal.
So, as I said, definitely try out
or experiment with this within your own home lab.
I would recommend downloading the Windows
VMs or multiple versions or multiple releases of Windows
from the Microsoft website.
They allow you to download the VMs for free,
and the licenses are limited for 90 days.
So you can download multiple versions
and test kernel exploitation on both of them
or on all of these versions.
Now, as I said, I really don't recommend
running kernel exploits in a production environment
or in an enterprise environment unless you've tested them
as I have just done with this particular kernel exploit,
and I do know that it is relatively stable
and I haven't experienced any crashes with it before.
All right, so this is going to conclude
the practical demonstration side of this video.
All right.
So now that we've explored kernel exploitation on Windows,
we can move on to the next privilege escalation vector
that we can use on Windows systems, and that, of course,
is bypassing UAC or bypassing user access control.
And again, that is one of my favorite privilege escalation
vectors, and you will see why.
So I'll see you in the next video.