Windows Privilege Escalation: Bypassing UAC, also known
as User Access Control.
In this video, we will be exploring
the process of utilizing the Metasploit
framework to essentially elevate our privileges on a Windows
target.
And the technique we will be utilizing
is the Bypass UAC technique.
All right?
So let's learn a little bit more about what UAC is, right?
So UAC stands for User Access Control.
So UAC is essentially a Windows security feature
that was introduced in Windows Vista that
is used to prevent unauthorized changes from being
made to the operating system.
So if you've used any modern Windows operating system,
you should be familiar with what UAC is.
So whenever you try and perform any action that again,
requires administrative privileges--
sort of like opening a Windows command prompt as administrator
or installing a new program--
you will be prompted with the UAC
prompt here that essentially asks you whether or not
you want to allow a certain application to make changes
to a device or to this particular device.
And then you can either say Yes or No.
Now, if you are a standard user and not an administrator--
once you hit Yes, you will be required
to provide the administrator password
or you essentially need to provide the administrator
password in order to, again, allow a certain application
to make changes to your operating system
or to that particular device.
So UAC is essentially used to ensure
that changes to the operating system
require approval from the administrator.
If you don't have the administrator password
or if you're not the administrator,
then you can't make any changes.
Now how do we bypass UAC or how do we utilize
UAC to elevate our privileges?
Well, we can utilize the "Windows Escalate UAC
Protection Bypass"--
and of course, that's the In Memory Injection method
module--
to bypass UAC by utilizing the trusted publisher certificate
through process injection.
So what this exploit module will do
is it will essentially bypass UAC.
And it will then consequently spawn or actually create
a second Meterpreter session, in our case, that
has the UAC flag turned off or has UAC turned off,
which means within the second Meterpreter session,
we will not have UAC enabled at all.
Which means we can perform administrative tasks
or we can essentially perform what the administrator would
be able to perform without providing
the administrative password.
And in this case, consequently, elevate our privileges.
All right, so in order to perform this,
you're going to need to have access
to the target system via a Meterpreter
session or a Meterpreter shell.
And in addition to that, you also
must ensure that the Meterpreter session or the Meterpreter
payload being used is the 64-bit version as opposed
to the 32-bit version.
All right?
So let's take a look at how this can be performed within the lab
environment.
So just fire up the lab environment
and we can get started.
All right, so I'm back within the lab environment.
And we have the target IP provided to us here,
which is great.
So we can copy that.
And we then need to start up MSFconsole
But before we do that, we actually
need to start up the PostgreSQL database service.
So I'm just going to zoom in so you
can see what's going on here.
So we are going to say Service, PostgreSQL, Start.
And we're also going to start up MSFconsole
so we can save time here.
So I'm going to Enter.
That's going to start the PostgreSQL database server,
and it's then going to start up MSFconsole for us.
All right.
So MSFconsole has started.
We are now going to create a new workspace called--
we're just going to call this a UACBypass right?
Because that's what we're exploring.
And we also need to set up the global variable for the RHOSTS
option, which we'll set to the target IP
so that we don't have to keep on typing in the target IP
whenever we load a module.
So I'll hit Enter.
We now need to perform an Nmap scan on the target server
to identify what services are running on it,
and consequently, exploit one of the services
in order to gain access to the target system
so that we can get a Meterpreter session, after which we
can take a look at how to elevate our privileges.
So we'll use the db_nmap command to perform an Nmap
scan from within the Metasploit framework console.
And this command will allow us to consequently save
the Nmap scan results directly into the Metasploit framework
database.
And yeah, we can then access the results whenever we want.
So we can type in db_nmap.
We're going to perform some service version detection.
We're then going to paste in the target IP and hit Enter.
So I'm just going to wait for this to complete scanning.
All right, so the Nmap scan is complete.
And as you can see, we have the HttpFileServer
running on Port 80.
And that is the Rejetto HttpFileServer version 2.3
that we have exploited multiple times.
So that's going to be our access vector.
So we are going to search for the exploit module,
we're going to say Search, Rejetto.
And we're going to be utilizing this exploit module here,
which of course, allows us to perform remote command
execution.
So I'm going to say Use, paste it in there.
We then need to set the payload to the 64-bit Meterpreter
payload because this is what will be required
in order to successfully bypass UAC
or to elevate our privileges.
So we will say Set Payload, windows/x64/meterpreter/reverse
tcp.
Of course, you can use whatever protocol you are interested in
or that you find useful.
In my case, I'll use Reverse TCP.
We can then show the options for this particular module.
And in this case, we have the RHOST option already
specified for us.
We know that Rejetto is running on Port 80, which
is perfectly fine in that case.
And then of course, as for the payload options,
we have the LHOST option specified for us.
You can, of course, change that to the interface.
So we can say set LHOST to ethernet 1.
If you want to do that as well, you can go ahead and do that.
And we'll leave the LPORT as Port 4444
as it's currently open.
All right, so we will hit Run or you can hit Exploit,
depending on what you're comfortable with.
In my case, I'll just Run.
Don't worry if it gives you a warning regarding
the URI.escape is obsolete.
As you can see, we get a Meterpreter session
on the target system so we can type in the sysinfo command.
And we can also get an idea of what user we currently
have access to by typing in Get User ID.
And in this case, you can see we have an account called
Admin, not Administrator, which is a very different, but Admin.
And that's going to be quite important.
Now, we can try and elevate our privileges
using the Get System Command.
So we can say Get System and hit Enter.
And as you can see, all of the techniques fail.
So the Named Pipe Impersonation technique In Memory
Fails as well as Token Duplication and the Pipe
Impersonation technique.
So all of these techniques fail.
So let's try and get an idea or an understanding
as to what users are currently on the system
and what our privileges are.
Now, we can do that by tapping and getprivs and hitting Enter.
And this command is limited to the Meterpreter session
on a Windows target.
So this will give you an idea of your current privileges
or the privileges assigned to this particular user.
And indeed, we can confirm that this really
isn't an Admin user, but just a standard user.
Now, this Admin user may be part of the Administrators group.
So how exactly can we verify that or find out whether or not
this user is part of the Administrator group?
Well, in order to do that, we can open up a shell session
to get a command prompt.
And we can then type in Net Local Group.
Or we can actually start off by displaying the actual users
on the system.
So I can say Net Users.
And as you can see, we have an Admin account,
which is what we currently have access to.
And then we have the real Administrator account,
as well as a Guest account.
Now, in order to enumerate the actual members that
are part of the Administrators group,
we can type in Net Local Group Administrators.
Hit Enter.
And as you can see, the members of the Administrator group
are Admin and Administrators.
So the Admin user account is part of the Administrators
group, which means they can perform administrative tasks
or they can essentially make changes to the operating
system, which is great.
Which means we can actually bypass UAC relatively easily.
Now, you may have a question at the back of your mind.
And that is, why are we utilizing
this particular privilege escalation technique?
The reason we're utilizing the Bypass User Access Control
technique is because first and foremost, it actually exists
within versions of Windows from Windows Vista to the latest
versions of Windows.
So it is fairly stable in that regard.
And secondly, again, it is, again,
a very, very, very efficient technique
when it comes down to elevating privileges
and doesn't require any additional tinkering
or tweaking.
And the Metasploit framework has various Bypass UAC modules
available based on your current situation
or the actual configuration of the target system.
So now that we've verified that the Admin user is
part of the Administrators group,
we already know that we don't have administrative privileges
through them Meterpreter session.
So we can bypass UAC by utilizing the Bypass UAC
module.
But to be specific, we're looking for the In Memory
Injection module.
So I will terminate this particular channel
and I will put this in the background.
All right, there we are.
And if we check our sessions, you
can see that this is a Meterpreter 64-bit Meterpreter
session.
And we currently have access to the system via the Admin user,
right?
OK, so that's very, very important to take note of.
So the module that we are looking for
is the Bypass UAC module.
Now if we hit Enter, you can see that we have quite a few Bypass
UAC modules that utilize different techniques
to essentially elevate your privileges.
Now, the one we are interested in, in particular,
is going to be the Bypass UAC Injection module, which again,
works or essentially performs the actual bypassing
of the User Access Control mechanism In Memory.
And in this case, it will, of course,
execute the actual Meterpreter payload In Memory.
So this is the actual exploit module here.
So we are going to copy that.
And we are going to say Use.
It's great to set the default payload
to the 32-bit Meterpreter payload.
So we need to change that to the actual Windows x64 payload.
So we're going to say windows/x64/meterpreter/reverse
tcp.
All right, we can now show the options
associated with this module.
And you can see that we need to set up the actual session
ID here.
So we can set the session to Session ID 1.
We then need to set up the LPORT option,
because if we list out our sessions here,
you can see that the session--
that this particular session here
is already utilizing Port 4444.
So we need to set the LPORT option.
So I'm going to show the options again and set LPORT
to something like Port 4433.
OK, so we hit Enter.
And we can now test out this payload, all right?
So we're going to hit Run.
All right, so we can see that it actually
says that Windows Server 2012 R2 may be vulnerable.
UAC is enabled.
It's going to check the level.
It'll tell you that the Admin user is part
of the Administrators group.
It's going to say that UAC is set to default.
And then it's going to tell you Bypass UAC can bypass
this setting, continuing.
But it tells us that the exploit was aborted due to failure,
bad-config x86 Target Selected for x64 system.
So in order to set the target we're
going to say Set the Target Option.
And then we can use the Tab Alt to completion
to actually set the actual--
we can use this to set the actual target operating system
architecture.
So in this case, we need to set the target to Windows x64,
right?
So we set the target and then we hit Run.
All right, as you can see, it now completes successfully
and injects the payload into the process.
And then it tells you the process ID.
So we can see that it's a sending stage and we
get the Meterpreter session.
So we say sysinfo.
We still have a 64-bit Meterpreter payload
and we say getuid.
So the reason we don't have any elevated privileges
is primarily because the actual Bypass UAC exploit
module essentially created a second Meterpreter session,
as we already explored during the slides.
And this Meterpreter session has the UAC flag or UAC disabled,
which means we can utilize the Get System
Command to essentially elevate our privileges.
And in this case, it will successfully
be able to elevate our privileges
because UAC is disabled.
And as a result, we can pretty much
execute any command as the Administrator user
without providing any passwords or any credentials.
And the reason why I recommend utilizing
this particular technique and this particular exploit module
is because it works really well on Windows versions
later or newer than Windows Vista.
So Windows Server 2008, Windows Server 2012.
As we've just done, Windows 7, Windows 10, Windows 8.1,
et cetera, et cetera.
All right?
So we've now been able to elevate our privileges.
So we can perform tasks that require
administrative privileges like hash dump.
We hit Enter.
And as you can see right over here,
we get the hashes for the Admin user,
as well as the Administrator user.
So again, you can now go ahead and perform
all the tasks or functionality that require
administrative privileges.
So that is how to elevate your privileges by bypassing UAC.
And that is going to conclude the practical demonstration
side or aspect of this video.
In the next video, we are going to be exploring
the process of elevating our privileges on Windows
through the Token Impersonation technique.
And this can be facilitated through the use
of a Meterpreter module called Incognito.
So that's what we're going to be exploring in the next video.
I'll see you there.