[MUSIC PLAYING]
Welcome to the Windows Privilege Escalation
section of this course.
In this section, we are going to be exploring
the process of identifying Windows privilege escalation
vulnerabilities, as well as exploring
an example, or a couple of examples,
as to how we can elevate our privileges on a Windows system
after we've gained access to it.
And of course, I've already gone over the post-exploitation
methodology and where and if privilege escalation
fits into it.
So just to run over that again, if you gain access to a Windows
system and you're provided with elevated privileges
or anti-authority system privileges,
then you can skip over the privilege escalation
phase of post-exploitation.
However, you may need to go through that phase
again once you exploit another system on the target network.
But we are going to be running under the assumption
that you've gained access to a Windows system
without elevated privileges.
And we are starting off in this video
with the process of how to identify Windows privilege
escalation vulnerabilities.
So why do we need to do this?
Well, firstly, privilege escalation
is a very complicated step or phase of post-exploitation
and for various reasons.
And again, these are not just limited to the operating
systems themselves.
So it doesn't matter whether you're
targeting Windows or Linux.
There's a plethora of privilege escalation techniques
that you can utilize to elevate your privileges.
Now, in order to elevate your privileges on Windows,
you must first identify privilege escalation
vulnerabilities that exist on the system you have just
compromised.
You cannot generalize privilege escalation.
The only section or phase of privilege escalation
that remains fixed or is a constant
is the process of identifying privilege escalation
vulnerabilities.
After that, the techniques, or the techniques and tools,
that you will use to elevate your privileges
will depend on a few factors, one of which is, in this case,
the version of Windows, as well as the system's
unique configuration.
Because Windows systems are configured differently,
and based on that configuration, there
could be a few vulnerabilities that
can be exploited to elevate your privileges.
And the same goes for the various versions or editions
of Windows and the fact that there's multiple privilege
escalation vulnerabilities that affect
specific versions of Windows over a different version
of Windows.
Now, it's important, also, to note that within this section
I'm not going to be covering all of the privilege escalation
vulnerabilities or techniques that you
can utilize on Windows.
I'm simply going through this and giving you
an idea of how you can, firstly, identify privilege escalation
vulnerabilities on a Windows system,
and then, how to use that information
to exploit these vulnerabilities in order
to elevate your privileges.
So this process, as you can already tell,
can be quite tedious and time-consuming.
And as a result, it is recommended
to automate the process of identifying privilege
escalation vulnerabilities.
This can obviously be done through the use
of various automation scripts.
Now, we're not really talking about local enumeration
anymore or how to automate local enumeration.
We're specifically interested in privilege escalation
vulnerabilities.
And in regards to privilege escalation vulnerability
scripts that you can use, one of the best ones
available that I personally use and have been using
for a couple of years now--
or rather recently-- is the PrivescCheck script.
So this is a PowerShell script.
And it aims to enumerate common Windows configuration
issues that can be leveraged for local privilege escalation.
It also gathers various information or various bits
of information that might be useful for exploitation
and/or post exploitation.
So I've linked the GitHub repository
to this particular script, and you can check it out for
yourself.
I'll be navigating or I'll be taking you
through the GitHub repository and how
to use this particular script.
And the way it works is that you gain access
to a Windows system.
You then transfer this script onto the target system,
and you execute it with PowerShell.
It'll then perform a series of checks
and identify privilege escalation vulnerabilities
that you can exploit to elevate your privileges.
Now, this video has a lab environment attached to it.
And the lab environment is set up in a really cool way
where the target system--
the target Windows system--
already has the PrivescCheck script downloaded
and set up on the target system.
So you don't actually have to go through the process
of transferring it from the internet
onto the lab environment.
It's already done for you.
So the first step in this process,
or in the practical section, will involve gaining access
to the Windows target system, after which we can then,
again, take a look at how to utilize the PrivescCheck
script to identify a privilege escalation vulnerability.
And then, we'll exploit that vulnerability in order
to elevate our privileges.
So without further ado, I'll see you in the lab environment.
All right, so I'm back within the lab environment.
And you'll be provided with the target IP address.
And of course, in your case, it's going to be different.
But the really cool thing with this lab environment
is that you're not only provided with access to your Kali
machine, you're also provide it with access to your Windows--
or to the Windows target system or the victim machine.
So you can see that the target system is running Windows.
And the PrivescCheck GitHub repository
has already been saved onto the desktop here.
So we're going to be using it.
Now, the reason you have been provided with access to both
is so that in the event you don't
want to simulate a real pen test and the post-exploitation
phase, you can simply execute this script directly
on the victim machine and take a look at the output
that it provides for you.
However, given the fact that this--
we are essentially training to become pen testers,
we are going to go through this as if it were a simulated pen
test.
So we are going to copy over this target IP.
Now, the target system doesn't have any vulnerable services
running on it.
So the way we are going to gain access to the system
is by utilizing a Metasploit framework
module called web delivery.
And I'll just open up a new terminal and I'll zoom in here.
So I'll say msfconsole.
Let me make sure that is visible.
All right, there we are.
It looks like it's started.
And I'm going to search for the modules.
I'm going to say search for web delivery--
so web underscore delivery.
And we are going to use the following exploit modules.
So it is exploit, multi script, web delivery.
And I'll explain what it's used for in a couple of seconds.
So I'll say use 1.
There we are.
And don't worry about it automatically
specifying the payload.
We'll actually set all of these options as required.
So I'll say show options.
And we can show the info here really quickly so that you
understand what it does.
All right, so if we show the info
for this particular module, you can
see that it says right over here under Description
that this module quickly fires up a web
server that serves a payload.
The provided command, which will allow for a payload to download
and execute-- and that's the command will be copying over
to the victim machine and executing it within a command
prompt--
it'll either do a specific-- or it will do it in either
a specified scripting language interpreter or it will use
the squiblydoo via the regsvr32 or Reg Server 32 .exe
for bypassing the application whitelisting.
Essentially, what's happening here
is this particular exploit module
sets up a web server that hosts a payload based on the target
operating system.
Once you hit Exploit, it then generates some PowerShell code,
because in this case, we're targeting Windows.
And this particular module supports Python PHP Windows
Linux.
We'll then copy that PowerShell code
and execute it on the target system, which will consequently
download the payload that is being hosted on the web server
and execute it.
That will consequently provide us
with a standard Command Shell session,
which we can then upgrade to a Meterpreter session.
All right, so let me just clear out the terminal.
And if I show the options here, you
can see that the option that we are really interested in
is the target and the actual payload.
So for the target, we're going to set the target
to PowerShell.
So I'll say, set target to PowerShell,
and we're going to use the binary option.
So set target, PowerShell, binary.
We are then going to set the payload.
We're going to obtain a simple command PowerShell session.
So we're going to say, Windows, shell, reverse tcp.
All right, so we'll hit Enter.
We also want to disable PowerShell--
we also want to disable the PowerShell
code from being encoded Base64.
So we'll say, set PowerShell encoded.
Let me just type that in correctly
with the correct case-- so encoded command-- to false.
And if we show the options, now, we still
need to configure the payload options.
So we need to set up the LHOST value, which is the Kali Linux
IP.
So the Kali Linux IP we can easily set that
by saying set LHOST, and we can set it to the value associated
with the interface ethernet 1.
You can see that's going to set your Kali Linux IP address.
And we can leave the LPORT as 4444.
Once we hit Exploit, you'll see that it'll
generate some PowerShell code.
So I want you to copy all of this PowerShell code right
over here.
And just don't worry about this not displaying any output.
And head over to the victim system,
and we'll open up the search menu here and open up a command
prompt session.
So we'll say cmd.
All right, we'll give this a couple
of seconds, as this, of course, is running in the cloud.
So there we are-- cmd.
And we'll open up the command prompt.
And just right click within the command
prompt, and that will paste in the command that you copied.
We then hit Enter.
Don't worry if the window disappears.
If you take a look at the Kali system,
you can see that it's going to say Command Shell Session 1
open.
So we have obtained access to the target system.
So if I hit Enter and type in sessions,
you can see we have access.
So I can say, sessions 1.
And we currently have access to the target system
through a simple Command Shell Session.
And of course, we are currently we currently
have access as the user student, which we can confirm by saying,
who am I?
And you can see, we're currently the student user.
And the host name is attack defense.
You can also verify that by saying hostname.
We've already gone over this, so you can see how that is done.
All right, so before we actually move forward,
I want to migrate this command session to a Meterpreter
session.
So I'll use the key combination Control and Z
and put this in the background.
Or you can simply type in background.
I'm then going to search for the module Shell 2.
So shell underscore 2, and we're looking for the Shell 2
Meterpreter module.
So I'll say use 0.
And there's a few things that we need to do here.
So because this is a post-exploitation module,
we need to set the LHOST option, because it's
going to provide us with a Meterpreter session.
So we'll set that to ethernet 1.
We then need to set the session option to session 1.
That's the actual ID of the Command Shell session.
And if we show advanced, we need to set an additional option
that is on the WIN TRANSFER.
So instead of setting the transfer method to PowerShell,
we want to set that to Visual Basic.
So we'll say, set WIN underscore TRANSFER to VBS.
And if we show the options one more time just
to confirm that everything is set correctly,
make sure the LPORT is not in conflict
with your current Command Shell session.
You can see that the Command Shell session
is running on Port 4444.
And make sure that it doesn't conflict with this option here.
Once that is done, we can hit Exploit.
And we should receive a Meterpreter session.
So we'll give this a couple of seconds.
It should send the actual command stager.
So we'll just give this a couple of seconds.
All right, so after a couple of seconds,
you can see that it will send the command
stager, after which you will receive a Meterpreter session.
There we are.
So it's going to stop the exploit multi-handler.
And if I type in sessions, you can see we have session 2,
and that is the Meterpreter session.
So I'll say sessions 2.
And we'll just clear out the terminals.
So I can say, sysinfo to learn more about the target system.
You can see that the hostname is ATTACKDEFENSE.
The target is running a Windows Server 2016, build 17763.
The operating system architecture is 64-bit,
and our Meterpreter session is 32-bit.
We can migrate to a 64-bit process.
So I'm going to say, ps, and we can migrate to explorer.exe.
So let's see if we can identify it.
You can see that it's only displaying
the actual privileges associated with the user
that we currently have access to for specific processes.
And the rest of the processes-- that means
are currently running with privileges
of other users or authority system or service privileges.
And that means we cannot migrate to them.
So let's see if I can identify Explorer here.
We should be able to find it around here.
Let's see if I can find it right over here.
So we have Explorer.
So we want to target this one here.
So the process ID is 3624.
So I'm going to say, migrate 3624.
And it's going to migrate into the explorer.exe process
for stability.
All right, so if I say, get user ID, you can see it's student.
And we can now confirm that this user is unprivileged.
So if I say, getprivs, you can see that this user only
has two privileges.
And we now need to elevate our privileges.
So what we can do now, is let's open up--
or let's navigate to the root of the C Drive
and then to the Users Directory.
So I'll say, cd Users and cd Student.
And on the desktop, we're going to have the PrivescCheck
directory.
So I'll navigate into that.
And if I list all the content of this directory,
you can see we have the PrivescCheck PowerShell script
right over here.
And we can open up a Command Shell session, now.
And we can now head over to the GitHub repository
to, essentially, take a look at how
to run this particular script.
So let me just switch over to my browser.
All right, so I'm back in my browser,
and I'm currently on the PrivescCheck GitHub
repository, as you can see.
And this GitHub repository contains
the build PowerShell script, as well as
the PrivescCheck PowerShell script right over here.
And you can go through the documentation.
For the usage, it has various options
based on your current level or type of access
that you have on the target system.
So if you have access to the target system
through a standard Command Shell session, which
is what we have here, then copy this command here,
as this is what will be used to essentially execute
the Privesc PowerShell script, or the PrivescCheck PowerShell
script.
And again, make sure that you execute
this within the PrivescCheck directory
on the student user's desktop.
So I'll copy this.
And again, you can take a look at other options.
For example, if you have a PowerShell session
on the target system, then you can use the following commands
to execute it.
And right at the top here, this is the command we're copying.
The way it works is we essentially saying,
PowerShell--
the actual execution policy--
set to bypass for the execution of this particular script.
And then, we specify the script itself.
And then, we invoke PrivescCheck.
And that should begin performing the check.
So just make sure you copy that.
And let me switch over to the lab environment.
All right, so I'm back within the lab environment.
And again, you can essentially paste that
into the lab environment clipboard
by using the following keyboard combination-- so Control,
Shift, and Alt all altogether.
And you can see, it's already added to my clipboard.
So once you've pasted it in there,
you can just close this by saying Control, Shift, and Alt.
And now, if I say Control, Shift, V to paste it
into my current session on the target system and I hit Enter,
it is going to execute the script.
So there we are.
It's beginning to perform all the checks.
So give this a couple of seconds to a couple of minutes
to complete it.
Shouldn't take too much time at all, after which we'll
be able to, essentially, go through all the vulnerabilities
that we've been able to identify and explore
how they can be exploited.
So again, just give this a couple of seconds.
All right, so once it's done, at the bottom
it will give you a summary or the PrivescCheck report,
which will essentially take you through a list of checks
that it performed in regards to privilege escalation
vulnerabilities.
And if it identified a specific result,
it would highlight that next to the particular check.
And they are based on different types of checks.
So for example, privilege escalation
via poor configurations or by Windows features
that have been enabled, these are highlighted as CONFIG.
It'll then check for privilege escalation vulnerabilities
that fall into credentials and credential management.
So it'll check for WinLogon credentials.
It'll also check for SAM and system backup
files, unattended installation files, GPP passwords.
By the way, I already--
I have covered how to elevate your privileges on a Windows
system through the unattended installation files.
And I cover that in the system and host-based attacks course.
So if you'd like to learn more about that,
you can check it there.
And then, of course, it'll also essentially perform
checks on the hardening.
So it'll tell you whether BitLocker-- there
are any vulnerabilities within BitLocker.
The Credential Guard, LSA protection, Hijackable DLLs,
under Scheduled Tasks, if there are any services that
have misconfigured binary permissions or unquoted parts,
it'll tell you that there.
Under SERVICES, it'll essentially
check for non-default services, for misconfigured binary
permissions, for unquoted parts, for service permissions,
for weak service permissions, and for misconfigured registry
permissions.
It'll also perform-- check on UPDATES
to essentially verify or to check whether your system is
up to date.
It'll also enumerate the hotfixes installed.
It'll then perform your standard user--
your user checks, so users and groups, identity, environment,
privileges, et cetera.
So let's scroll to the top of the results,
because there are quite a few results
that we need to explore here.
So I'll just navigate all the way to the top
here where it actually began.
So there we are.
That's where we executed it.
So firstly, you can see that it is essentially
going to start off with USER and Groups here.
So it will display a list of all users
on the system, as well as groups.
So you can see that right over here, these are all the Groups.
So you have your standard users group.
And we should have the local administrators group.
That should be displayed somewhere over here.
If it's not displayed, that's perfectly fine.
And then, right over here, it'll display your current user
privileges, which we already did,
the current user environment variables-- remember,
it's performing these checks and identifying
whether there are any vulnerabilities
within these particular files or configurations that
can be exploited.
So for example, in the case of environment variables,
you can see that this will list the environment
variables of the current process and try
to identify any potentially sensitive information,
such as passwords or API secrets.
This check is simply based on keyword matching
and might not entirely be reliable.
It'll then perform checks for the non-default services.
This will list all registered services
and filter out the ones that are built into Windows.
It does so by passing the target executables metadata.
So these are all the non-default services.
And then, of course, you have service permissions.
And right at the bottom, it'll tell you not vulnerable.
So that means that their vulnerabilities do not
exist in regards to privilege escalation vulnerabilities.
And of course, where results are produced--
if we can actually identify them here--
you can see under Credentials, WinLogon.
You can see that this will parse the Winlogon on registry keys
and check whether they contain any clear text passwords.
Entries that have an empty password field
are filtered out.
So it found one result, and it actually
has provided us with the administrator credentials.
So in the next video, we'll actually
be taking a look at how we can utilize
these credentials to elevate our privileges
and how we can authenticate to the target system with them.
So in terms of other results that it was able to find,
we can see under LSA Protection, it
tells us right away here that RunAsPPL is not configured.
Under Hardening, the Credential Guard
is not configured, as well.
So this system is actually secured quite well.
And the only vulnerability that we
were able to find that can help us elevate our privileges
is through the WinLogon feature.
As for the AlwaysInstallElevated feature,
you can see that it's currently disabled,
and it's not vulnerable.
And you can scroll through all the results.
So for example under, UPDATES, it
will enumerate the install updates and hotfixes
and check whether a patch was applied in the last 31 days.
So you can see that this is the hotfix ID that was installed.
The description is updated.
It was installed by the administrator
on the following date.
And at the bottom, of course, you have your summary.
Now, the great thing with the PrivescCheck script
is that it also allows you to perform an extended check using
the extended flag here.
But that's something that we really
don't need at this stage, and we'll probably
be exploring all of this during another course.
All right, so that is how to identify Windows privilege
escalation vulnerabilities through the use of an automated
script.
And that is going to conclude the practical demonstration
side of this video.
All right, so now that we've been
able to identify a privilege escalation vulnerability,
and in this case, we were able to identify the WinLogon
credentials for the administrator user,
in the next video, we'll be exploring
the process of how to utilize these credentials
to essentially obtain an elevated session.
Because if you obtain Windows credentials and you know
RDP is disabled, how can you use these credentials
to obtain an elevated session?
So that's what we're going to be exploring.
So I'll be seeing you in the next video.