Windows Privilege Escalation.
In this video, we will be exploring
the process of utilizing the credentials we obtained
in the previous video when we were taking a look at how
to identify Windows privilege escalation vulnerabilities,
and we'll be exploring how we can
use these credentials to receive an elevated session
on the target system that we have compromised.
So we're going to be utilizing the same lab
environment that we used in the previous video.
And again, you can follow along with the steps that
are required to gain access to the target system
from the previous video.
I'm going to be resuming where we left off
at the end of the previous video,
where we had already performed the check
with the actual privilege escalation check script.
And we are going to head straight
into how to use these credentials to obtain
an elevated session.
So I'll just switch over to my lab environment,
and we can take a look at how this can be done.
All right, so I'm back in the lab environment,
and this is where we left off from in the previous video.
And we identified that there is a privilege escalation
vulnerability pertinent to credentials
and, more specifically, the WinLogon feature.
So the WinLogon feature is a feature on Windows
that allows you to configure a Windows system to automatically
log on, and the credentials for this specific user to log on
are typically stored in the Windows Registry.
Now, based on how a system is configured and secured,
it is always recommended to encrypt
these log on credentials or when they're stored in the registry.
And in this case, it doesn't look
like that was actually done.
So you can see under the actual TEST
here, CREDS, WinLogon, we actually
went through the description.
But let's just go through it one more time.
So this will parse the WinLogon registry keys
and check whether they contain any clear text
password, entries that have an empty password field
or filtered out right.
So in this case, we've pretty much
hit the holy grail in that we've identified
the credentials or the password for the administrator account
on the system.
And as we know, the administrator account
on a Windows system is pretty much
the user account that has the highest level of privileges
available, right?
And we have the clear text password, which means,
in this case, we really do not even need to crack any hashes.
We pretty much have got the credentials
that we're looking for.
So you might be asking yourself, what can we
do with this information?
How do we elevate our privileges?
How do we switch to the administrator user?
So let's get started with the first technique, right?
And we'll explore how to do this with and without Meterpreter
or the Metasploit framework.
So let me just paste in the password that I copy this,
so that I have it on hand here.
And I'll zoom in so you can actually see it.
So I've pasted it in the password for the administrator
user.
So once you have gathered these credentials,
you know that every Windows system will have SMB running.
And as part of the wide variety of features that Windows has,
one of the features that it has is the ability
to authenticate with SMB, right?
And we can utilize a Python implementation
of the PsExec utility to log in to the target system
and obtain an elevated session because we
have administrator credentials.
So what I'll do is, I'll just right click on my terminal,
and I'll open up a new tab.
And this Kali Linux system already
has the PsExec Python script.
So if I just type in psexec, you can see it'll auto complete,
and the script name is psexec.py.
So how can you log in to the target system?
We're logging into the target system
or authenticating with the target system
with psexec is fairly simple.
It's quite familiar to logging in to a system via SSH
or through the SSH client.
We specify the PsExec Python script,
and then we specify the user that we
want to authenticate as.
So in this case, the user account is administrator.
And then, we say, @ and specify the target IP address.
So this is the system we would like to authenticate with.
I'll just paste that in there.
And then, we need the password on hand,
so I'll also copy that there.
And we can then hit Enter.
This is going to prompt you to enter
the password for the user.
So I'll paste it in there.
And if I hit Enter, you can see it's going to request shares.
It's going to find a writable share,
and this is the admin share.
It's then going to upload the payload and open up SVCManager.
And it's then going to create the service,
and we are provided with a command shell session.
So you might be asking yourself, well,
what privileges do I currently have?
Or what user do I currently have access on the target system as?
By typing whoamI, can see nt authority system,
which is the highest privileges available on a Windows system.
And you know, I can say net user, for example.
And these are all the user accounts on the system.
So I can say, whoamI priv, and we
should have all the privileges that you typically
have if you gained access to a target system
as the administrator user.
So we have essentially elevated our privileges,
and this was all facilitated through the use
of the priv check script, which is fantastic.
So this is one way you can use the credentials.
And of course, this PsExec authenticates
to the target system via SMB.
And remember, the great thing about this
is, we are not exploiting the system.
We're just authenticating legitimately
because we have obtained legitimate credentials.
Now, if you want to obtain an elevated Meterpreter session,
and you have the administrators credentials,
you can also do this within the Metasploit framework, right?
So I'll just terminate this particular channel here,
and I'll put my Meterpreter session in the background.
Remember, this is the unprivileged Meterpreter
session.
So if I list out my sessions, we have the standard command
shell, and then we have the unprivileged Meterpreter
session.
And you can see, we had access through the student user.
We can search for the PsExec Metasploit modules.
So I'll say, search psexec, and we are looking
for the following module.
Let me see if I can find it.
There it is.
So this is the one here-- exploit/windows/smb/psexec.
So this is the Microsoft Windows authenticated user code
execution.
So in order to use this module, you
need legitimate credentials.
So I'll say, use, and I'll paste the actual module name
in there.
And it'll set the default payload
to windows/meterpreter/reverse_tcp.
This is the 32-bit Meterpreter payload.
That's fine for now because we can always migrate our process.
So let's show the options.
For the payload options, make sure
that the LHOST is set to your Kali Linux IP,
and make sure that you set L port
to a port that is not-- that will not conflict
with your current sessions.
So in my case, I know that both port 4444 is being
used as well as port 4433.
So I'll set the L port to 4422.
We then need to specify the target IP address.
So we'll just copy the target IP here.
And in your case, this will be different, but just
copy the value.
We'll say set RHOSTS, paste that in there,
and we then need to set--
we then need to set the SMB user and the SMB password.
So this is where you put in your credentials.
I'm going to say, set SMBUser to administrator because that's
the account we authenticating with,
and then set SMBPass to the password
that we identified, right?
So I'll just copy that there.
And I'll paste that in there, and we can hit exploit.
And we should receive an elevated Meterpreter session.
There we are.
Almost immediately, you can see that it will
connect to the target system.
It is then going to authenticate to the target system
as the user administrator.
It's going to select the partial target.
It's going to execute the payload,
and the Meterpreter session will be opened up.
So we can say, sysinfo.
You can see we're still on the same target system.
If I say getuid, NT AUTHORITY SYSTEM.
And we have successfully been able to elevate our privileges
on a Windows system.
So that is going to conclude the practical demonstration
side of this video.
All right, so that concludes the Windows privilege escalation
section of this course.
As I said, these are going to be relatively short, primarily
because I've covered other privilege escalation
techniques within the system and host-based attacks course
in addition to the Metasploit framework course.
What I was really focused on here
is the process of identifying Windows privilege escalation
vulnerabilities, right?
And we've been able to take a look at a good example that
highlights the importance of these tools
and the importance of performing checks based on all the Windows
features configuration files in order
to identify privilege escalation vulnerabilities that
can be exploited.
With that being said, we are now going
to move on to the next section, which
is going to involve performing privilege escalation on Linux.
So I'll be seeing you in the next video.