[Music]
hey guys hackersploit here back again
with another video welcome back to the
penetration testing boot camp more
specifically uh the windows privilege
escalation series uh in this video we're
going to be taking a look at how to
elevate our privileges by exploiting
misconfigured uh auto runs and i'll get
to what auto runs are in a few uh in a
few seconds right so we've already uh
taken a look at service exploitation and
we're now moving on to the registry
right and in
in particular this is not really uh you
know the process of elevating your
privileges through the registry but
rather obtaining information that that
is typically stored within the windows
registry so
what is uh autoruns right or what is the
autorun feature on windows well autorun
is a windows feature that is utilized as
typically utilized to automatically
start applications and programs during
system startup right uh and an example
of this would you know typically be a
program like steam you know so whenever
you start up your system if you've
configured a steam to start up then you
know steam will usually start up and
it'll update itself if there's an update
and that again is typically done by uh
by actual developers uh you know to
actually
check for updates to if it's a
persistent service um
that actually requires uh that needs to
be running in order to function
correctly then it'll be started up
whenever you essentially start up your
system and log in
all right now in terms of exploiting
autorun programs or executables that
have been configured to start on system
startup there are a few parameters that
we need to be aware of number one uh we
need to be the system actually needs to
have um you know autorun programs or
executable executables that have been
configured to to start up during the
system startup uh secondly
the program uh will actually uh we
actually need the the actual path of the
program to be modifiable by any use on
the system
and that will essentially allow us to
replace the legitimate executable with
our own malicious executable and in this
case we would typically uh replace it
with a
an interpreter payload that we've
generated with msf venom
okay now
in terms of identifying
the autorun executables we can do this
manually and automatically
if we are to start off with doing it
manually we can essentially you know
perform a registry query through the
command prompt and the actual registry
uh the actual registry that we're
interested in is under hkey local
machine software microsoft windows
current version and run and then run
will actually store the various keys uh
and in this case the keys are the actual
autorun programs or executables and this
particular query will actually display
the autorun programs as well as their
respective parts which is very important
in this context so what i'll do is i'll
just copy that there
and we'll head over into my interpreter
session i've already obtained a
interpreter session on the target system
now you may have realized that i'm doing
this on ubuntu well the reason i'm doing
this is again i got a lot of heat for my
last video
and a lot of people are saying you
really can't do what you typically do on
ubuntu well i'm doing it now so
msf console or metasploit is installed
and working so i've really just
installed just three or four tools that
i need to record this video just to show
you that it does work anyhow uh if i say
uh you know sysinfo let me just verify
to you that i'm not using an elevated or
i don't have an elevated session here
you can see i have i'm currently
utilizing the user account which is
unprivileged and of course if i say get
privs you can see that we only have
three privileges here and this is not a
privileged account
nor is it part of the local
administrators group so
what we can do is let me just open up a
command prompt here i'll say shell paste
in the actual registry query command hit
enter
and it'll actually display the various
keys so you have a security health
program and then it provides you with
the path to that particular program
and then you have the a program called
my program which is uh again has been
set up to demonstrate this particular
technique and the path to that program
is under c program files
autorun program
and program.exe all right so now that
we've identified
a uh we've identified a particular
autorun program we can utilize access
check to identify or to essentially
enumerate the permissions for that
folder in regards to what users can
actually make changes to that particular
uh you know program path and
consequently replace or you know delete
the actual executable itself but in our
case we'll be replacing it with our own
uh materpreta payload that we've
generated with msf venom
so
let's take a look at the try hack me
documentation here
um so try the access check utility or
executable has already been provided for
us on the target system under a
directory called privesque as you
already know if you've been following
along with this series and i'll just
copy the actual arguments here because
again every time we launch access check
we need to accept the euler and really
you we're just checking for permission
so
wvu and then the actual path to that
autorun program
so
uh what we can do here is i'm just going
to navigate back
into the root of the c drive
and under privesque
there we go
we have access check i believe let me
make sure that is there there we are so
that's there so i'll say access chk.exe
paste in the arguments there hit enter
and you can see that for the current
user so that's the user's group there
we pretty much have file access read and
write so that means that we can
currently make changes
to the particular directory or the path
of this particular autorun executable
right now uh the last variable that i
wanted to highlight in regards to
elevating our privileges uh through this
particular technique is
again going back to how autorun programs
work remember that they executed when a
user logs in or authenticates uh you
know either physically or via rdp
so
the user you authenticate as or
you know for example if we authenticate
as the administrator then the program
will be executed right
and typically that might not be required
because in the case of rdp all you
really need to do is just attempt to
authenticate and the program you know
will be executed right
so we can actually test and see how this
is working
and before we do that you can also
automate the process of finding these
auto run programs or executables with
win
and i want to highlight both techniques
so that you guys are actually aware of
this so within the temp directory i've
uploaded the win ps x64 binary there
disregard shell.exe i was using that for
a few tests uh but we'll get to that
when we get there so
um
win peace
x64.exe and we're not going to run any
specific checks we're just going to run
i'll enumerate all the information or
run all the checks that win peace would
typically perform so i'll hit enter
and this will take a few seconds and
we're looking for a specific piece of
information or a specific check that is
pertinent to the windows registry which
i believe is
it should be under its own section let
me see if i can identify that here
for some reason you have reached the
maximum for my terminal let me actually
configure that right now so preferences
i should have actually increased the
uh the actual scrolling limit
uh so limit scroll back to no limiting
there and we can probably run it again
but we should have it here because i
know win beast performs
some registry checks so what i'll do is
let me just run that again
uh so win p is
let me make sure i'm typing that
correctly uh so dir so yeah there we are
uh
win ps psx64.exe
hit enter
and i should be able to find that piece
of information now
so
that's done let me just scroll up
okay because i know it actually checks
it with wmi or runs a few wmi checks and
there we are it actually identifies
there so there we are key from wmic
um the folder it actually tells us the
autorun program there as well as the
security health program
and in the case of program.exe you can
see the file permissions are listed here
so everyone has all access
i'm just looking for the registry
section i believe it should be here this
is the one here i believe so
uh no this is still checking for
different types of vulnerabilities
uh it is probably above this here let me
see if i can identify it
uh there are a few there checks there we
are autorun applications that's what i
was looking for so i'll actually display
various autorun applications and it
identifies program.exe so file
permissions everyone all access uh
although you probably need to disregard
the unquoted unquoted file path there
because it was actually quoted but
there you are that's what we're looking
for file permissions everyone all access
okay
so now that we've done that what we can
do now
is let's navigate to the root of the c
drive and i'll just switch back into my
temperature so i'll terminate at that
channel there
and uh navigate to the root of the c
drive so that's under program files
uh program
files
sorry my bad my keyboard isn't actually
working
correctly today
like that in there so program files
there we are
and we're looking for the autorun
program
okay
so that's what we need to replace so i'm
just going to generate a new program
right and
i'm just going to generate the payload
with msf venom and i'm going to call it
program.exe there's a one thing that i
want to check before i do this however
and that is my session so my initial
access to this target system was
via powershell so if i list out my
sessions there
that's using port 444 and
sorry let me navigate to my other tab
here let me put this in the background
sessions
that is using one two three four so for
that payload we can use the port 4433 i
believe all right so sessions one
back in there
uh dir
all right so we're currently within that
directory all right so cool so i'll
navigate there
uh into my
documents directory yeah i'm currently
within the correct directory so i'll say
msf venom
msf venom let me see if i'm typing that
incorrectly
msf venom and i already have the z shell
uh the z shell plug-in doing its work
for me
and we'll change this to port 4433
and we'll output this as program.exe
program.exe
that's my ip address there
hit enter
so that will generate it for me
and then we can upload it directly
so we'll give this a couple of seconds
there we are
and
i will now
we actually need to set up the handler
for that which is very important and
already created a handler here so we'll
change that to port 4433
uh four four three three there we are
right and quit so msf console r
handler.rc
that'll set up the handler for us to
receive the connection once the autorun
uh the malicious autorun executable is
executed we now need to
transfer the program.exe or rather
replace the original one and we can do
that with meterpreter so uh back into my
interpreter session
upload uh documents
right hack me
windows prives
program
or exe
okay so
that should have replaced it
and what we can do now is let me make
sure my handler is set up
okay so let's take a look at the
documentation provided to us in the room
right so start the cali listener or
start a listener on kali and then
restart the windows vm
i will probably lose our sessions
that's fine open up a new rdp session to
trigger a reverse chill running with
admin privileges you should not have to
authenticate to trigger it however if
the payload does not fire login as admin
and admin password one to three to
trigger it note that in the real world
engagement you would have to wait for an
administrator to log in themselves so we
are going to assume that we are all of a
sudden the administrator for uh purposes
of demonstration so
uh can i restart it directly here from
romina probably let's try it uh so
restart
uh other yeah i keep forgetting that
this is a windows server so we'll
probably lose all our sessions which is
fine as long as we configured everything
correctly
um
and we can then connect once it's
restarted so i'm just going to wait for
it to reboot and then
i'll try and authenticate again with
romina are using the admin credentials
all right so it looks like it's rebooted
so i'll just log in admin password one
two three that's the credentials for the
admin account hit ok
and we should get a meterpreter session
that's going to start or log log us in
to the administrator account
uh so if we did everything correctly we
should get a interpreter session here
uh let's see let's see it's not sending
the stage so that looks like it failed
um
let's see there we are it actually
executes so that's not my fault that's
the the actual vm uh but yeah uh once
you log in it should automatically be
executed and it sends the stage
and we should get an elevated
interpreter session because the
administrator logs in so
uh this particular technique is very
nuanced in that it requires an action
from legitimate users in order for in
order for this to work right so as i
said you typically have to wait for the
administrator or a privileged user to
log in so um you know get use id
admin
get privs
and uh
yeah we are so this doesn't looks like
it's privileged um
can we migrate to a privileged process
like
we have elsas running here
keep forgetting that i'm running in tmox
ah that doesn't look privileged to me
but yeah i believe this user has
privileges although we pretty much would
need to
bypass uac
so that's something that we can actually
explore
but we can migrate maybe to svc host
you know process running as nd authority
uh let's see if i can find the process
that i'm looking for here
um
do we have that running now so
three seven eight eight so
three seven eight eight
give that a couple of seconds hopefully
doesn't fail
get use id
get privs yeah we can probably i know
that this user is privileged
um
and again if i let me let me actually
see if we have any impersonation tokens
or access tokens that we can impersonate
so
list tokens you
uh yeah so no authority system so we can
probably perform uh you know we can
actually bypass uac
uh however this user is privileged um
and uh of course if you know we can say
get system
let's see whether that actually gives us
yeah that tries essentially named pipe
impersonation
uh but yeah that is a privileged user
now if we wanted anti-authority system
uh anti-authority system privileges
uh then the most likely way or technique
that we would need to leverage is going
to be
um
is going to be bypassing uac now i don't
know whether i want to introduce that in
here or in this video probably not
because i'm going to be covering it
right
and bypassing uac is essentially
uh is essentially applicable when we're
in a situation like this where we have
access to a user
uh that is privileged or part of the
local administrators group right
however
you know in order for for us to do
anything that requires privileges
uh on the target system for example or
if an administrator was using that
system and they ran something as
administrator they would be prompted to
either accept uh or you know deny on the
on the actual uac consent a prompt or
the dialog box now because we're doing
this remotely we can do that so we have
to find a way of bypassing that
and there's multiple tools that you can
use but because this is windows server i
don't think there are any metasploit
modules that can actually be used to do
this uh automatically because this needs
to be done manually and i'll probably be
covering that within its own video
because i'm going to be covering a tool
called uac me and telling you or showing
you the various techniques you can use
to bypass uac but irregardless of that
this is a privileged
user
now as per the instructions within this
particular task it says that we don't
need to authenticate as the
administrator
all we really need to do is
open up a new rdp session so
what we can do
is
uh we'll exit from there and i'll just
say back here
and uh what i'll do is i'll take a look
at my sessions nothing there
and we say you know use multi handler
there we go
show options
should have the options configured
already for us and i run
and we open up a new rdp
session uh with
our desktop uh probably have to install
that so apt get install our
desktop
there we are and uh we can then
authenticate manually so
again you can see ubuntu is still
working although i don't have any of
these tools installed but should be set
up immediately for us here
without an issue
so
give this a couple of seconds there we
are let's authenticate do i trust the
certificate yes i do
okay so that
does not authenticate us as any user so
if we go back to
let's go back into my terminal here
let's see if that actually works
right because we've not authenticated
right now we probably need to restart
the system again so that's uh really
what i'm going to do so i'm just going
to restart it
right so um i've restarted the system
and
i know i reinitiated
my rdp session with our desktop but i
haven't received this stage yet so
that's probably why they've added the
documentation here
uh that an administrator or a privileged
user will need to log in or you know in
order to gain access and of course this
can really backfire because
if if a standard user with uh
with no with no real privileges logs in
then that autorun program will be
executed with their privileges so you
probably have to keep multiple jobs
listening um
or you know multiple handlers listening
for listening for a connection
uh until you get the admin uh you know
until you get the admin logging in right
but this really isn't uh elevating your
privileges as i said because you may be
part of the administrator's group
however
you don't have anti-authority system
privileges but for the purpose of this
video i'm going to just leave it off
here
and we're just going to complete this
because i know i'm not sure whether this
room covers a bypassing uac i will cover
that independently because that really
is very important and it's something you
will run across uh when performing a
real penetration test right so in the
next video we'll get started with one of
my favorite which is the always install
elevated feature
and again this really doesn't involve
exploiting the
registry uh all you're doing here is
utilizing the registry to identify
whether the always install elevated
feature is enabled right
once you know that that is the case
you can generate an msi or an
installation a windows installation file
and you can then essentially utilize the
msi exec tool
to install it with elevated privileges
as
as that is what the always install
elevated feature is there for
and that will consequently provided you
will provide you with an elevated
meterpreter session
all right so that is going to be it for
this video guys uh thank you very much
very much for watching if you have any
questions or feedback leave it in the
comments section if you want to reach
out to me you can do so uh by contacting
me via twitter or you can join in uh the
discussion by joining our discord server
the discord server or the link to the
discord server is in the description
section so do check that out and as
always i'll be seeing you in the next
video
a huge thank you to all of our patreons
your support is greatly appreciated and
this is a formal thank you so thank you
shamir douglas ryan carr sandor michael
busby sits up doozy defean barry dustin
on press and michael hubbard your
support is greatly appreciated and you
keep us making even more high quality
content for you guys so thank you
[Music]