📘
CAS Cybersecurity
  • Start
  • Reconnaissance
    • Opensource Intelligence
  • Docker basics and Images
    • Damn Vulnerable Webapp
    • bWAPP
    • Juice Webshop
    • Webgoat
    • Metasploitable 2
    • Metasploitable 3
    • MISP Docker (old)
    • MISP Docker (new)
  • Scanning and Enumeration
    • Scanning with zenmap
    • Scanning with nmap
    • Scanning with msf auxiliary
  • Vulnerability Scanning and Analysis
    • OpenVAS
    • nmap vulnerability scan
    • MSF Auxiliary Modules
  • Exploitation
    • Metasploitable 2
    • Redis Server
    • Print Nightmare
    • Baron Samedit
    • Polkit
    • Heartbleed
  • Man in the Middle
    • ARP Cache poisoning
    • RDP MitM Exercise
  • Windows Hacking
    • Throwback Network
      • Entering the breach
      • Exploring the caverns
      • Webshells and you!
      • First Contact
    • WinAttack LAB
      • Module 01
      • Module 02
      • Module 03
      • Module 04
      • Module 05
      • Module 06
      • Module 07
      • Module 08
      • Module 09
      • Module 10
  • Web Application Security
    • Burp Proxy Introduction
    • DVWA
      • DVWA Exercises 1
      • DVWA Exercises 2
      • DVWA Exercises 3
      • DVWA Exercises 4
      • DVWA Exercises 5
      • DVWA Exercises 6
      • DVWA Exercises 7
      • DVWA Exercises 8
  • CTF and Crypto Exercises
    • Cyberchef Challenge
    • HTB Invite Challenge
    • BSides London 2019 Challenge
    • Ninja Sec Challenge
  • Threat Intelligence
    • MISP Exercise 1
    • MISP Exercise 2
    • MISP Exercise 3
    • MISP Exercise 4
    • MISP Exercise 5
    • MISP Exercise 6
    • MISP Exercise 7
    • MISP Exercise 8
    • Virus Total Graph Exercise
    • RFI Incoming!
  • Forensic Exercises
    • Disk Forensics
      • The Sleuth Kit Intro
      • Filecarving with Foremost
      • Filecarving with scalpel
      • Bulk extractor
      • Disk acquisition with dd
      • Disk acquisition with dcfldd
      • Disk acquisition with ewftools
      • Disk acquisition with FTK Imager
      • Mount disk image (raw)
      • Unknown USB Stick
      • USB Stick Filecarving
      • Autopsy Exercise
    • Windows Forensics
      • Bitunlocker
      • Alternate Datastreams
    • Memory Forensics
      • Volatility2 Basics (Linux)
      • Volatility2 Exercise 1
      • Volatility3 Exercise 1
      • Volatility3 Exercise 2
      • Volatility3 Exercise 3
    • Image Forensics
      • Unswirl Image
      • Manual Filecarving 1
      • Manual Filecarving 2
    • Browser Forensics
    • Mail Header Analysis
    • Timestomping Exercise
    • Network Forensics
      • Tshark Exercise
  • Malware Analysis
    • Ransomware
      • General Introduction
      • Ryuk
      • RansomEXX
      • REvil
      • BlackMatter
      • Hades
      • Egregor
      • DoppelPaymer
    • YARA
      • YARA Install
      • yarGen
      • YARA with Cyberchef
      • TCP dump analysis
      • Memory dump analysis
    • Dosfuscated Scripts
  • Android Malware
    • LAB Setup 1
    • LAB Setup 2
    • Android Manifest
    • Android Permissions
    • APP Tracing with Frida
    • AES Key decryption
    • RedAlert
    • BlackRoseLucy
    • Crackme RE Challenge
  • Forensic Readiness
    • Windows Event Logs
    • Windows Sysmon
    • Sysmon: Capture Clipboard
    • Sysmon: Process Injection
    • Ransomware Detection
      • Signature based
  • Live Response
    • Velociraptor P1
    • Velociraptor P2
    • Velociraptor P3
    • Windows Response LAB
      • Lateral Movement Detection
      • Detect persistence
      • Volatility Analysis
Powered by GitBook
On this page
  • Win Attack Lab: Privilege Escalation
  • 1. Introduction
  • 2. Situational Awareness
  • 3. Questions
  • 4. Answers

Was this helpful?

  1. Windows Hacking
  2. WinAttack LAB

Module 02

PreviousModule 01NextModule 03

Last updated 3 years ago

Was this helpful?

Win Attack Lab: Privilege Escalation

1. Introduction

After having established the initial connection to your Windows 10 client via RDP, we will first assess the situation on the machine. This should give you an idea about the available attack surface and possible options to escalate your privileges.

Your current user tmassie is a regular user on the machine and does not have local admin privileges.

2. Situational Awareness

  1. Powersploit

The tool we are using to assess the local situation on the client is called PowerSploit. PowerSploit is a collection of PowerShell scripts which can be used in various stages of an attack. In this case, we are going to use the Privesc module to look for possible ways to escalate our privileges.

First, we need to start PowerShell with disabled execution policy. Start a new command line and enter the following command:

powershell -exec bypass

cd C:\temp\tools\PowerSploit\Privesc\

Import-Module .\Privesc.psd1

Invoke-AllChecks

  1. Creating UserAdd MSI

In order to exploit the AlwaysInstallElevated registry key, we need to create an executable in the .msi format. You can create your own executable with the tools of your choice or you can simply run the abuse function suggested by PowerSploit:

Write-UserAddMSI

2. Running the exploit

After that we have a new user called backdoor which is part of the local Admin Group

Now we can start a cmd with elevated privileges:

whoami /groups

Take a look at the mandatory label!

3. Questions

  1. Explain the vulnerability you used for privilege escalation.

  2. Can you use the new user account to log on to another machine and why?

  3. Explain if the cmd.exe was started in an elevated context and how you can tell that from the output of whoami /groups?

  4. If yes, explain how you “bypassed” UAC?

  5. How can you prevent such an attack?

4. Answers

  1. On the target win10 Client a policy called AlwaysInstallElevated is set to 1. Any user can install msi packages with elevated system priviledges which is equivalent for granting full administrative rights and a massive security risk! The registry hives are located under:

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer

2. Login to another machine is not possible yet, because we only elevated our priviledges on the local machine.

3. With local admin privileges we are allowed to start cmd.exe in an elevated context. The mandatory label is set to high then. Otherwise mandatory level will be medium

4. It’s not really a bypass. We just used the admin credentials from our freshly created user backdoor. By playing a little bit we could find out another cool trick. With the tool psexec.exe and the parameters -s -i -d followed by cmd.exe we got a cmd prompt running under local system priviledges!

5. First mitigation in this case is to disable the AlwaysInstallElevated Registry hive