Module 6: Windows Privilege Escalation
Privilege Escalation Introduction
Privilege Escalation Enumeration
Privileges are the permissions of a specific account to perform system-related local operations. i.e. modifying the filesystem, adding users, shutting down the system, etc.
For these to be effective, Windows uses access tokens. These tokens are uniquely identified via a security identifier or SID. These are generated/maintained by the Local Security Authority.
From Windows Vista onward, processes run on four integrity levels, which align with various rights:
System integrity process: SYSTEM rights
High integrity process: administrative rights
Medium integrity process: standard user rights
Low integrity process: very restricted rights often used in sandboxed processes
Using AccessChk from SysInternals to search for files or directories with Everyone having write permissions
PS C:\tools\windows_privilege_escalation> .\accesschk64.exe -uws "Everyone" "C:\Program Files (x86)\"
Accesschk v6.13 - Reports effective permissions for securable objects
Copyright - 2006-2020 Mark Russinovich
Sysinternals - www.sysinternals.com
RW C:\Program Files (x86)\IObitPowerUp is another useful tool for identifying several common Windows misconfigurations.
PowerUp privilege escalation enumeration
User Account Control
User Account Control (UAC) is a Microsoft access control system introduced in Windows Vista and Windows Server 2008. The goal of UAC is that any application wishing to perform an operation with potentially system-wide impact, must inform the user and request approval to do so.
Bypassing UAC
Escalating to SYSTEM
Service Creation
Options for getsystem in Meterpreter
Successful elevation of privileges using getsystem
Meterpreter now running with SYSTEM-level privileges
Importing Get-Security.psm1
New Service created events
New Service installed events use event ID 4697.
Details of New Windows Service event
Sysmon events generated
Reviewing the RegistryEvents
Reviewing the ProcessCreate event
Checking if the keys or services still exist
Attacking Service Permissions
In some cases an attacker can just modify an existing service directly rather than creating their own.
Querying the Update Orchestrator Service
Enumerating permissions of a service with accesschk64.exe
All authenticated users have access to SERVICE_CHANGE_CONFIG, SERVICE_START, and SERVICE_STOP.
Querying the Serviio service
Modifying the service to point to a reverse shell instead
Starting the Serviio service
This fails, however that is just because the binary does not behave like a service and thus the error can be ignored. Checking the meterpreter shell shows it ran just fine.
ProcessCreate event showing the modification to the service
RegistryEvent entry for the service change as well
ProcessCreate events from starting the service
Chain of ProcessCreate events after starting the service
Leveraging Unquoted Service Paths
Unquoted service paths can allow an attacker to place an executable file along the path to be executed.
Example: A service binary is stored in a path such as C:\Program Files\My Program\My Service\service.exe. If this is unquoted then Windows will attempt to execute a binary from the following paths:
C:\Program.exe
C:\Program Files\My.exe
C:\Program Files\My Program\My.exe
C:\Program Files\My Program\My Service\service.exe
Querying service to identify its path
Last updated