Instructor: Welcome back.
Time to see how we can try to elevate our privileges
on the target machine.
But before we do that
I just want to play you this recording
that we recorded from the previous video using interpreter
and the record mic command just to see
that we indeed managed to record the sound
on the target machine, see if we play it.
"This will start recording
and it should capture what I'm speaking
at the moment to the microphone."
You can see it did manage to record it.
Now it is not that high quality of a sound
but nonetheless we can hear what the target spoke
on the microphone nonetheless,
Let's get back to the privilege escalation.
And privilege escalation is a big topic
and a more advanced topic.
There are many advanced techniques that can be
used to try to elevate privileges.
However, we're going to be covering the scripts
we can use to automate those processes.
All of those scripts we have available
inside of our Metasploit framework.
Now usually we don't know
whether we can elevate privileges or not.
Throughout the years
there have been many exploits that got patched
for the privilege escalation.
However, maybe our target skipped some patch
and is vulnerable to one of them.
So what we are left is just to try all
of those scripts out and see if some of them works.
What we can do to search
for the privileged escalation experts is we
can first background this session
that we got with our Windows 10 machine
and we can type search bypass UAC.
What does this mean?
Well, UAC is user account control and this exploits
that we will find are used to bypass it
which could allow us to elevate our program privileges
to the system level.
Another thing I like to search is type search
and then the year that we are currently in
since we are at the end of 2020
we can type 2020 or search 2020 and this will list
out all the modules that came out this year.
Inside of these modules, we will have everything.
So what we want to search and filter out is Windows exploits
and preferably local Windows exploits.
As we can see right here, what does local mean?
It means it's getting executed on the system itself.
Usually these type
of local exploits try to elevate privileges.
For example, here we can see a few
of them such as exploit Windows local
and then this name up here we got another local exploit
and many more are right here
and we can also see the SMB Ghost exploit.
Now I know what you're thinking.
I did say that Matasploit Framework
doesn't have SMB ghost module.
Well, that wasn't true.
However, this module is a local exploit and it's only useful
after you're already on the target machine.
As we can see, it is exploit for Windows
but it is also a local exploit.
The one that we covered is the same vulnerability
inside the SMB version three, just we exploited it remotely
from another computer to gain a shell.
But let's test it out just to see whether we
manage to elevate our privileges using this exploit.
So to use it, we can type, use and paste the exploit.
Just make sure
that you got the active session with the target machine.
As you can see right here, I got session one active
on the user account of the Windows 10 machine.
If I type show info for this exploit
we can read that this is a vulnerability that exists
within the Microsoft server message block 3.1.1
protocol that can be leveraged to execute code
on a vulnerable server.
So we can see the targets right here
and all we need to set is the session ID to do that,
we can type the sessions command, check out the session ID
that we got and type set session and then one
if I type run to execute this local exploit well seems
that it did something but we didn't get a shell back
so we can assume it doesn't work.
Let's try another one.
If I type search 2020 and for example
let us say I'm going to use this one
which is exploit Windows local CVE 2020 service tracing.
And the reason why I'm using this one is
because down here it says privilege elevation vulnerability.
So this can be used to elevate privileges
in case our target machine is vulnerable.
Let's check it out, press enter type show info just to check
out what this module does.
And this module leverages a trusted file override
with the DLL hijacking vulnerability to gain system
level access on vulnerable windows 10 64 with targets.
So our targets do match
and we do want to gain system level access.
So let us see whether this will work.
There is only one thing that we must test
and that is required and that option is the session.
So let's type set session and then one press enter
and run the actually fail to validate LHOST.
So let us type show options just to
see which bailout we got.
And we need to set LHOST to be 192.168.1.12
which is the IP address of my Cal Linux machine.
Now also make sure that the L port is different
than the port that you got active inside of a session.
Since I got port 5555 active in the current session
I can specify right here 4444
but if your Meterpreter session is running on port 4444
you need to specify a different local port.
Otherwise, none of these exploits will work.
So I can leave it on 4444 and type run.
And it seems that this one doesn't work either.
Let's try from the UAC bypass exploits.
So I will type search bypass UAC, and here I will see all
of the exploits for user can't control bypass.
Now you can go ahead and try all
of these local Windows bypass UAC experts to
see which ones work.
Just make sure you read information
about them first before running them.
But what I'm going to use
in this case is this fodhelper bypass UAC.
It is from 2017 and it showed to work a lot
of times in my personal experience.
So I will copy the name type use
and then I will paste the name right here.
Press Enter, it configured the payload
and let's give it a try.
If I type show information just to see what it does
it will tell me "This module will bypass Windows 10
user account control by hijacking a special key
in the registry under the current user hive
and inserting a custom command that will get invoked when
the Windows fodhelper.exe application is launched.
It'll spawn a second shell that has the UAC flag turned off.
Hmm. So let's see.
What are our options that we must set
and we need to set this session.
In my case, it's session one
and I can use the local port 4444.
And if I type run, here it is
we got another session open, we got the Meterpreter open
and this is a different session.
As you can see, it is running on port 4444
so we got a shell back with this local exploit, but
if we try to run the command, get user id, it'll
say that we are still the same account that we were before.
But remember it said in the module description
that this exploit will spawn a second shell with
the user account control flag turned off.
What does this mean?
Well, it means that if we try once again to run
the command get system, that didn't work before
now we are the system account.
We did it right now
we can say we fully owned this Windows 10 target machine
since there is nothing that we can do on it right now.
And just to prove to you, I will type
get user ID once again
and it'll tell me that I am authority system account.
So feel free to test
out other modules to see if they work or not.
And you can also try these modules
on our Windows seven virtual machine just to
see how that would go.
Great. Now that we elevated our privileges, let us check
out other post exploitation modules that we can also run.
See you in the next video.