WEBVTT 00:00:00.620 --> 00:00:01.730 In this demonstration, 00:00:01.740 --> 00:00:05.080 we're going to look at how we can obtain a high integrity agent. 00:00:06.240 --> 00:00:09.550 And the reason for this is that some persistence techniques 00:00:09.560 --> 00:00:12.660 are available in a non‑elevated agent, 00:00:13.140 --> 00:00:15.750 and some are available in an elevated agent. 00:00:16.340 --> 00:00:18.230 So, during your red team engagement, 00:00:18.240 --> 00:00:21.910 you probably would need to elevate to a high integrity agent if 00:00:21.910 --> 00:00:25.030 you would like to perform a certain type of persistent techniques. 00:00:25.030 --> 00:00:27.050 Let's take a look at our environment. 00:00:27.440 --> 00:00:28.560 In this demonstration, 00:00:28.570 --> 00:00:33.110 we will focus on the help desk PC. On the help desk PC, we 00:00:33.110 --> 00:00:35.060 already have a C2 channel established. 00:00:35.440 --> 00:00:39.850 However, the agent that's reporting in is not a high integrity agent. 00:00:40.440 --> 00:00:41.180 So in the demo, 00:00:41.180 --> 00:00:44.590 we will leverage that existing agent and establish a high 00:00:44.590 --> 00:00:46.920 integrity agent on the same machine. 00:00:47.090 --> 00:00:48.040 Let's get started. 00:00:48.380 --> 00:00:51.570 Let's take a look at the agents that are currently reporting to Empire. 00:00:52.150 --> 00:00:54.470 Right now I have one agent which is active. 00:00:54.840 --> 00:01:00.350 I will interact with this agent and view the info to see what type of integrity 00:01:00.350 --> 00:01:04.260 level I currently have. From the output of the info command. 00:01:04.360 --> 00:01:07.420 I have some information related to the agent. I can see the 00:01:07.420 --> 00:01:10.290 name of the agent, the listener that's being used, the 00:01:10.290 --> 00:01:12.980 PowerShell version, IP address information, 00:01:13.290 --> 00:01:18.110 OS details, and a lot more. With the current agent of an 00:01:18.110 --> 00:01:21.530 integrity level of 0, I can perform some attacks. 00:01:21.540 --> 00:01:22.450 However, 00:01:22.620 --> 00:01:26.300 some attacks require elevated rights. In order to get elevated 00:01:26.300 --> 00:01:29.370 rights, we need a high integrity value of 1. 00:01:30.340 --> 00:01:33.530 There are a number of modules that we can use that can perform this, 00:01:33.770 --> 00:01:37.270 but let's use one within Empire which is called PowerUp. 00:01:39.840 --> 00:01:43.860 I will use the module on the PowerUp which is called AllChecks, 00:01:44.440 --> 00:01:48.690 and what AllChecks does, it performs various checks to see how 00:01:48.690 --> 00:01:50.770 we can obtain a higher privilege. 00:01:51.740 --> 00:01:55.070 When I issue the info command, it gives me information about the module. 00:01:55.260 --> 00:01:57.640 Since I'm using this module within an active agent, 00:01:57.940 --> 00:01:59.750 I don't need to define any options. 00:02:00.210 --> 00:02:03.050 The only option that's available is to set the agent name, 00:02:03.640 --> 00:02:05.860 but in my case, this is already defined. 00:02:06.940 --> 00:02:09.070 I'm going to go ahead and execute this now, 00:02:10.120 --> 00:02:14.080 and it will run a task on the agent, and once the task is completed, 00:02:14.360 --> 00:02:16.670 it will return back some results. 00:02:17.440 --> 00:02:20.260 Now that PowerUp is completed, let's take a look at what it did. 00:02:21.840 --> 00:02:23.500 We can see that a job was started, 00:02:23.510 --> 00:02:27.770 and within this job it ran the command Invoke‑AllChecks. 00:02:28.140 --> 00:02:31.170 What this does is it goes and it checks for various things. 00:02:31.540 --> 00:02:34.020 The next step is it started to look at what type of 00:02:34.020 --> 00:02:35.770 administrative privileges exist. 00:02:36.690 --> 00:02:38.020 So it looked at the user, 00:02:38.030 --> 00:02:40.530 and we can see that the user is in the local group that 00:02:40.530 --> 00:02:42.460 will grant administrative privileges. 00:02:43.040 --> 00:02:47.400 It then returned the type of attack that I can run to elevate my privileges. 00:02:47.700 --> 00:02:48.370 In this case, 00:02:48.380 --> 00:02:52.260 it's the BypassUAC attack. From there, it continued to do some 00:02:52.260 --> 00:02:55.610 additional checks where it looked at service paths, service 00:02:55.610 --> 00:02:58.870 permissions, hijackable DLLs, registry keys, 00:02:58.880 --> 00:03:02.550 autologon credentials, and a lot more, and eventually it completed. 00:03:02.940 --> 00:03:06.080 So now I'm going to use the output from PowerUp to 00:03:06.080 --> 00:03:07.790 obtain administrative privileges. 00:03:07.970 --> 00:03:11.390 And in this case, it's going to be the BypassUAC attack. 00:03:11.600 --> 00:03:13.440 So, I'll exit out of the module, 00:03:13.640 --> 00:03:16.900 and I'm going to issue the command bypassuac, and you can see 00:03:16.900 --> 00:03:20.260 that now I need to define a listener name. So I will issue 00:03:20.270 --> 00:03:23.620 bypassuac again with the listener name. 00:03:23.690 --> 00:03:27.550 Next, a new job will be started, and we can see that after a few minutes, 00:03:27.730 --> 00:03:32.360 I have a new agent which is reported in. Let's take a look at this agent. 00:03:33.340 --> 00:03:37.510 So, I will exit out of my current agent, and I will list my agents. 00:03:37.520 --> 00:03:39.890 And now you can see I've got two agents reporting; the 00:03:39.890 --> 00:03:41.770 first one which we initially used, 00:03:41.900 --> 00:03:45.960 and the new one which was created using the bypassuac attack. 00:03:45.970 --> 00:03:49.380 I'm going to interact with this new one, and I will issue the info command. 00:03:49.390 --> 00:03:53.500 And now you will notice that I have an integrity level of 1. This 00:03:53.500 --> 00:03:57.340 shows that I now have an administrative agent, which was obtainable 00:03:57.350 --> 00:04:00.260 by using the PowerUp module within Empire. 00:04:00.840 --> 00:04:03.180 My next step would be to rename these agents to 00:04:03.180 --> 00:04:04.800 something that's more user‑friendly. 00:04:05.080 --> 00:04:07.410 I will also prep the rest of the machines so we can 00:04:07.410 --> 00:04:09.170 leverage them in the upcoming demos.