WEBVTT 00:00:01.740 --> 00:00:02.250 Hey there. 00:00:02.260 --> 00:00:05.160 Welcome to the course, Privilege Escalation with SharpUp. 00:00:05.840 --> 00:00:07.700 My name is Ricardo, and in here, 00:00:07.700 --> 00:00:11.960 you'll learn how to get admin level access to a machine using the SharpUp tool. 00:00:13.540 --> 00:00:16.020 So, imagine that you're in a red team engagement. 00:00:16.020 --> 00:00:19.560 After exploiting a vulnerability, you got initial access to a server, 00:00:20.140 --> 00:00:22.290 and although this is already a really good achievement, 00:00:22.300 --> 00:00:25.050 you cannot do much with a low level user account. 00:00:25.050 --> 00:00:29.110 To be able to do more advanced things like accessing sensitive data, 00:00:29.110 --> 00:00:31.450 you need admin level access to the server, 00:00:32.439 --> 00:00:35.180 and that's why you need to know how to escalate privileges. 00:00:35.180 --> 00:00:36.650 And in this course, 00:00:36.660 --> 00:00:39.420 you'll learn how to find misconfigurations that will allow you 00:00:39.420 --> 00:00:41.520 to get admin level access to the server, 00:00:41.520 --> 00:00:43.660 so then you pretty much own the machine. 00:00:45.140 --> 00:00:47.420 There are dozens of techniques for privilege escalation, 00:00:47.510 --> 00:00:50.590 and it would take a lot of time for us to test each technique manually. 00:00:50.590 --> 00:00:53.190 For this reason, we have the SharpUp tool, 00:00:53.400 --> 00:00:56.660 which automates the testing of several privilege escalation techniques. 00:00:57.740 --> 00:01:02.060 The SharpUp tool was developed by Will Schroeder, who is known as @harmj0y. 00:01:02.060 --> 00:01:04.519 If you've never heard about @harmj0y before, 00:01:04.530 --> 00:01:07.160 I'd definitely recommend you checking out some of his other tools. 00:01:07.840 --> 00:01:09.880 He has a lot of interesting publications teaching 00:01:09.880 --> 00:01:11.560 exploitation and privilege escalation. 00:01:12.240 --> 00:01:15.230 SharpUp is a C# tool that ports several 00:01:15.230 --> 00:01:17.480 functionalities from the PowerUp framework. 00:01:17.480 --> 00:01:18.500 Basically, 00:01:18.510 --> 00:01:21.590 this tool is really useful to discover misconfigurations 00:01:21.600 --> 00:01:23.260 that could lead to privilege escalation. 00:01:24.540 --> 00:01:27.430 What I love about SharpUp is that it's an open source tool, 00:01:27.430 --> 00:01:29.640 meaning that you can download the source code and 00:01:29.640 --> 00:01:31.260 customize it for whatever you need. 00:01:32.040 --> 00:01:33.090 Also, as I mentioned, 00:01:33.100 --> 00:01:36.900 SharpUp is really useful to audit Windows machines to find common 00:01:36.900 --> 00:01:39.360 misconfigurations that could lead to privilege escalation. 00:01:40.240 --> 00:01:45.130 In reality, this tool has 13 different modules to find common misconfigurations, 00:01:45.390 --> 00:01:49.340 including AlwaysInstallElevated, CachedGPPPasswords, 00:01:49.350 --> 00:01:53.760 HijackablePaths, RegistryAutoruns, UnquotedServicePath, 00:01:54.140 --> 00:01:54.860 and much more. 00:01:56.640 --> 00:01:58.810 If you're familiar with the kill chain methodology, 00:01:58.820 --> 00:02:01.950 we can use SharpUp during the escalation phase of this process, 00:02:02.540 --> 00:02:04.280 meaning that after exploiting a machine, 00:02:04.290 --> 00:02:07.720 we can use the SharpUp tool to discover both the vulnerabilities and 00:02:07.720 --> 00:02:10.160 misconfigurations that could help us on privilege escalation. 00:02:11.740 --> 00:02:14.200 Also, if you're familiar with the MITRE ATT&CK framework, 00:02:14.210 --> 00:02:17.760 we can map this course to the privilege escalation phase of this framework. 00:02:18.640 --> 00:02:21.960 Inside privilege escalation, we'll be focusing on two main techniques. 00:02:22.740 --> 00:02:28.010 The first one is the T1574, which is hijack of execution flows. 00:02:28.010 --> 00:02:32.100 In more specifics, we'll be covering the sub‑technique 005, 00:02:32.210 --> 00:02:34.760 which is executable installer file permission weakness, 00:02:35.540 --> 00:02:37.960 and this means that we'll be able to abuse some permission 00:02:37.960 --> 00:02:41.640 misconfigurations to run a malicious installer in the target systems. 00:02:41.640 --> 00:02:44.350 And this will give us admin access to the machine. 00:02:46.040 --> 00:02:49.480 The second technique that we'll cover is the T1547, 00:02:49.630 --> 00:02:52.240 which is boot or logon autorun execution. 00:02:52.240 --> 00:02:56.610 In more specifics, we'll be covering the sub‑technique 001, 00:02:56.620 --> 00:02:59.720 which is registry run keys and startup folders, 00:02:59.720 --> 00:03:03.730 and this means that we will exploit some of the autorun scripts to 00:03:03.730 --> 00:03:06.250 execute malicious commands as administrator. 00:03:07.240 --> 00:03:10.460 And although those are the two main techniques, as you see in our demos, 00:03:10.470 --> 00:03:13.860 we can use SharpUp to test for several other privilege escalation techniques. 00:03:15.440 --> 00:03:18.120 If you want to follow our demos in your own environment, 00:03:18.130 --> 00:03:22.060 you need two things. First, you need an attacker machine. 00:03:22.540 --> 00:03:26.950 And in here, I'm using a Kali Linux version 2021.2 because it comes 00:03:26.950 --> 00:03:28.760 with pretty much everything we need for this demo. 00:03:29.540 --> 00:03:32.660 But in theory, you can use any Linux or Windows version you want. 00:03:33.940 --> 00:03:39.140 Also, you need a victim machine. In here, I'm using a Windows 2016 server, 00:03:39.290 --> 00:03:43.400 but, again, it could be any Windows machine you want. And that's it, 00:03:43.410 --> 00:03:44.950 that's all you need for this demo. 00:03:45.340 --> 00:03:46.610 So, enough of theory, 00:03:46.620 --> 00:03:49.860 let's go to our lab environment and see how those attacks are done in real life.