WEBVTT

00:00:01.740 --> 00:00:03.290
Welcome back to our lab environment.

00:00:03.290 --> 00:00:06.080
Now that we have here the SharpUp tool running fine,

00:00:06.080 --> 00:00:09.090
we can start to use this tool to escalate our privileges.

00:00:09.090 --> 00:00:11.560
To use this tool is really simple.

00:00:11.800 --> 00:00:16.050
You just have to type SharpUp.exe audit,

00:00:16.050 --> 00:00:18.850
and then the module that you want to use.

00:00:19.540 --> 00:00:20.180
For example,

00:00:20.190 --> 00:00:24.160
let's see if we can find any CachedGPPPasswords using this module here.

00:00:25.440 --> 00:00:26.970
Once I press Enter,

00:00:26.970 --> 00:00:30.950
SharpUp will perform several checks to see if any GPPPasswords are in cache.

00:00:31.740 --> 00:00:35.850
In my case, I have none, so we should try to run some of the other modules.

00:00:36.440 --> 00:00:41.130
To make things easier, we can simply type SharpUp with the audit parameter,

00:00:41.130 --> 00:00:44.370
and this will execute all 13 modules for us.

00:00:44.370 --> 00:00:47.570
In this way, we don't need to try it module by module.

00:00:47.760 --> 00:00:48.860
So, let's run this.

00:00:51.940 --> 00:00:54.960
Then, as you can see from the 13 privilege escalation techniques,

00:00:54.970 --> 00:00:57.460
we have only two that might work in the server.

00:00:57.460 --> 00:00:59.370
And actually, quick pause here,

00:00:59.380 --> 00:01:01.570
if you're running these two on a brand‑new virtual

00:01:01.570 --> 00:01:03.710
machine with a fully patched Windows,

00:01:03.720 --> 00:01:06.850
you most likely will not find any privilege escalation path.

00:01:07.540 --> 00:01:10.390
This tool checks for common misconfigurations that

00:01:10.400 --> 00:01:12.350
admins implement in real companies.

00:01:12.350 --> 00:01:13.740
For this demo,

00:01:13.750 --> 00:01:17.870
I made this machine vulnerable on purpose to simulate a real‑world scenario.

00:01:17.870 --> 00:01:21.850
For example, see here this Always Install Elevated vulnerability?

00:01:22.340 --> 00:01:25.550
This is something really common in companies with bad security practices.

00:01:26.340 --> 00:01:29.840
This means that the IT administrator created GPO policy

00:01:29.850 --> 00:01:32.360
allowing all installer files to run as admin,

00:01:33.040 --> 00:01:35.730
and they do that so their regular users can install software on

00:01:35.730 --> 00:01:38.160
their laptop without intervention of the IT team.

00:01:38.840 --> 00:01:40.330
And as a really common configuration,

00:01:40.330 --> 00:01:43.340
that is a huge security risk because if you are able to

00:01:43.340 --> 00:01:47.550
create a fake Windows installer file, it will execute with admin privileges.

00:01:47.550 --> 00:01:51.060
So, we can create a Windows installer with a malicious payload

00:01:51.110 --> 00:01:53.450
and you it give us admin level execution.

00:01:54.340 --> 00:01:55.750
So let me show you how that's done.

00:01:56.240 --> 00:01:58.060
I'll go to my Kali Linux machine,

00:01:59.040 --> 00:02:03.350
then open the terminal and use the msfvenom to to

00:02:03.350 --> 00:02:05.050
create a malicious Windows installer.

00:02:06.440 --> 00:02:09.110
If you're not familiar with msfvenom, don't worry, let's

00:02:09.110 --> 00:02:10.360
take a look at this command together.

00:02:11.240 --> 00:02:14.810
First, I have here the option ‑p specifying that I want my Windows

00:02:14.810 --> 00:02:17.360
installer to have a Windows reverse shell payload.

00:02:18.840 --> 00:02:22.560
I also have here the flags lhost to define the IP address of my

00:02:22.560 --> 00:02:26.560
attacker machine and the lport to define the ports in which will

00:02:26.560 --> 00:02:28.260
be listening for the reverse shell.

00:02:29.640 --> 00:02:34.540
After that, I have the ‑f flag msi, which will tell msfvenom that I want a

00:02:34.540 --> 00:02:40.960
Windows MSI file, and this is a Windows installer file. And after that, I will

00:02:40.970 --> 00:02:45.960
output this to a file called shell.msi. And that's it.

00:02:46.340 --> 00:02:49.930
Once I run this, msfvenom will create a fake Windows installer

00:02:49.940 --> 00:02:53.260
with a reverse shell inside of it, and this reverse shell will

00:02:53.260 --> 00:02:54.850
connect back to our attacker machine.

00:02:56.440 --> 00:03:00.080
Now, let me set up the listener for this reverse shell. I'll open

00:03:00.080 --> 00:03:06.190
Metasploit using the msfconsole command. And in here, I will use

00:03:06.190 --> 00:03:08.360
the listener exploit/multi/handler.

00:03:09.640 --> 00:03:15.010
Now, I will set the same payload as I use in the msfvenom, and I will also set

00:03:15.010 --> 00:03:18.150
the same lhost an lport that we had in the msfvenom command.

00:03:21.840 --> 00:03:26.310
Okay, now let me run this. Perfect.

00:03:26.310 --> 00:03:28.950
We have a listener ready. Once we have executed the

00:03:28.950 --> 00:03:30.760
installer, we will get a session here.

00:03:32.040 --> 00:03:35.360
Now, all we have to do is translate this file to the victim computer,

00:03:35.940 --> 00:03:40.030
and you can do that in any way you want. In here, I'll simply use a

00:03:40.030 --> 00:03:42.360
Python HTTP server to share the file.

00:03:43.140 --> 00:03:45.560
I'll use this command here to start the HTTP server.

00:03:47.340 --> 00:03:51.280
Then, I'll go to my victim machine and access my attacker machine IP

00:03:51.280 --> 00:03:57.540
and port. And from this list, I will download the shell.msi file.

00:03:57.540 --> 00:04:00.540
Then, now that we have the installer here,

00:04:00.550 --> 00:04:01.650
we just have to run it.

00:04:05.440 --> 00:04:08.650
Take a look. It looks like it failed,\ but that's just a decoy.

00:04:09.040 --> 00:04:10.710
If we go to our Kali Linux machine,

00:04:10.720 --> 00:04:13.150
we can see that we got a new Meterpreter session here.

00:04:13.840 --> 00:04:16.829
Pretty cool, right? And the best part is that this session

00:04:16.839 --> 00:04:19.550
is running as a system, which is the highest privilege

00:04:19.550 --> 00:04:20.660
that we can have in a machine.

00:04:21.339 --> 00:04:23.650
We can even start the show and do whatever we want in there.