WEBVTT

00:00:01.440 --> 00:00:02.240
Before we go,

00:00:02.240 --> 00:00:04.800
I want to show you one more privilege escalation technique

00:00:04.810 --> 00:00:06.560
that we can use on this victim computer.

00:00:07.240 --> 00:00:10.520
If you remember from the previous demo, whenever we execute SharpUp tool,

00:00:10.530 --> 00:00:13.390
we actually get two different techniques that we could use.

00:00:13.390 --> 00:00:16.160
The first one we already explored the previous demo.

00:00:16.740 --> 00:00:18.450
Now, let's take a look at the second one.

00:00:19.440 --> 00:00:22.860
This one here, Modifiable Registry AutoRun Files,

00:00:23.240 --> 00:00:25.680
basically means that it's a file that runs automatically

00:00:25.690 --> 00:00:27.460
every time someone logs into the system.

00:00:28.340 --> 00:00:31.850
And because it's modifiable, it means that we have permissions to edit the file.

00:00:32.940 --> 00:00:34.120
So again, think about that.

00:00:34.130 --> 00:00:38.100
We can edit a script that runs every time someone logs on.

00:00:38.100 --> 00:00:40.260
Now think, how could you exploit that?

00:00:42.640 --> 00:00:45.110
If the script runs every time someone logs on,

00:00:45.260 --> 00:00:48.360
it means that the script is executed with the person's privileges.

00:00:48.840 --> 00:00:53.260
So, when an admin logs on, the script will execute with admin privileges.

00:00:53.260 --> 00:00:55.960
And think about that, if we can edit the script,

00:00:55.970 --> 00:00:57.810
we can add malicious code to it.

00:00:57.820 --> 00:00:59.490
So, when the admin logs in,

00:00:59.500 --> 00:01:02.460
the malicious code will be executed with the admin privileges.

00:01:03.140 --> 00:01:03.940
Interesting, right?

00:01:04.180 --> 00:01:06.460
So now let's take a look at this modifiable file.

00:01:09.840 --> 00:01:10.620
Take a look.

00:01:10.620 --> 00:01:12.150
It looks like a pretty simple script.

00:01:12.840 --> 00:01:16.240
It cleans up the old backup files every time someone logs on.

00:01:16.240 --> 00:01:19.260
And it's a batch script, so it's fairly easy to add this.

00:01:20.040 --> 00:01:21.360
So we have two options here.

00:01:21.740 --> 00:01:25.760
First, I could create a reverse shell using Metasploit and add the code to here,

00:01:26.340 --> 00:01:27.860
and this will work perfectly.

00:01:28.240 --> 00:01:30.350
But as we've already done this in a previous demo,

00:01:30.350 --> 00:01:32.160
let me show you something different in here.

00:01:32.840 --> 00:01:35.370
Instead of using Metasploit, I'll do something a little bit simpler.

00:01:35.370 --> 00:01:37.160
I will add two comments to this file.

00:01:37.840 --> 00:01:40.560
The first one is to add a new user to the machine,

00:01:41.140 --> 00:01:44.860
something like this, net user /add,

00:01:45.740 --> 00:01:49.460
then the username that I want to add and the password for the account.

00:01:50.840 --> 00:01:53.570
One important thing here is that this password should meet the

00:01:53.570 --> 00:01:55.460
password complexity requirements of the domain.

00:01:56.540 --> 00:01:59.900
After adding the new user, I will add one more comment in here,

00:01:59.910 --> 00:02:03.690
which is to add this user to the administrator groups of this machine.

00:02:03.690 --> 00:02:08.960
And this looks like this, net localgroup administrators,

00:02:09.539 --> 00:02:13.960
and then the username that I want to add and then /add.

00:02:15.540 --> 00:02:16.000
Done.

00:02:16.010 --> 00:02:18.240
Those two lines will do everything we need.

00:02:18.270 --> 00:02:21.260
They will add a new user and then make this user an admin.

00:02:22.140 --> 00:02:27.860
So, we just need to save the script and wait for an admin to log into the system.

00:02:28.940 --> 00:02:30.520
As in here we're in a lab environment,

00:02:30.520 --> 00:02:33.200
I'll log in to the machine using admin credentials to

00:02:33.200 --> 00:02:35.360
simulate a new admin login to the system.

00:02:40.640 --> 00:02:40.920
Done.

00:02:40.920 --> 00:02:41.540
Take a look.

00:02:41.550 --> 00:02:42.990
We are logged in as admin.

00:02:43.140 --> 00:02:46.250
And there's nothing suspicious in here, everything seems normal.

00:02:46.740 --> 00:02:51.250
So, let me log out and go back to my normal session to this server.

00:02:52.040 --> 00:02:52.330
Cool.

00:02:52.330 --> 00:02:53.860
So let's take a look if that worked.

00:02:54.240 --> 00:02:58.350
I'll use the comment net users to list out the local users in this machine.

00:02:59.640 --> 00:03:00.160
Amazing.

00:03:00.160 --> 00:03:03.810
Take a look. We have here a new user called hacker, and that's us.

00:03:03.820 --> 00:03:07.050
So, let's take a look on what kind of permissions this user has.

00:03:09.640 --> 00:03:10.420
Nice. Take a look.

00:03:10.430 --> 00:03:11.760
We have admin privileges.

00:03:12.240 --> 00:03:13.650
Pretty cool, right? Now,

00:03:13.660 --> 00:03:15.990
all we have to do is log into this server using our

00:03:15.990 --> 00:03:22.380
new admin user. And there you go.

00:03:22.390 --> 00:03:23.600
We are logged in as the hacker,

00:03:23.600 --> 00:03:27.520
which is an administrator account. We even have here the Server Manager

00:03:27.520 --> 00:03:32.170
dashboard. And one important thing. After you're done with your red team

00:03:32.170 --> 00:03:35.830
work, don't forget to remove the malicious code from the original script and

00:03:35.830 --> 00:03:37.450
clean any other changes you might have made.