WEBVTT

00:00:01.340 --> 00:00:02.150
[Autogenerated] in this video,

00:00:02.160 --> 00:00:06.870
we're going to start looking at how we can use wind peas to discover any type of

00:00:06.870 --> 00:00:11.700
privilege escalation parts in Windows on my target machine.

00:00:11.860 --> 00:00:14.650
I am currently logged in as a low privileged user.

00:00:15.640 --> 00:00:18.280
I'm gonna go ahead and confirm this by trying to run command

00:00:18.280 --> 00:00:21.840
prompt in administrator mode and right away you'll see that I

00:00:21.840 --> 00:00:24.290
am prompted for admin credentials.

00:00:24.450 --> 00:00:28.170
So now let's go ahead and use WinPE S and we are specifically looking

00:00:28.170 --> 00:00:33.670
for any type of services that utilize a DLL allowing us to hijack that

00:00:33.680 --> 00:00:37.000
DLL and gain administrative privileges.

00:00:37.160 --> 00:00:40.190
So the first thing I'm gonna do is take a look at wind peas

00:00:40.280 --> 00:00:42.640
when I look at the help function of wind peas,

00:00:42.650 --> 00:00:45.300
you'll see that it's got a lot of different checks

00:00:45.310 --> 00:00:47.950
similar to what we've seen with Lynn pease.

00:00:48.680 --> 00:00:51.370
So what I'm gonna do now is just go ahead and run wind

00:00:51.370 --> 00:00:54.310
peas without any additional parameters.

00:00:54.740 --> 00:00:57.700
This is gonna go and perform all of the checks and

00:00:57.700 --> 00:00:59.480
then pipe the output back to me.

00:00:59.510 --> 00:01:02.000
So let's give this a minute to complete and then we

00:01:02.000 --> 00:01:03.570
will take a look at the results.

00:01:03.670 --> 00:01:06.920
So now that we have the results, let's take a look at the output.

00:01:07.170 --> 00:01:11.360
I'm going to go ahead and start from the top and immediately we'll see the

00:01:11.360 --> 00:01:17.090
awesome colors and again a legend of what each of the colors represent and

00:01:17.090 --> 00:01:19.570
then along with some information about the system,

00:01:19.660 --> 00:01:23.690
various updates the user environment and so forth.

00:01:24.310 --> 00:01:28.230
So now let's go and look at the services information because we

00:01:28.230 --> 00:01:31.490
are looking for any type of service that may be running that

00:01:31.490 --> 00:01:35.120
leverages a DLL file and more specifically,

00:01:35.130 --> 00:01:37.150
we are looking for a service that we can actually

00:01:37.150 --> 00:01:39.980
modify using our low privileged account.

00:01:40.280 --> 00:01:43.780
Alright, so as I go ahead and find the services information,

00:01:44.000 --> 00:01:46.720
you'll see that we've got a number of services currently running.

00:01:47.690 --> 00:01:52.050
One service that kind of stands out is the DLL S V C,

00:01:52.190 --> 00:01:54.600
which is the DLL hijack service.

00:01:54.950 --> 00:01:58.110
This specific service uses a X E file,

00:01:58.630 --> 00:02:03.370
but let's go ahead and look at that E X E file and see what it

00:02:03.370 --> 00:02:09.660
actually loads because generally E X files would be calling a DLL now

00:02:09.660 --> 00:02:11.720
in order to go and actually look at the file,

00:02:11.730 --> 00:02:15.640
you can perform like some type of reverse analysis of the file itself.

00:02:15.660 --> 00:02:19.500
You could copy that file to your Kali Linux machine or another

00:02:19.500 --> 00:02:23.490
Windows machine that you already have admin rights on and open it

00:02:23.490 --> 00:02:26.810
up with Process monitor as an example.

00:02:26.990 --> 00:02:29.730
So I already have another Windows machine and I'm gonna

00:02:29.730 --> 00:02:32.110
go ahead and switch to that machine.

00:02:32.120 --> 00:02:34.890
Alright, so looking at my current machine,

00:02:35.150 --> 00:02:39.730
I have now loaded that DLL service dot e X E file and

00:02:39.740 --> 00:02:42.410
using Sysinternals process monitor.

00:02:42.560 --> 00:02:46.830
I'm taking a look at any result that relates to name, not found.

00:02:47.710 --> 00:02:50.280
Now this is going to give me any type of file that this

00:02:50.280 --> 00:02:54.630
specific e x C is trying to load, which does not exist.

00:02:55.390 --> 00:03:01.380
You'll notice that something stands out and this is the hijack me dot Dll file.

00:03:01.850 --> 00:03:04.860
There are a number of different locations where the C x C

00:03:04.860 --> 00:03:07.470
is searching for that specific DLL.

00:03:07.710 --> 00:03:11.000
One such location is the temp location,

00:03:11.150 --> 00:03:14.790
which is generally a location that we would have access to.

00:03:15.290 --> 00:03:17.790
These are called world writeable folders.

00:03:18.360 --> 00:03:21.170
So let's go ahead and switch back to our target machine and

00:03:21.170 --> 00:03:23.100
see if we've got access to that folder.

00:03:24.080 --> 00:03:24.490
All right.

00:03:24.490 --> 00:03:27.300
And I've switched back to my target machine and I know

00:03:27.300 --> 00:03:30.430
I've got access to the temp folder because I was able to

00:03:30.430 --> 00:03:32.560
copy wind piece to the folder.

00:03:33.200 --> 00:03:37.000
What I have also done is I have leveraged MSF venom to create a standard

00:03:37.000 --> 00:03:41.320
DLL which will actually go ahead and execute a command that would add my

00:03:41.320 --> 00:03:44.950
current local user to the administrators group.

00:03:45.760 --> 00:03:50.000
So what I'm gonna do now is go ahead and stop that vulnerable service.

00:03:50.390 --> 00:03:55.660
Next I'm gonna go ahead and copy the DLL file to the stem folder.

00:03:55.910 --> 00:03:59.370
I'm then going to go ahead and verify that my account is

00:03:59.370 --> 00:04:01.220
not part of the administrators group.

00:04:01.230 --> 00:04:04.350
Alright, so let's go ahead and start the service.

00:04:04.510 --> 00:04:06.130
Now as I start the service,

00:04:06.140 --> 00:04:09.620
I should now be added to the administrators group

00:04:09.630 --> 00:04:11.780
because of the malicious DLL file.

00:04:11.940 --> 00:04:16.760
So let's go ahead and now query the local administrators group and sure enough,

00:04:16.769 --> 00:04:19.660
I have my user account added to the group.

00:04:20.040 --> 00:04:22.970
So this was another way that you could use wind peas to

00:04:22.970 --> 00:04:26.430
specifically escalate your privileges by looking at any type

00:04:26.430 --> 00:04:28.630
of DLL s that could be hijacked.