WEBVTT

00:00:00.530 --> 00:00:01.690
[Autogenerated] in this demonstration,

00:00:01.750 --> 00:00:06.470
we're going to look at how we can use wind peas to identify registry

00:00:06.470 --> 00:00:09.950
keys that will allow us to escalate our privileges,

00:00:09.960 --> 00:00:13.860
I'm currently logged in as a standard user and I have already

00:00:13.870 --> 00:00:18.290
downloaded WinPE along with my reverse shell,

00:00:18.400 --> 00:00:21.770
my reverse shell has been set up with MSF venom.

00:00:21.850 --> 00:00:24.815
Now, generally when you look at privilege escalation parts,

00:00:24.925 --> 00:00:29.475
a good place to look would be the registry within the Windows registry.

00:00:29.745 --> 00:00:33.035
There are various types of registry keys that allow you to

00:00:33.035 --> 00:00:35.265
go ahead and escalate your privileges.

00:00:35.335 --> 00:00:36.205
For example,

00:00:36.305 --> 00:00:39.635
if I go ahead and look at this specific registry key

00:00:39.645 --> 00:00:41.805
which relates to the Windows installer,

00:00:42.135 --> 00:00:45.195
allowing it the privilege to always install an

00:00:45.195 --> 00:00:47.860
application in an elevated permission.

00:00:48.110 --> 00:00:51.990
Now of course the specific target is purposefully vulnerable.

00:00:52.120 --> 00:00:56.370
So in this case the specific registry key is set to

00:00:56.370 --> 00:00:58.600
one which means that it's enabled.

00:00:58.850 --> 00:00:59.320
Now,

00:00:59.330 --> 00:01:04.379
what if you wanted to go in search for more registry key is in a very quick way.

00:01:04.739 --> 00:01:08.580
Well this is where WinPE is can come into play because over and

00:01:08.580 --> 00:01:11.400
above which is searching for the registry keys of course it

00:01:11.400 --> 00:01:16.830
performs a lot more checks allowing you to view various other

00:01:16.900 --> 00:01:18.580
privileged escalation parts.

00:01:18.800 --> 00:01:18.940
Now,

00:01:18.940 --> 00:01:22.340
as I take a look at the different checks that when peers is able to

00:01:22.340 --> 00:01:25.340
execute because we are looking for registry keys,

00:01:25.440 --> 00:01:29.520
these would be found within the Windows creates component.

00:01:29.760 --> 00:01:33.970
So what I'm gonna do instead of executing the entire suite of checks,

00:01:33.980 --> 00:01:37.770
I'm going to just specify the Windows creds and as I hit

00:01:37.770 --> 00:01:40.000
enter wind peas will go ahead and run.

00:01:40.120 --> 00:01:43.180
Now of course I could have also piped all of the output to a

00:01:43.180 --> 00:01:46.950
text file but for the sake of the demonstration let's keep

00:01:46.960 --> 00:01:48.900
all of the output on the screen.

00:01:49.020 --> 00:01:51.450
So as we work through the results,

00:01:51.500 --> 00:01:55.880
let's take a look at what wind peas actually went and checked again.

00:01:55.890 --> 00:01:58.240
We are presented with the awesome colors.

00:01:58.650 --> 00:02:02.200
But as we look through the different Windows credentials we can see that

00:02:02.200 --> 00:02:06.340
Wind peas has already discovered some stored credentials.

00:02:06.500 --> 00:02:10.600
This one here is pretty interesting because this is a local

00:02:10.610 --> 00:02:14.750
admin account which has a stored credential so immediately I

00:02:14.750 --> 00:02:17.320
could use that to escalate my privilege.

00:02:17.870 --> 00:02:22.210
For example using something like rain is with the safe cred either.

00:02:22.210 --> 00:02:26.210
Let's not focus on this Super easy, low hanging fruit.

00:02:26.440 --> 00:02:28.730
Let's look at the Windows registry.

00:02:29.240 --> 00:02:31.950
So as I work through the rest of findings we can see that there

00:02:31.950 --> 00:02:35.950
are some additional credential files but then wind piece goes

00:02:35.950 --> 00:02:38.000
and looks for other credentials.

00:02:38.020 --> 00:02:38.880
For example,

00:02:38.890 --> 00:02:43.070
if there are any credentials stored in remote desktop connection manager,

00:02:43.700 --> 00:02:48.430
any type of Kerberos, tickets saved, Wi-Fi profiles and so forth.

00:02:49.020 --> 00:02:52.340
The one that I want to focus on specifically is this one

00:02:52.350 --> 00:02:55.300
which is always installed elevated.

00:02:55.610 --> 00:02:57.350
Now what's great about wind piece?

00:02:57.360 --> 00:03:01.420
It actually gives you a link allowing you to read up about the specific

00:03:01.430 --> 00:03:05.680
finding and how you can use it to escalate your privileges.

00:03:05.720 --> 00:03:08.320
Let's take a look at how we can use this miss

00:03:08.320 --> 00:03:11.240
configured registry key to our advantage.

00:03:11.410 --> 00:03:15.200
The first thing that I'm gonna do is generate a malicious M.

00:03:15.200 --> 00:03:15.280
S.

00:03:15.280 --> 00:03:15.500
I.

00:03:15.500 --> 00:03:20.770
executable this can be done with MSF venom or any other tool that you choose.

00:03:21.240 --> 00:03:25.360
In my case I have just generated a simple reverse shell using

00:03:25.360 --> 00:03:29.720
MSF venom and I have already copied it to the target machine and

00:03:29.720 --> 00:03:31.650
you can see the file listed here.

00:03:32.770 --> 00:03:36.150
Now let's go ahead and test if we are able to

00:03:36.150 --> 00:03:39.340
establish a reverse shell as system.

00:03:40.130 --> 00:03:44.380
Currently I am logged in as a standard user and I'm gonna go ahead and

00:03:44.380 --> 00:03:48.620
quickly start up my listener on my Kali Linux machine.

00:03:48.800 --> 00:03:53.550
I'm gonna go ahead and use nat cat and a simple listener listening

00:03:53.560 --> 00:03:57.470
on port 53 as I switch back to my target machine.

00:03:58.010 --> 00:04:02.390
I'm going to go ahead now and use the Microsoft installer and within the

00:04:02.390 --> 00:04:06.380
Microsoft installer I'm going to give it some additional switches such

00:04:06.380 --> 00:04:09.840
as running in quiet mode as I hit enter.

00:04:10.400 --> 00:04:13.330
Of course nothing happens because this specific M.

00:04:13.330 --> 00:04:13.390
S.

00:04:13.390 --> 00:04:13.630
I.

00:04:13.630 --> 00:04:15.670
File does not install anything.

00:04:16.029 --> 00:04:18.890
But now let's take a look at my listener to see if we have

00:04:18.890 --> 00:04:21.470
received a connection as I switch to my listener.

00:04:21.680 --> 00:04:23.530
I have established a connection.

00:04:23.630 --> 00:04:25.170
When I take a look at who am I?

00:04:25.590 --> 00:04:28.130
I am currently logged in as system.

00:04:28.770 --> 00:04:30.450
This means that because of that.

00:04:30.460 --> 00:04:37.680
misconfigurations streaky it ultimately allowed any installer to install an M.

00:04:37.680 --> 00:04:37.740
S.

00:04:37.740 --> 00:04:38.000
I.

00:04:38.000 --> 00:04:42.170
File as system in this case using Wind P.

00:04:42.170 --> 00:04:42.440
S,

00:04:42.770 --> 00:04:47.330
I was able to quickly and easily identify the specific registry key

00:04:47.340 --> 00:04:51.660
and get some additional information on how to use this finding to

00:04:51.660 --> 00:04:54.140
go ahead and execute a malicious M.

00:04:54.140 --> 00:04:54.200
S.

00:04:54.200 --> 00:04:57.220
I file so that I could escalate my privileges.