Original subtitles

[Music]

hey guys hack exploit here back again

with another video Welcome Back to the

penetration testing boot camp uh in this

video or in this set of videos we will

be uh taking a look at the various

Windows privilege escalation uh

techniques or vectors that you can use

to elevate your privileges on a Windows

system and again this is part of the pen

testing boot camp so we've covered post

EXP itation we're now moving on to

pesque we'll also be covering we we'll

also be covering prives on Linux so

again I just want to make sure that

we're uh we all have an understanding of

where we are and where we're going now

I've been getting a lot of messages

regarding uh the log forj or the log for

Shell vulnerability and how to exploit

it and I'm currently working on an

in-depth video that covers the

exploitation not just of uh you know of

the vulnerability on Minecraft servers

uh but also on the very ious Apache

Solutions out there so uh do stay tuned

for that in this uh video we'll be

focusing primarily on performing uh

local enumeration with a uh a script or

a tool called wipas which you guys have

seen me use before uh the objective of

this video is again to perform local

enumeration on the system in order to

identify uh the various vulnerabilities

that we can essentially exploit to

elevate our privileges and this uh the

room that we'll be utilizing is the

windows prives room on triac me it's a

free room and it's an intermediate room

so uh the objective here is to

essentially Elevate our privileges to

the highest level I've already started

the actual machine here and let me just

copy the IP there and as you can see

there are various techniques that we'll

be exploring and in my view this is

pretty much one of the best rooms on

traki uh that goes over the various

privilege escalation vectors on windows

so without further Ado uh the primary

access Vector is VI RDP so again we're

not exploiting anything on the target

system although that could be an option

uh but we'll just copy the xfree RDP

command here to uh essentially start up

an RDP session you're free to use Rina

if you want as well so there we are

that'll open up the RDP session for us

and we'll give that a couple of seconds

it looks like it's a uh Windows Server

uh box so we'll just wait for that to

load up um looks like it's starting up

CMD for some reason there we are Windows

Server 2019 evaluation now if we take a

look at the instructions here you can

see that we're logging in as an

unprivileged user so I just want you to

take note of that because that's very

important so uh again as I said we're

going to be using a tool called win

piece to perform enumeration in the

previous set of videos uh within the

post exploitation series I covered how

to perform manual enumeration on Windows

and we were primarily focused on

performing enumeration on an active

directory environment but again the

techniques are also uh in know to to

some degree applicable on a standard

Windows system so what is wipas well

wipas is essentially a binary or a tool

that can be used to uh essentially

automate all the you know traditional

information gathering uh checks that

You' perform on a Windows system and

more specifically it actually gives you

important diagnostic information

regarding vulnerable Services uh more to

do with elevating your privileges but

just basically uh it it really gives you

a comprehensive rundown of uh the system

configuration any misconfigurations or

vulnerabilities that we can take

advantage of so on and so forth all

right now the GitHub repository will be

in the description section and you can

see that right over here we have the

batch file as well as sorry the bat file

as well as the exe binaries here so if I

click on that uh you can see you have

the source code so you can actually go

through it and compile it yourself if

you're not comfortable uh or if you're

not you know if you don't feel safe uh

you know just download downloading and

executing a binary of the internet so

I'll click on wipes here and uh you can

see there we are that's the source code

there so I'll just take a step back and

if we take a look at the binaries uh we

have the obvious skated releases which

have been obvious skated so if you click

on that you can see that you have the do

obfuscated uh binaries and then you have

your obfuscated uh binaries here so uh

they're sorted based on the target

operating system architecture so you

have 32-bit 64-bit as well as any

architecture which will run on uh pretty

much both 32bit and 64-bit versions of

Windows uh in this case it looks like

it's Windows Server so it's a it's a

64-bit system so we'll be utilizing the

64-bit binary there we are and again you

can just download it onto your Cali

system and then in terms of transferring

it you can transfer it onto the target

system via CT util or through a

interpreter session so um as for the uh

tasks here that's already done so we'll

hit complete

and if we move to the first or the

second task here which essentially

involves generating a reverse shell

executable as our primary access Vector

so uh the technique highlighted here

essentially involves setting up an SMB

server and then transferring it over to

the Target via our our RDP session I I I

pretty much prefer utilizing a u you

know utilizing the web delivery metas

Spate module so that's what I'm going to

be doing although you can also follow

along with the techniques highlighted

here

all right so I'll start up my I'll open

up a new tab here and I'll start up msf

console and what we'll do is we will

essentially generate a partial command

that will then execute on the target

system and that'll provide us with a

interpreter session after which we can

perform the

enumeration uh with win peas all right

so we'll give that a couple of seconds

there all right there we are it looks

like it's starting up msf usually takes

a few seconds there we are I'll search

for the module and of course I covered

how to use it so you should be familiar

with it now um I'll just hit copy and

we'll hit paste and then we want to set

the target as Powershell and we will use

the binary option so uh there we are let

me set that up correctly binary and then

set the payload if we show the options

now uh you can see we still need need to

set up the payload so I'm going to say

Set uh payload and then we can set up

the Powershell payload so I'm going to

say Powershell

so that is not po shell but um we're

going to set the payload to Windows and

then we'll say po shell and we're using

a non-staged module here so Powershell

reverse TCP show the options

again and we're going to set the lhost

option so let me just check out my IP

here so ip config and tunnel zero is the

interface so I'll copy that there so

I'll say set l l host and we'll we'll

leave the L Port as Port 44 44 which is

fine so show options and uh we then need

to set up a few other options one of

them is going to be an advanced option

so show

Advanced there we are and uh the option

we want to disable is the Parell encode

option so let me see if I can find that

here so that's pow shell encoded command

we're going to set that to false so I'm

going to copy that uh sorry let me just

get that done there and we're going to

say set partial encoded command to false

there we go and if we now hit exploit we

should get the PowerAll code that we can

then ex we we can then execute on the

target system so uh I'll give that a

couple of seconds there there we are

it's generated it for us and it starts

up the Handler so uh we'll copy that and

we'll then head over here and we'll open

up a command prompt so I'll give that a

couple of seconds uh because you know

this is a VM after all well not a VM

it's a cloud instance and of course

resources are going to be uh scarce so

I'll just paste that in there and of

course you can get rid of the Hidden

option there so that it executes and

doesn't close up the window if you want

to actually know where there are any

errors I'll just hit enter and that

should open up a pow shell window here

which means that it's executed

successfully there we are and it should

send the

stage there we are delivering the

payload and we'll give that a couple of

seconds there we looks like that is done

delivering payload is done um any errors

there nothing there have we got a

interpreter session probably there we

are power shell session well sorry we

actually need to upgrade the power shell

session into a interpreter session so if

we say sessions you can see we have the

power shell session there so I'm going

to upgrade the command shell or the

power Shell Shell uh into a meterpreter

shell and that's that can be done by

using the sessions U option and the

session we want to upgrade is session

one there we are don't worry if it gives

you the error that this may not be

compatible with this module that's

simply just um a message to to to to

actually inform you to keep you aware of

that so uh there we are sending the

stage and we should get a MPR session on

the target system there we are

meterpreter session two

opened sessions there we are and we get

a 64-bit session so session too let's

perform some basic enumeration so CIS

info uh you know get us ID and then of

course you can pop a native command

shell and then uh essentially you know

perform all of the commands that we had

taken a look at previously in this case

however we're just going to navigate to

the root of the C drive and uh into the

temp directory which is where I want to

save the wipie binary and then I can

upload it so I can say upload and in my

case I've saved the win piece binary on

my desktop under Windows enum and then I

of course I have um winp there we have

there's the folder and then I'm going to

upload uh winp

x64.exe upload that there and they will

give that a couple of seconds to

actually

complete there we are looks like it's

completed and then of course we can pop

a shell here and we're currently within

the temp directory which is great and we

can then execute the wipas executable so

winp x64.exe however before you do that

you can open up the help uh menu right

over here now this is very important

because if you run win pece by default

or just without any arguments or any

other options it's going to go through

all of the uh enumeration right so it's

going to enumerate all of this

information right over here so it's

going to enumerate the domain

information if it's part of a domain

system information User information

process service etc etc so uh if you're

uh specifically looking for a specific

set of information like the user

information I can specify that so I can

say winp uh

x64.exe and then I can

say user information so user info hit

enter that'll only enumerate the user

information here so we'll give that a

couple of seconds there we are let's

take a look at what information this

will give us because this is quite

important so first and foremost you can

see that it'll go through the following

checklist so it'll check if it's part of

a domain getting the user account info

the group list active user list disabled

users admin users and uh files or

directories uh that we can essentially

search so uh check if you have some

admin equivalent equivalent privileges

uh you can see that the current user is

not part of the admin group so we don't

have any elevated privileges uh we have

an admin user that's part of the

administrator group as well as the

administrator account and then of course

we have our current user account the

rest are you guest accounts and the

default account which is disabled uh on

you know modern versions of Windows um

as for the other piece of information

you can see you have your token

privileges here and then of course

logged on users it'll only tell us that

we are currently logged on which is very

important then uh display information

about the uh local users which we've

already gone over but you can get the

user ID to identify whether that user is

administ you know etc etc right um okay

so the users that have logged on to the

system administrator admin user okay so

on and so forth you get the idea now we

can enumerate all the information as I

said previously by simply saying wipas

uh

x64.exe right so I'll hit enter and uh

in this particular context the reason

why I'm using wipas is because wipas

will actually help you identify all of

these privilege escalation vectors

uh and whether or not the system is

vulnerable to any of them right so it'll

tell you whether you have any insecure

service permissions unquoted Service

Parts weak registry permissions uh

insecure Service executables uh Auto

runs uh they always install elevated

vulnerability uh week registry uh

permissions um so on and so forth right

so let's go back here you can see it's

still going through the check and I'm

just going to wait for it to complete

and then I'll take you through it step

by step and that'll pretty much conclude

this video because we'll then move on to

the first privilege escalation Vector so

if we take a look at the results from

the beginning uh most of it is going to

be diagnostic information pertinent to

processes uh that are currently running

the networking uh information like the

interfaces which can be useful if you're

trying to Pivot uh it'll also enumerate

other information that can be quite

useful but again we'll get to that in a

few seconds right so there's quite a lot

of in information here and you can see

we have path injection vulnerabilities

that have been detected um but let's

take a look at the beginning here all

right so there we are that's where it

began so first and foremost you'll get

the system information so the host name

uh the version of Windows the release ID

or the build version of Windows the

architecture the the actual current

version the time zone which can be quite

important as well as the keyboard

language and then whether or not it's a

part of the domain the hot fix is

installed Etc now as for the

vulnerabilities that it identifies with

whats and here these are going to be

vulnerabilities uh pertinent to the

kernel or you know parts of the Windows

operating system that can be exploited

to elevate Privileges and of course

we'll be exploring kernel exploits in

the next video as we progress uh but

this is where you typically find that

information so you get the exploit DB uh

code or reference link if there is a

publicly available exploit and then you

get the reference link which could

contain the exploit code or a proof of

concept all right so uh for the install

updates it'll give you the hot fix ID

when it was installed uh and then of

course the description and the title

which is very important right so uh in

this case you can see that the Microsoft

updates are pertinent to uh one of them

is pertinent to Windows uh antivirus or

Windows Defender and then of course

there's a driver install which is VMware

which tells us that this is indeed a

virtual machine okay the user

environment variables we can which can

be quite uh useful uh and then of course

the system environment variable so you

can see that the temp directory

specified there uh the actual path and

Driver data directories are specified uh

so on and so forth all right let's take

a look at some of the other options here

LSA protection right so this is very

important so if enabled a driver is

needed to read Elsas memory uh so again

it tells us right over here that L LSA

protection is not enabled we'll get to

uh why that is important and then of

course credential guard is not enabled

um we don't have uh it looks like we

have cached creds uh which tells us

right via cached log on count is set to

10 right so uh credentials will be

cashed in the registry and accessible by

the system user so we'll only be able to

access credentials um you know once

we've elevated our privileges no

antivirus was detected so it tells us

that Windows Defender has been disabled

in this case it makes sense because we

were able to execute the poell code

natively without encoding it right uh

user access control status or UA C

status it tells us that any local

account can be used for lateral movement

so we can pretty much Elevate our

privileges directly if we were to try

that right now uh via UAC and I'll cover

that as well um but that's very very

important right because that's one of

the most common Windows privilege

escalation vectors that you typically

utilize is trying to bypass UAC and of

course there's various techniques or

Metasploit modules that can be used to

do that um let's take a look at some of

the other options here that I can

actually go through so let's take a look

at an example check here if we are

trying to look for maybe um let's see uh

insecure service permissions let's see

if we can find information pertinent to

that so again this is just the system uh

configuration there um user information

which we enumerated uh there we are and

then of course the home folders there

RDP

sessions uh the password policy will

tell you the minimum password the

minimum and maximum password Edge the

minimum and maximum password length or

rather the minimum password length which

again can be used to get an idea of uh

you know of the length of the password

if you're performing password cracking

uh the print log on Services interesting

processes right uh so right over here

you can see that it identifies wipas as

an interesting process that we can

essentially perform D hijacking although

in this case that's really not relevant

um let's see if we can find there we are

so Services information uh we're looking

for insecure service permissions there

we are so this is where you'll identify

the weak uh service permission so for

example the file uh the file permission

service which is a vulnerable service

that has been set up to demonstrate this

vulnerability you can see that this

particular service it gives you the

actual path to the exe or the service

the current status is stopped and we can

start or stop it because the file

permissions are set to everyone so any

user on the system can access that

service or interact uh with the service

and we'll ex we'll actually explore that

for unquoted service paths or the Y

there we are that's the vulnerability

there you can see we have the AWS light

agent there so no quotes or spaces

detected there and we can possibly uh

exploit that and of course we have the

actual unquoted Service uh uh the actual

unquoted service here that uh we will be

exploiting so no quotes or spaces

detected all right

so um of course this is um this will

tell you whether you can modify uh any

service or registry and in this case you

can see that we can essentially modify

the registry Service uh which again has

been set up to demonstrate this dll

hijacking that's uh the win piece

directory so that's really not relevant

there unquoted service path so there we

are it identifies that uh as well there

and then of course we have an auto run

program there uh so on and so forth so

you can see already already with win

peas we've been able to identify the

actual services that we can exploit uh

in the case of uh you know the unquoted

service path as well as insecure service

permissions as well as the weak registry

permissions and then of course you can

go through it and uh you know enumerate

as much information as possible uh

regarding the type of privilege

escalation uh Vector you you want to use

right so this this is all path injection

so on and so forth let's uh scroll right

over here so it looks like we have

unquoted um and space detected there

that doesn't look like it's

vulnerable and uh let's just scroll here

there we are we have the scheduled

applications here so this is uh this

will essentially check if you can modify

other users scheduled binaries so uh

there we are it looks like this is uh s

save credentials dobat and uh we can

perform some DL hijacking there although

that's not really important to us uh the

other information here uh that I was

trying to highlight because that's quite

important there we are right so uh right

over here this will look for cus tickets

if you are on a an active directory

environment and uh it'll then tell you

the actual Security package credential

so it's you can see it's telling us that

we're using net ntlm version two so keep

that in mind if you're trying to perform

password cracking now it's already given

us our hash here so we can use these

hashes in different ways and we'll also

be exploring how to perform the past the

hash attack which I've explored

previously uh so you really don't need

to crack credentials unless it's

necessary uh but we get uh you know

passwords or credentials from other

services or applications and in this

case you can see that we get a puty

session and we get the proxy username

and proxy password so we've been able to

gather information there Cloud

credentials nothing there unattended

files we have the unattended XML file

which can possibly contain uh the

Windows administrator credentials if uh

the file has not been uh redacted but in

this case we get the administrator uh it

looks like the password there and this

is of course for the you uh for the

admin user so we can possibly try and

authenticate because we've already got

the credentials uh so let's actually try

that now uh do I need to log out or can

I just switch my current session there

um yeah so I'm just going to sign out of

that um and we'll give that a couple of

seconds there and uh let me see if I can

copy that I'm pretty sure that has been

in base 64 encoded but you can pretty

much log in uh let's see if we can log

in like so

um yeah let's just sign out anyway we'll

I think we might lose

our we might lose our interpreter

session but that's fine uh we can try

the admin or administrator I think

that's the correct user

administrator and we can paste it in

there if this doesn't work then we can

try and base you can try and decode it

so I'll hit

enter um looks like y it looks like

there's an issue with the

authentication um so what we can do is

let's try and base let's try and decode

it so I'm just going to create a file

here called hash and I'll paste in the

hash there and we can then decode it

using the base 64 utility so basic4

decode hash and it looks like the

password is pass password one 12 three

right so uh let's just take a note of

that um there we are and uh we you can

also utilize other tools if you want um

so I'm just going to log in Via RDP

again uh let me just go back in here and

let me just copy the command there and

uh we can then log in as administrator

and let's see whether that actually

works because we pretty much uh have you

know evaded any of this here so 1 2 3

and we'll change that to administrator

but of course we're not going to rely on

this because the unattended file uh I'll

I'll get to that in a second and what

it's used

for um it looks like we have an issue

there um let me just try and add

uh sorry trying it enter was that part

of the password uh yeah so I think what

I'll do we can also try the admin user

uh because it's not specified what user

within the unattended files

uh is uh you know the user account for

this particular password but we can

check it it looks like it's the admin

user so there we are we're able to log

on as the admin user and we should have

elevated our privileges right so again

as I said wipas is an extremely powerful

tool and that's really what I'm trying

to demonstrate here uh this is one of

the vectors that you can utilize and we

pretty much explored it I believe it's

covered uh somewhere here it may have

been covered although I'm not really

sure but there we are you can utilize

that and that's something that I've

covered in my book so you can actually

learn more about that right so uh the

unattended file if you're not familiar

with it is a configuration file that's

created to uh you know it's essentially

created when you're Mass installing uh

Windows systems uh you know uh on a

network so let's say you've been tasked

uh to actually install uh you know

windows on more than five systems uh you

can automate the account creation

process through the unattended uh

configuration file where you can specify

the administrative credentials and any

other you know operating system specific

configurations that you want set up

during the installation process so again

sometimes it's not cleaned up by

administrators so if it's not cleaned up

you can get the admin credentials from

there and you don't have to go through

the process of elevating your privileges

manually and of course Al interpreter

session uh right over there died uh

because we you know we signed out so we

didn't set up persistence so we can just

terminate that there and we list out our

sessions uh I think we've lost all our

sessions do we have um there we are

there we are okay so what we can do is

generate a new um it looks like that job

is still

running uh yeah so job skill and we can

then hit exploit again generate the

power Shell Code execute it with the

admin user and we'll then get a

meterpreter session with administrative

privileges all right so I think I've

covered how to use win peas as I said

you can take a look at the help menu if

you're looking for specific sets of

information uh but I would recommend you

know running it at least um at least

once uh running it by the default

configuration at least once and then

going through all the information step

by step because you really don't want to

miss out anything there all right so now

that we've taken a look at how to

identify these vulnerabilities these

privilege escalation uh vulnerabilities

in the next set of uh set of videos will

be exploring these privilege escalation

attack vectors and taking a look at they

can be exploited in order to elevate our

privileges uh we've already explored one

of them but I didn't want to get into

that but I just wanted to show you how

powerful uh this tool is um all right so

that's going to be it as I said uh the

log for Shell video will be coming out

so stay tuned for that it's going to be

an in-depth video that covers

exploitation as well as patching uh and

yeah we'll be taking a look at that as

well let me know what you guys think in

the comment section if you want to reach

out to me you can do so on our Discord

server uh the link to that is in the

description description section or you

can contact me directly via Twitter and

yeah thank you very much for watching

and I'll be seeing you guys in the next

video a huge thank you to all of our

patreons your support is greatly

appreciated and this is a formal thank

you so thank you Shamir Douglas Ryan car

sandor Michael Busby sidab doozy deim

Bari Dustin umpr and Michael Hubbard

your support is greatly appreciated and

you keep us making even more high

quality content for you guys so thank

you

[Music]