Пост 🤜 Local Privilege Escalation 🤜

🤜 Local Privilege Escalation 🤜 #PostExplotation Part #2 — Local Privilege Escalation The obtained privileges on the target system are directly dependent on the privileges of the program from which Meterpreter was started. This can vary from very limited privileges of a specific user to administrative privileges. If the attacker does not have administrative privileges, they must first be obtained via privilege escalation. The possibilities to gain higher rights on the target system are as many as the possibilities to gain access to a server. They strongly depend on the respective environment and its configuration, so I can only give you good ideas here. As in other areas, carelessness by other users is one of the most common attack vectors. For example, if credentials are stored in a file, they may be used to authenticate elsewhere or to elevate privileges. For example, PowerShell can be used to search local files for certain stimulus words that may reveal interesting information: Get-ChildItem -recurse c: | Select-String "password|passwort|pass|kennwort|secret|@" You can also add some strings by writing your string and using the | as a delimeter. Especially test and backup scripts or backups themselves often contain very valuable information that can help to extend privileges. Another option is to look for points of attack on local software components running with elevated privileges. For standard cases, such as missing patches, scripts such as the Windows Exploit Suggester can be used for support. As input, this uses version numbers that can be read from the Windows command line with the systeminfo command. Based on these versions, the Windows Exploit Suggester searches for possible exploits for this system. However, the output may contain many false positives, as it suggests possible attacks in general, but does not specifically match the patch level. git clone https://github.com/AonCyberLabs/Windows-Exploit-Suggester cd Windows-Exploit-Suggester/ sudo apt-get install python-xlrd python3-xlrd chmod +rwx windows-exploit-suggester.py ./windows-exploit-suggester.py --update set ls ./windows-exploit-suggester.py --database $1 --systeminfo systeminfo-win10.txt systeminfo-win10.txt is the file, where you store the output of the systeminfo command of our session. Two other tools that can be helpful in finding ways to escalate privileges on Windows are PowerUp and Sherlock.ps1. The script Sherlock (https://github.com/rasta-mouse/Sherlock) checks a few selected possibilities for escalation. To run it, simply download and load the PowerShell script and call the Find-AllVulns function. If you want to download it via CMD : curl -LO https://raw.githubusercontent.com/rasta-mouse/Sherlock/master/Sherlock.ps1 Execute in PowerShell : Import-Module .\Sherlock.ps1 Find-AllVulns The functionality of PowerUp is also integrated in PowerShell Empire, which we will look later on. Written by #f4c3r100