Hello everyone. In this video. We're going to be taking a look at
elevating privileges on Windows 7. Now.
I'm just going to be following on. I'm just going to be following
along from the previous video, where we had set up assistance, and
I'm going to be using that exact same
meterpreter session that we are with that. We have now set up
and we should have at all times. So
if I list out the system information here, you can see
that. Indeed. I am logged in on the
Windows 7 VM, and if I say get you,
I d, we are currently logged in as the IEEE
user. However, if we go into my
shell and I say, Nettie users, you can see that
we have, we have the ability to gain administrative access
on the target, which is the NT Authority user. And
that is what we are going to be targeting. So
we we are targeting or we want to get the highest privileges
possible so that we pretty much have total control over
the system. That being said, I'm just going
to exit from this and there we are. We're back.
Into the meterpreter session. When we talk about post exploitation
and privilege escalation. It's
very important. The first
bit of information that's very important is to understand what
operating system you're running. And when
I talk about the operating system, referring to the version, and
the service pack, which are going to be extremely
extremely relevant. Now, the awesome
thing about Metasploit or the Metasploit framework in is
that we have a module, a post exploitation.
Should module that will actually use a
session on the Target that we have an active session and
will actively probe that the
Target and get relevant information from it. Like the operating
system version the service pack version Etc and
is going to suggest various exploits that
we can use to escalate our privileges. So
again with with meterpreter we can use the
the standard get system, get
system option, which again will fail.
Because again, in most cases the get system option
does not work on a newer versions of windows. So
that will not work. And again if we want to
perform any hash dump here, you can see that that is going to fail as
well. So what I'm going to do now is I'm just going to background this,
some you say background, right? And that is
going to background it into Session 1 so sessions right over here
and we have the session running. Excellent. So
we are going to search for a module called suggestor, right?
And there we are. It's the
Option. It's the only suggest a module. As you can see. This
is an exploit suggest and it runs this locally
on the target. So it's very important that you
have an active session on the Target and we're going to require the
session ID. So we're going to say use and we're going to
use this module. So if I show the options now, say
show options, you can see, the
only the only option we need to set is the session ID.
So Vice, if I list out my sessions at
the session ID is 1. So I'm going to say set session.
On 21. Alright, and we're just
going to hit run. All right. So what this is going to do is it's going to it's
going to look at the information from that particular session. And
as you can see, in this case is going to start collecting local
exploits for 32-bit version of Windows. And
of course, it already knows that it's running Windows 7, Service
Pack, 1 and the build number. So it's going to give
us a relevant modules that we can use to try and Elevate
our privileges. So what I'm going to do is I'm just going to wait for
this to complete scanning and giving it.
Then going to give us a list of modules we can use. So
there we are, we can see that. It's
run 34, exploit checks, and it's given us
the various modules that we can use here. Now,
of course, this is going to this is
going to entail a certain amount of trial and error. And
again, you might want to try out all of these ones. But
again, you can perform research regarding the
version of Windows that is running on your Target. And which of these modules
is most likely to give you administrative privileges.
Has in our case, let us test out the first one
right over here, which again uses the bypass user
access control functionality, which is is
quite stable and is also very very successful and
this targets The Event Viewer, so I'm
just going to copy that, right. I'm going to say copy and
we're going to use this module. So I'll say, I'm just going to paste that in there. And
by default it's going to this module
is going to give us another reverse. It's
going to give us another meterpreter session.
Administrative privileges. So you can see
the default payload is set to Windows meterpreter, reverse
TCP, which is perfectly fine. So if I say show
options, it tells us
that for the payload options. We set our host and
our L Port, make sure that your airport that you set is
not in conflict with your listener or
with the original meterpreter session in mind. In
my case. It's not that one is set to listen on Port.
1 2, 3 4. So again
Then I'll leave this as 4444. And again
we can set the session ID to 1. So again, I'll just make
sure I do that one more time. So set session to 1 and
we can hit run. All right, so it's going to start a
reverse, the zpn, Lan Port 4444 and
it looks like we get a meterpreter session, a
new meterpreter session now, so, we're just going to wait for that session
to load up. And by default this, this
particular exploit targets and executes a
payload within the Event Viewer dot, exe file.
I say get use ID, it's still going to tell me that
I'm running as IE user. However, if we take a
look at the processes, you can see we have administrative privileges
primarily because I
can now access all the services that
are running and I can now see the
user that is running them or the user that has executed them.
So the only thing left that we with a
that we should do now is to try and migrate to
a process that has that has
As the administrator that that is started by the administrative user.
So again, I can try and migrate to win, log on
.exe. That is also very stable process
to migrate to. So, the process IDs for
48, so we can try and do that. So I'm going to say my great for
48, I'm going to enter is going to migrate to that particular process.
And there we are. Migration successfully completed
device. A get, uid. It's
going to tell me. I'm now nto Authority and I know I have administrative
privileges and again I can
Of this by saying hash dump. And I hit enter. And
there we are. You can see, I can now dump all the relevant password
hashes, which can then be used for later cracking, but
now, I essentially have total control over the system,
and I've shown you how to perform privilege escalation
manually through a persistent session.
And again, we do not Target. Any particular exploit we've
done this all in we with our, we
followed all the various steps and I've shown you how to set up
a table to Target a particular exploit.
We targeted Eternal blue then showed you how to setup assistance
in order to set up the listener. And then, of course, I've shown you
how to elevate privileges so that we can get administrative access
on the system, which we can now, again, used
to perform we can again execute and wide
variety of commands. In the next video. We'll be
taking a look at Windows 10 privilege escalation, which
again is also going to be very interesting. So I'll be seeing you in
the next video.