Hello everyone. In this video. We're going to be taking a
look at Windows, 10 privilege escalation. Now, I
already have established a meterpreter session on the target. So
again, I'll just confirm and show you that we are running
Windows 10 and there's a few things to take into
consideration and we're going to go through this step by step.
So first of all, the architecture of the system is 64 bit,
of course, and the meterpreter session
is a 32-bit session. So the first thing we want to
do is we want to migrate on to a more stable.
Process that is of course, a 64-bit process. And
again, we're just going to perform some basic enumeration, first
of all, so if I say get user ID, you can see we
are currently logged on as when the Windows 10 user
and of course, if we get a shell, we can say net
users and that will display all the users on the
system. And by default, we have the administrator guest
account and Windows 10, so, we
want to get again, administrative privileges. So, I'll
just go back into the meterpreter session.
Right over here. And you can see that
I'm currently the downloads folder and I'd use the encoded payload
to get access. So again,
we're going to be using the exploit suggest a module to
suggest some exploits that we can use. But before we do that,
let's try and migrate this into explorer.exe, which
should be a 64-bit process. There. We
are. That's explorer.exe. So, we're going to migrate into process, 41,
68, and all that will give us a 64-bit meterpreter
session. So my great
My great and that was let me just go and check that one
more time just to make sure that is accurate. We
are looking for, explorer.exe, 40, 168.
That's the process ID. So 40
168 hit enter, and
we'll give that a few seconds to migrate. And
there we also see this info. You can see we now have a 64-bit, a
meterpreter session. So we're just going to background this
the version of Windows that we are running is
Windows 10 build.
A 62. So background and
we're going to search for the suggestor. So
search for the suggester and
we're looking for the exploit suggest a tool to use
and we show the options here show show
options and we set the session. So
again, if we list these sessions so we say set session
for right? And we're going to run and
that is going to start collecting the local exploit available.
So again, I'm just going to wait for this to complete and
we can try.
Out the various modules that it suggests for
us and by default, again, we're going to be targeting the
bypass user account user access control modules.
Because these are the ones that
will give us the most, the most success. But
we'll see what are the modules are currently available. So again,
I'll just wait for this to complete. All right, it's
currently loaded the modules and it checked, 17, exploit
checks, and by default. We
can see that we have a bypass user access control.
Roll dotnet profiler so we
can try the first exploit, which again, gives us the
best chance here. So I'll just copy that and we'll
say, use and we'll use that exploit. So
show options, and we're going to set the
session. So set session 24. And
again, The Listener is set on Port
4444 and
finally, start my sessions here.
We want to change that to another Fortune. Has
a set L Port. So L said I'll put one, two, three,
four, and we're just going to run right to
the. We are it looks like we're going to get another meterpreter session
here. And this looks
like it was successful. So bypass you AC can
bypass. This setting continuing this explode requires manual
cleanup of the exploits of this is the dll file
so we can clean that up. This is going to be very important when
especially when we talk about post.
Exploitation because we want to clear our traces
which is what we're going to be taking a look at in the next video. So
we get a session. So we say get uid. We're
still using the Windows 10 user. So
what we can do is let me just say
this info with. This is still a 64-bit meterpreter session.
But if we try and list our processes you
can see that we have administrative privileges. So
again, we need to migrate to a anti-authority session
service or program here.
That's
Running and by default we want to look for win, log
on .exe. That is the most stable. So
when log on .exe, we should use
that process and it should be running as anti-authority.
So I'll just look for that here. It
should be there. We are winning log on and
that is anti-authority. Right? So we're going to say that migrated
to 1820, right? So migrated to 1820 and
I'll do that right now. So my great.
1820. And that's going to migrate to that particular process
and because we have administrative privileges.
If I say get you ID you can see,
we are NT Authority now and we have administrative privileges so I
can run commands like hash dump and that will give
me all the windows Windows 10 hashes that
we can then crack. So again, you can see it's pretty
much the similar process with Windows 10, of course, Windows 10
is much more secure in regards to the other
types of post exploitation commands that you can run.
Namely, you know, taking screenshots of the desktop,
starting the keylogger that will usually cause
the system to crash and restart. So that's not something
you want to do. And of course you can set up assistants
just as simply as we did with Windows 7. And
again, you can have a persistent presence on the
system and you can again escalate your privileges as required.
That being said, that's going to be it for this video
in the next video. We'll be taking a look at how
to clear out tracks using meterpreter.
Ter.