Welcome back.
Time to see how we can try to elevate our privileges on the target machine.
But before we do that, I just want to play you this recording that we recorded from the previous video
using my interpreter and the record, my comment, just to see that we indeed managed to record the
sound on the target machine.
So if I played.
This will start recording and it should capture what I'm speaking at the moment.
To the microphone.
You can see it did manage to record it.
Now, it is not that high quality of a sound, but nonetheless, we can hear what the target spoke on
the microphone.
Nonetheless, let's get back to the Privileges and Privileges Commission is a big topic and a more advanced
topic.
There are many advanced techniques that can be used to try to elevate privileges.
However, we're going to be covering the scripts we can use to automate those processes, all of those
scripts we have available inside the government framework.
Now, usually we don't know whether we can elevate privileges or not.
Throughout the years, there have been many experts that got patched for the privilege escalation.
However, maybe our target skipped some patch and is vulnerable to one of them.
So what we are left is just to try all of those scripts out and see if some of them works.
What we can do to search for the privilege escalation experts is we first background this session that
we got with our Winterstein machine and we can type search, bypass UAC.
What does this mean?
Well, you see is user account control and these exploits that we will find are used to bypass it,
which could allow us to elevate our program privileges to the system level.
Another thing I like to search is type search.
And then the year that we are currently in, since we are at the end of 2020, we can type 20, 20 or
search 2020.
And this will list out all the modules that came out this year.
Inside of these modules, we will have everything.
So what we want to search and filter out is windows experts and preferably local Windows exploits,
as we can see right here.
What does local mean?
It means it's getting executed on the system itself.
Usually these type of local exploits try to elevate privileges.
For example, here we can see a few of them, such as Exploit Local and then this name up here.
We got another local expert and many more are right here.
And we can also see the SMB ghost exploit.
Now, I know what you're thinking.
I did say that matters.
Split Framework doesn't have some big ghost module.
Well, that wasn't true.
However, this module is a local exploit and it's only useful after you're already on the target machine.
As we can see, it is exposed for Windows, but it is also a local exploit.
The one that we covered is the same vulnerability inside the survivors, and we just we exploited it
remotely from another computer to gain a shell.
But let's test it out just to see whether we managed to elevate our privileges using this exploit.
So to use it, we can type, use and paste the exploit.
Just make sure that you got the active session with the target machine.
As you can see right here, I got Section one active on the user account of the Winterstein machine.
If I type show info for this exploit, we can read that this is a vulnerability that exists within the
Microsoft server message block three point one point one protocol that can be leveraged to execute code
on a vulnerable server.
So we can see the targets right here.
And all we need to set is the session ID to do that.
We can type the sessions command, check out the session ID that we got and type set session and then
one if I type run to execute this local exploit.
Well, it seems that he did something, but we didn't get a shell back, so we can assume it doesn't
work.
Let's try another one.
If I type search 20, 20, and for example, let's say I'm going to use this one, which is exploit
Windows Local CVG 2020 service tracing.
And the reason why I'm using this one is because down here it says privilege, elevation, vulnerability.
So this can be used to elevate privileges in case our target machine is vulnerable.
Let's check it out, press enter type show info just to check out what this model does.
And this module leverages a trusted file, overwrite with a dual hijacking vulnerability to gain system
level access on vulnerable Windows 10.
Sixty four bit targets.
So our targets do match and we do want to gain system level access.
So let see whether this will work.
There is only one thing that we must set and that is required and that option is session.
So let's typeset session and then one press enter and run the exploit, fail to validate all hosts.
So let this type show options just to see which BAYLOCK we got.
And we need to set our host to be wanted to two of the 168 at twelve, which is the IP address of my
Linux machine.
Now also make sure that the airport is different than the port that you got active inside of a session.
Since I got Port five five five five active in the current session, I can specify right here four four
four four.
But if your interpreter session is running on port four four four four, you need to specify a different
local port.
Otherwise none of these experts will work so I can leave it on for four, four, four and type frunk.
And it seems that this one doesn't work either.
Let's try from the UAC bypass exploits, soil type search to bypass, see and hear, obviously all of
the exploits for user account control bypass.
Now, you can go ahead and try all of these local windows, bypass US experts to see which ones work.
Just make sure you read information about them first before running them.
But what I'm going to use in this case is this Ford Helper bypass USSI.
It is from two thousand and seventeen, and it showed to work a lot of times in my personal experience.
So we'll copy the name.
Type use, and then I will paste the name right here, press enter.
It configured the payload and let's give it a try, if I type show information just to see what it does,
it will tell me this module will bypass Windows 10 user account control by hijacking a special key in
the registry under the current user hype and inserting a custom command that will get invoked when the
Windows Phone, the XY application is launched, it will spawn our second shell that has the U.S. flag
turned off.
So let's see what are our options that we must set and we need to set this session.
In my case, it session one and I can use the local port for four, four four.
And if I type run, here it is.
We got another session open.
We got the matter better opened.
And this is a different session.
As you can see, it is running on port four four four four.
So we got a shellback with this local expert.
But if we try to run the command, get user ID, it will say that we are still the same account that
we were before.
But remember, it set in the module description that this exploit will spawn a second shell with the
user account control flag turned off.
What does this mean?
Well, it means that if we try once again to run the command get system that didn't work before.
Now we are the system account.
We did it right now.
We can say we fully owned this Windows 10 target machine since there is nothing that we can do on it
right now.
And just to prove to you, I will type get user I.D. once again and it will tell me that I am authority
system account.
So feel free to test out other modules to see if they work or not.
And you can also try these modules on our Windows seven virtual machine just to see how that would go.
Great.
Now that we elevated our privileges, let us check out other post exploitation modules that we can also
run.
See you in the next video.