Hello and welcome to another
application of the minor attack
framework discussion today
we're looking at our case study on
privilege escalation.
So today's title is
two for the price of one.
So the reason I'm using that two for
the price of one is that
in the month
of July, in twenty nineteen,
there were two privilege escalation
vulnerabilities, zero day, mind
you, vulnerabilities
that were fixed.
And so this is great news
for those of us who are in
the console team and blue
team spectrum.
Bad news for those of us that
are red team are doing things that
are illicit or illegal with respect
to compromising systems.
So in these cases,
CBE twenty nineteen
eleven thirty two and CV
twenty nineteen zero eight
zero win thirty two k
elevation of privilege
vulnerability. So this vulnerability
took advantage of
a component the win thirty two
component that fails to properly
handle objects in memory.
And so if this was exploited it
would allow you to run arbitrary
code, install programs you can
change, delete data, create
new accounts with full user rights.
And so there was a lot
to look forward to if you were able
to take advantage of this.
Now, it did require that you
had to run some specifically crafted
applications that
could exploit this and
you had to make sure that
you would
have a login into the system.
And so in this case, you had to be
local right
now for Microsoft, ESP
while sixty for elevation of
privilege, vulnerability, local
elevation of privilege
and accidentally wrote through that.
But it was local.
All right. And this was working
with the CP while 64 Rexy,
which handles certain calls.
And so an attacker who was able
to exploit this could elevate
privilege on the effected machine
from a low integrity Dimmit
integrity range.
So by itself,
it did not allow arbitrary code
execution. However, it could allow
code to be run if the attacker
used it in combination with another
vulnerability.
So this again
required something very specific,
OK, you had to be local.
So that brings it up to four
two here.
OK, what did they have in common?
You have to be on the system
locally to execute
these privilege escalation type
attacks, at least in these two
cases. Right.
So what can we
do from our
perspective and with the tools that
are available to us to try and
mitigate an attackers capability
with respect to taking advantage
of these privileges or these
vulnerabilities?
So privilege escalation
is all about finding processes
or services or whatever the case
may be that we can take advantage
of because they maybe
were configured for, again,
functionality and not so much
security and use them to our
advantage.
And so there's a tool
that I ended up running on my
local system.
And so I spun out my Calli
Linux instant's and I
got a Web server started.
And at that point I was running
this PowerPoint directory or serving
it up.
And so there's an area in
here called priv
sec.
OK, so improve SEC.
There's this particular set
of scripts
now as you'll see here, we were in
the directory.
So what I did now, I took some
liberties here. Right, because in
this case, I'm not trying to maybe
play the part of the threat actor.
I'm trying to use the tools
that a threat actor might use to
take advantage of my system.
So power shell right
out the gate.
There were some things that I had to
do, OK?
So I had to go in
and I had to change my execution
policy
to an unrestricted state.
Now, in order to do that, I had
to run in an elevated project
because my user account, without
doing so, didn't allow me
to change those permissions.
Now, I could run as administrator,
do things like that with my account,
but in order to change my execution
policy, I had to run it in
an administrative mode.
So that's one way that we could
potentially prevent an attacker
because we talked about power
shell. We talked about not allowing
unrestricted things to be run
in this case.
I'm aware of where this is coming
from and what it's doing.
And as soon as I finished, I
reverted these changes.
Now, I
took this particular directory
and I imported the
particular scripts into
power shell.
And so.
After doing that,
I ran the following commands,
invoke all checks with the
dash, their HTML
report was the output, so
it went through and ran
everything
in that. So there were two things
that I did.
I ran it with the full
administrative privilege
and then I ran it with local or with
just the local account.
And so you might be asking yourself,
that's cool.
So what kind of outputs did we get?
What were the results of that?
So when I ran it as administrator,
it got pretty much
anything you could think of.
And so starting from the top here,
Unquoted Service pazzo identified
a service where we could potentially
abuse or hijack a path
here.
And essentially that would be just
replacing it with maybe the payload
in that instance.
We've got service executable
permissions here.
So it again provides the service
name, the path, the modifiable
file, OK,
the start name
and then the abuse function.
We've got service permissions.
And looking through that and what
could be taken advantage of in these
areas and so this list is huge
as far as what we could take
advantage of and do, because, again,
we've got administrative privilege
here, paths where we could
potentially take advantage of DLO
hijacks registry
auto runs, that we could take
advantage of vulnerable
scheduled tasks that we could
potentially take advantage of.
And so this was a pretty big
list.
But chances are if I've already
got an administrative prompt,
I probably would use some of this
for persistence, but not so much for
privilege escalation.
If our party got that high level
of privilege now as my standard
user, right.
I can I'm in the local
administrative group,
so technically I could right.
Click run as administrator.
Good to go by the bank.
But if I couldn't and I was just a
local user, there might be some
capability and a few of these areas
a lot more limited.
There's no squirreling required
here.
And I could take advantage
of maybe this unquoted service
path or hijacking this deal
or this particular registry
ought to run.
So for me,
my goal as a member
of the blue team and the red
team on some occasions would be
to run something of this
nature on my systems, especially
my critical systems at a minimum,
and determine
what a threat actor might be able
to take advantage of
what I could do to
limit their capabilities or
better protect that system
and where there would be things that
need to continue to run,
identify them, mark
them as being
manipulatable or something
that could be taken advantage
of. And if something happens to that
system, have mechanisms in place
that could identify those particular
areas as being touched.
And at that point, that might
speed up our ability to identify a
threat actor and recover from
that attack. So I encourage you
to look at some tools that are out
there for identifying these types of
potential risks with respect to
privilege, escalation, give
approval and maybe run
a few of them on your systems
or look at your golden images after
getting everything installed that
would be business appropriate
and see if there's anything there
that could be taken advantage of and
what you could potentially do to
reduce your risks.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.