In this video, you will learn how to perform privilege escalation talks
and also gain a solid understanding on
importance of privilege escalation.
I hope you're excited as me. So let's dive on in.
What exactly is privilege escalation or why
do we even need it to put simply after exploiting a
security flow? I'm gaining either a
reverse or a bind shell you may not
be able to perform administrative actions or task on
the compromise system due to Simply operating
as a low privilege user on a Target
system.
Therefore it's important to understand the need
to escalate your user privileges to high
level privileges on a
Target system such as local administrator a
domain administrator or even
system level access.
Escalating your user privileges on a compromised
system simply allows you to modify. The system's configurations
aren't perform administrative functions
on the victim system.
Penetration testers can also use metsuperter to
easily escalate their user privileges or on
the compromise system and to get started we can simply
gain image to purchase shell on the victim system
as you have seen on the screen.
firstly we can simply use the gapped uid
command like so
And the purpose of this command simply allows us
to verify our current user privileges on the
target system as you can see we are currently operating
as the system user which is
great. But let's see we will not operating as
system. What could we do? Well, we
can simply use the command use proof
like so
and hit enter
this command will simply allow us
to load the privilege extensions if it
is not already loaded Within metuperter.
Next if we will operating with a low privilege user
we can simply type get system like so and
this would escalate our privileges directly to
the highest possible privilege within
the system, which is the system
user.
Are additional method is simply doing something called to
concealing unemploitation with implication
is simply allows a penetration tester to
Simply pretend to be another user
on a system or on the network without knowing
the implicitated users credentials. So
in other words, you don't need to know their username or a
password or even their password hashes for
the account. Let's see margin if a doom in
administrator has locked into a whose system on a
network and let's say this two minute administrator is
performing some type of administrative task. Then the
user me logged off after completing our
task. Well, the thing is once you
use logged in which is let's say Do Me
administrator a toolk on is temporarily created
on the system that was being used by
that particular Doom without administrator. If this
seems to some is compromise by let's say a
painter.
One ethical hacker then the penetration tester will
be able to steal anyone p**** need
the domain administrator stubon simply allowing
the penetration tester to log into any system within
the entire domain as the actual
two mid administrator. So in other words,
we are sealing the token and even please anything the user.
to see a list of let's say
All the users we need to be able to get
a meterpreter shell on the target system. We will
need to load Incognito module like
so we can simply say use Incognito and
press enter. This will
simply allow us to
Impersonate someone else but who could we
personally?
To view the tokens. We can simply type
use Incognito like so to load Incognito
module. Let's type list.
Underscore tokens Dash U
to view a list of possible tokens on
the system.
Currently we can see there's this particular
user token.
This is a valid user on a Target
system, which is administrator. But why does this tool can
exist this took on is simply validating that
hey this uses currently logged in or has when recently
logged in.
Notice that there are two types of tokens. There's a
delegation token, which is simply created on a system
when a user logs in and this 2
can simply provide that user with the necessary privileges to
perform any particular task. The input
Extinction took on is simply categories toon that
simply allows the user to access a remote service.
So currently we have the administrator
account is logged in now if you're not
seeing the administrator account simply log into
metasploitable tree virtual machine and
then perform the list tokens
Dashi U command
to impersonators took on simply copy the two
con information like so
we can type implicit like so on
the score took on followed by the
actual token itself. However, we need
to use.
2 slashes like so
on hit enter.
Currently we can see delegation token is available. We
implementing this user. How do
we know whether we are implicating this user or whether we
are still system.
Well, we can simply type get uid like
so we actually impersonating that Ministry
to account. If you recall a few
minutes ago. We will actually personating this
system user Let's see. We want to review it
back to the system user. You can simply type cat system
like so and press enter.
currently we can see we got a message that says God
system via technique 1
Well, did it work? Let's type get
uid.
And we can see we are now system.
As you can see, it's that simple to use my Jupiter as
create your privileges steel tokens. Impersonate
2 Guns.
In this video you have learned how to perform privilege escalation
using my Twitter and you
have also seen how to identify anyone perform took on
impersonation.
In the next video, we'll be starting section 7.
I hope this section has been informative for
you and I will see you in the next one.