Hey there.
Welcome back to our Meterpreter course.
In this module,
you'll learn how to escalate your privileges using the
Meterpreter tool. This module is all about getting admin‑level
access to our target machine. Our goal here is to go from a
regular user account to an admin account,
which is usually the end goal of a penetration test.
And the good news is with Meterpreter, privilege
escalation is way easier and faster.
We can quickly test internal vulnerabilities and quickly find
misconfigurations that could lead to privilege escalation.
So stay tuned.
I'm sure you'll be surprised on how Meterpreter can be helpful for
you. In this module, we'll continue our Globomantics scenario that
we started previously. In the previous module, we got a Meterpreter
shell to our victim computer.
So now our objective is to get an admin‑level shell to a target computer,
and we accomplish that in two ways.
First,
we will try to exploit vulnerabilities in the software
that is installed in the server.
Also,
we'll try to escalate their privileges by finding and
exploiting misconfigured services.
As you've seen in the demos of this module,
Meterpreter helps us a lot in this process.
So let's take a quick look on what we'll be learning in
this module. First, we will discuss what are the main
techniques for privilege escalation.
You see that we can accomplish that in several ways,
and Meterpreter can help us a lot here.
Then, in our first demo,
you see how to find and exploit vulnerabilities in the
internal software of our target computer.
Then, in our second demo,
you'll learn how to find and exploit misconfigured services. And last,
as a bonus content,
you'll learn how to gather password hashes from your target
machine so then you can try to brute force them offline and
access other accounts in the server.
As I mentioned before, there are several ways of escalating privilege.
Actually, each year,
security researchers find dozens of new ways of escalating
privileges. And the reality is we would need several courses to
cover every single method for privilege escalation.
So in here in this course,
we're focusing on the two most common ways of getting admin‑level access.
The first one is by exploiting internal vulnerabilities,
and this means finding which software is installed on the
machine and then trying to find vulnerabilities in the software
that could lead to privilege escalation.
For example, if the server has a really old Microsoft SQL Server installed,
some old versions of Microsoft SQL are famous for having code
execution vulnerabilities. So we can insert malicious code in
there, and then we will run as administrator.
The second most common way of getting admin access is
by exploiting misconfigurations.
In this case, we're not looking for vulnerable software,
but actually we're looking for mistakes that administrators made when
they were configuring the software. For example,
let's say the administrator set up a script to run every hour,
and the script runs with admin privileges.
But the same script can be edited by anyone with access to the computer.
So what we can do is add it to the script and add malicious code in there.
So then, next time it's executed, our malicious code is also executed.
Pretty cool, right?
But again,
those are the ones that we'll be covering here in the course. There
are tons of other ways of escalating privileges,
like you can try to find files on the computer that
have credentials saved in plaintext,
or you can even try to phish the administrator to get their password.