So let's get started with the hands‑on parts of this module.
Let's take a look on how to escalate your privileges
by exploiting vulnerabilities.
When looking for potential services to exploit,
there are a few things to keep in mind.
First,
it is a good idea to take a look in which processes
and services are currently running.
The services that are running as administrator are really good candidates.
The idea here is that if they're already running as a high‑privilege account,
we can try to exploit them to execute code with the same privilege they have.
Also, from a personal experience,
you most likely will find vulnerabilities in services
that are not exposed externally.
Usually,
system administrators are really good at closing all unnecessary ports
in the server so people cannot get inside of it.
But they don't pay too much attention on what is running inside of the server.
Since we already have a low‑privilege account,
we can try to exploit things that are not available externally.
Another thing to keep in mind is that we should be really
careful when exploiting internal vulnerabilities.
Usually, if we are using exploits or payloads,
there is an increased chance of getting detected.
For example,
if to exploit a vulnerability you have to transfer an
executable exploit to the server,
most likely the antivirus solution would attack that.
So try to exploit vulnerabilities that do not require any files on disk.
Awesome.
It's demo time.
In here, you see how to escalate privileges using vulnerabilities in a service,
and this includes finding potential liabilities in our target server,
using the Exploit Suggester to find any potential exploits,
doing the vulnerability exploitation,
anything playing with the Meterpreter GetSystem function,
which tries to automate privilege escalation.
So enough of talking.
Let's go to our virtual machines.
Welcome back to our lab environment.
So let's take a look on how to escalate privileges
using vulnerabilities in the server.
First, I have here my victim machine.
I'm logged as a low‑privilege user called mjackson.
To make things simpler for this demo,
I'll simply use this reverse‑shell executable file to get a Meterpreter shell.
I jointed at this file using this msfvenom command here.
As you can see,
I'm using the x64 payload since my Windows is a Windows 64 machine.
Also,
I'm using the port 443 since I want to make the traffic
look like normal web‑browsing traffic.
So let's go to Metasploit and get a Meterpreter shell.
First,
I'll use the exploit multi/handler to start a listener on
the same port as I have my payload.
In here, I already have all the variables properly configured.
So I can just run this and open the listener.
Perfect.
So let's go to the Windows machine and execute the file.
Awesome.
We got an Meterpreter shell.
So far, nothing new here.
It's basically what we've done in the previous modules.
In here, I have a shell as a low‑privilege user called mjackson.
The first and the easiest way of scaling privileges is
using the Meterpreter getsystem command.
This will try a few privilege escalation techniques, so let's execute it.
Perfect.
Take a look.
It was not successful.
And the reality is this getsystem command tries very basic vulnerabilities.
So unless you have a really vulnerable system, this would not work.
In any case,
it's worth trying it out because it literally takes less than 5 minutes.
Okay, so next, since we didn't get admin level with this automated script,
we can try to find a vulnerability in the server and then
exploit the vulnerability manually.
Metasploit has a really cool feature called Exploit Suggester,
which basically analyzes the system and gives
suggestions of exploits that might work.
So let me background the session using the bg command,
and then let me search for this Exploit Suggester.
Perfect.
Take a look.
It's this one here.
So now let's use this.
And here's a little tip.
Instead of writing the whole exploit path,
you can just use use and then the number of the
search results that you want to use.
In this case, it is zero.
Perfect.
Now let's take a quick look at the parameters that we have to set.
Take a look.
All we need is the session number.
So let's find that out.
I'll use sessions ‑l to list all the sessions in Metasploit.
Here we go.
Take a look.
It's the session number 3.
So let's set the variable SESSION to 3.
Perfect.
Let's have a last check just to make sure everything is correct.
Okay, everything looks fine, so let's execute this.
What Metasploit is doing is analyzing the current operational
system version and then comparing that with all the exploits
that Metasploit has available.
And this might take a few minutes,
so I'll skip this video to when this completed.
Then take a look.
We have here some exploit suggests to us.
And to save us some time, I already tried those exploits,
and none of them worked.
And again,
it's good that we tried those because those are the most likely that would work.
And remember, a pen test is like that.
There is a lot of trial and error until eventually you get something that works.
So since our suggested exploits didn't work,
let's do some manual investigation to see if there's any
software in the computer that could be exploited.
To get a list of all the services that are running this machine,
I'll use this module here called post/windows/gather/enum_services.
Basically, this will list every service running on the computer.
So let's check what parameters we have to set up in here.
Perfect.
The only mandatory parameter is the session one.
So let me set the SESSION as 3.
Perfect.
Now let's run this.
Now what is happening in the background is that Metasploit is querying
the registry files for all the services in the machine.
And take a look.
It found a lot of stuff.
Before recording this demo, I was investigating the server,
and I found some interesting ones here,
like this freeFTPdService here is really well known for
having privilege escalation vulnerabilities.
Also,
this Druva inSync service here is also known for having some vulnerabilities.
So let's see if we can exploit some of them.
So I will search and then druva.
Awesome.
Take a look.
We have this privilege escalation exploit here for the Druva inSync software.
And this is a really good candidate since we have
exactly the same software in the machine.
So let's use it.
Now let's take a quick look on the parameters that we have to set,
and here it looks pretty simple.
It seems that we only have to provide the session
number and the payload we want to use.
Nothing else.
So let me set the session as the number 3,
and let me set the payload as a reverse Meterpreter
shell for our Windows 64 bit.
Perfect.
Now let me quickly set the LHOST variable,
which is the IP of my attacker machine.
In your case, this IP might be different, so make sure you have the right IP.
And that's it.
We are ready to exploit.
So let me clear the screen and quickly check if everything is correct.
Perfect.
It seems that we have everything we need.
So let's run this and cross your fingers.
Perfect.
Take a look.
We got an Meterpreter shell.
So let's check which user we have in here.
Awesome.
There you go.
We've got a system‑level access,
which is the highest level of access we can get on our Windows machine.
Pretty cool, right?
And we can even launch a shell and execute any command here as we want,
which is now being executed as the system user.