So far, we looked at a variety of methods we can use to get
access to the machine by leveraging the client.
We're not too choosy when it comes to which method because as
long as we had access into the environment,
that is our initial foothold.
So what level is that foothold is what has to be considered.
Because if we don't have a strong enough access,
where do we go from here?
We have to have the initial access, right? It's required.
Once we have that requirement, we're ready to roll.
Well, not so fast.
Any access is good; don't get me wrong.
What privilege level is that access is our biggest concern.
How do we start?
What do we attack?
A good place to start are the applications installed on the machine.
That's the benefit of having the client‑side access, because now we have
the capability. Analyze the machine's software,
applications, and configurations, and then see what else we can do.
But we have a big challenge, especially today.
What are we up against?
It's well known that the defenses at the endpoint of the
system have improved, so what can we do?
The reality is we're at the mercy of what is there,
but we've got to identify and know what is there and then decide.
So that's our main goal. Evaluate the protections that are in
place, and based on our previous research,
find a weakness and get a higher level of access.
We call this privilege escalation.
And what that is, is we want a higher level of access than we currently have.
So what do we need?
The first thing we need is to determine the brain, and in cybersecurity,
the brain of the operating system is the kernel. The way
Metasploit, virtually all exploits work, is take control of
program execution, and this requires specific and very accurate
data, so we have to know the kernel level.
And remember, the kernel level is the brain of the
operating system. And in Windows,
we need to know this kernel level with respect to the NT kernel.
Yes, no matter how many versions of Windows we see,
they're all based on the old Windows NT kernel. And to go
into that is a bit beyond our scope, but that's just one
piece of this complex puzzle.
These exploits are so granular, we have to identify not only the kernel,
but also the patch level and the installed patches.
Now in Linux, when we output the kernel level,
we can usually see the patch level as well in that same string
of output. With Windows, it's not that easy.
We have to either determine the installed service pack or, in many cases,
the installed version of the patches on the system.
Once we've done this,
it can assist us with our privilege escalation. But once again,
like everything else, especially with exploitation,
there's no guarantee it will work.
We are ready for our next demo. In this demonstration,
we will review the local attacks and what can be done there.
And this is why we have to determine if it's a version of Windows,
what the version of Windows is to the service pack or even the
patch level. And if it's a Linux or a UNIX target,
we have to determine it to the kernel and the
revision build and level of the kernel.
So there are all different things we have to do when we're
doing our local attacks and trying to improve our privileges
and perform privilege escalation,
which is what we're going to do in this demonstration. Enjoy the demo.