We are ready for our next demo.
In this demonstration, we'll look at the method of gaining an elevated access,
in other words, a privileged escalation from our current user access.
In many cases,
the user we trick into clicking will only have a normal user privilege,
so we'll have to explore the different levels and try to see what
we can do to escalate our current privileges.
This process starts once we gain access.
So we have our payload from previous exercises,
and that's what we'll use to get that first initial access.
As a review, remember, we just have to double‑click the file,
and we should get our shell, unless Windows Defender is not disabled.
So we've got to make sure we disable Windows Defender so we don't get detected,
both real‑time protection and the cloud‑based sample submission as well.
So when we get into our exploit multi/handler,
that's how we're going to handle the connection coming back to us,
you see here we have our payload options,
and we have set it at windows/meterpreter/reverse_tcp,
so that's good.
And then we have our options that are required,
and they are there, so everything is ready to go.
So all we do is we do exploit.
So we'll clear the screen so we get up to the top.
We run exploit, and it generates that handler,
and that handler is on the port four fours.
And now all we do is go over here to our Windows 10 machine, we double‑click.
We go back to our Meterpreter shell, and there it is.
Now we've got the Meterpreter shell open, right?
So these are the types of things we want to do.
Now one thing we want to make a note of here is the session number.
So since we have the session number, we know what we got.
Now, the quickest way to do privilege escalation is getsystem.
But, unfortunately, as you see here, it doesn't work.
And this is as you go through the process,
you have to go through different types of methods to try to
figure out what works and doesn't work.
So the next thing you want to do is background the session,
so we background the session here.
Sessions ‑l shows us it's still there.
So now we're going to do the clear screen again,
and we're going to search,
and we're going to search for privilege of privilege escalation.
As you see, there are a lot of these.
So, we can interact with the module by putting in info and the number of
the actual module we want to look at and stuff like that,
or maybe there's a better way, and there is a better way.
And that better way is suggester.
So we're going to actually search for suggester.
And you see we have one exploit there called
post/multi/recon/local_exploit_suggester.
So now we're just going to do use 0, which is a nice shortcut we have now.
Remember, you always want to read.
So you go into info, and once you read info,
you see everything that's there, and we have to set the session.
So then it does suggest based on the architecture and the platform what
we potentially can use to escalate our privileges.
So before we do that,
let's clear our screen to get to the top and look at our sessions.
Now when you first start this, your session ID is probably going to be 1.
We've been doing this for a few demonstrations.
So as you see here, our session ID is 3.
It's not hard.
We just do set SESSION 3.
Alright, now if we show our options,
we see we've got the current settings we need,
and then we just write exploit.
And when we run exploit,
we're collecting the local exploits for the x86 windows
that's in our current shell session, session number 3,
and we just wait for it to come back and tell us what
exploits it finds on the machine.
And you see all the different ones that stay,
and 38 exploit checks are being tried,
and these are the ones it's actually showing as potentially vulnerable.
Now in a perfect world, we'd try one, and it will work.
But remember, there's no perfect exploitation.
So we'll start with the first one, the eventvwr.
Now the one downside of this one, it's going to open the eventvwr.
But for our demonstration here, we're just trying to demonstrate the concept.
Now as always, we do info,
and we see bypass Windows user account control by hijacking a special key.
Sounds interesting.
We need the session, so we've got to do our session.
So let's do our sessions and make sure we have the right
number because if we get the wrong number,
then it's not going to work for sure.
We see we're in SESSION 3.
So we'll clear our screen.
We'll set SESSION 3.
As we see here, it's executing, but is it going to pass or not?
Blue and green's all good, so as long as we see that, we're okay.
So we're just waiting here to see if it's going to complete,
and it completed, but did we get a session? No.
We see exploit completed, but no session was created.
Hate to see that, but it does happen.
So now if we do a clear up here, and we do a search to go back to our suggester,
and then we use 0, so now we're going back into our suggester,
and we're going to run it again.
Let's make sure our options are still set,
and they are, and then we just do exploit.
Because remember, if the first one doesn't work, we can try the second one.
Now one of the things we can do is we can set the show description.
And when we set the show description, it can help.
So we're going to run it again here and set the actual show description.
So once it finishes running here,
we will actually get the actual show description.
So let's do this again, but first, let's show description.
We're going to see if we can maybe do a little bit better analysis and
find an exploit that matches our victim machine,
in this case, Windows 10 machines.
And now we just do the exploit,
and you'll notice this time it's going to go and show
the different descriptions because, remember,
some of these exploits are for Windows 8 and those types of things,
and Windows 10 looks kind of like Windows 8 in some aspects,
so sometimes that will fail as well.
So, as you see here, as we start looking through the DLLs and reading,
now we've got a description.
So when we look here at the Vista through Windows 8,
so we've got the IKEEXT, that only works on Vista through Windows 8.
So without the description, we would've wasted our time,
but look at this one down here at the bottom.
The very bottom one says Windows 7 through Windows 10 1803 are affected.
That's what we want.
We have a Windows 10.
Now we don't know if it's build 1803 because we
didn't really look at it that close, but it is a Windows 10.
So now,
let's highlight this exploit and see if tokenmagic,
the name of it's tokenmagic here.
So we copy it, clear the screen so we get at at the top,
use it, as always, info.
We read the info.
There's a lot of different things,
but it looks like the only requireable thing that we
don't have set is the session.
You see it leverages a UAC bypass using TokenMagic to
spawn a process and do DLL hijacking.
And DLL hijacking is one of the more modern day attacks,
so it looks pretty good so far.
So let's go ahead and set our SESSION to 3,
and let's go ahead and clear our screen so we're up at the top,
and let's run our exploit.
And so now we've got to set LHOST, and now we do it again.
There it goes, executing the script, and look at that,
Meterpreter session 4 open.
We have now successfully privilege escalated and done privilege escalation.
So to see that, we just go sessions ‑l.
We Ctrl+Z background the session and now do sessions ‑l
now from within the Meterpreter shell.
And you see there, what do we have?
We have our session ID 3, which is our Meterpreter,
but look at number 4, NT AUTHORITY\SYSTEM.
So we have successfully escalated our privileges using
the windows/local/tokenmagic module.
And that was the whole goal as we went through this exercise in
this demonstration was to find a way that we could escalate our
privileges to NT AUTHORITY\SYSTEM, and we have done that.
With this, we'll conclude the demonstration, here.