So after performing reconnaissance,
we need to take our pen test to the next level.
And to do that,
we need to look at how we can elevate our privileges so that
we can ultimately obtain a system shell,
or a system agent rather, on the target machine.
By doing this,
we can then go ahead and dump credentials and then look at how we can move
laterally across the environment to exfiltrate data.
I'm going to be interacting with the agent that we already
have established with the target machine.
The first step that I'm going to take is leverage a
PowerUp module to look for what type of privilege
escalation options exist on this endpoint.
PowerUp provides a number of different modules.
I'm going to start with the allchecks module,
and this will actually go and run a number of different checks to see
what type of privilege escalation options exist.
Within the Optional Fields, I'm going to leave the default,
and I'm going to go ahead and submit the task.
Once the task has been submitted,
it may take a minute or so for the results to get back because remember that
this is actually running a number of checks via PowerShell.
Navigating to the TASKS tab, I can see the task that I've just submitted,
and I've got the results that have been returned.
So we see that the first batch of checks that PowerUp performed is to check if
the specific user is part of the local administrators group.
In our case,
the user that currently is logged in is part of the local administrators group.
So here we already have an easy way to escalate our privileges,
and PowerUp goes ahead and actually provides the attack that I
need to run to elevate my privileges.
In this case,
I can make use of the BypassUAC attack to go and elevate my privileges.
Now off the bat,
I could stop right here and already go and elevate my privileges,
but let's look at the rest of the output and see what other options exist.
So as PowerUp progressed through the different checks,
it looked for unquoted service paths, which in this case,
it found none.
However, looking at the executable services,
there are a number of different services that we can
leverage to actually elevate our privileges.
For example, looking at the AbuseFunction for these different services,
I could leverage the Install‑ServiceBinary option within PowerUp
calling the specific service name and then appending that command
with a command that I would like to execute.
For example, if I wanted to make use of the ClickToRunSvc,
I could send a command that looks like this via Empire using
the PowerUp module to actually go and create an additional
user on the targeted system.
I can, of course,
append this further and make sure that the user is part of the
local administrators group and so forth.
So this endpoint actually had quite a number of services that are vulnerable.
What's interesting to note is that these are all default services on Windows.
So moving swiftly along, it went and looked at any type of service permissions,
which there wasn't anything that was found,
but when it went and looked at any DLL locations where
we could potentially hijack a DLL, it did find one.
Again, this is part of the default Windows apps,
but that specific DLL location we could use.
So I could go and create a DLL,
upload it to that specific path, and then use the AbuseFunction,
which is Write‑HijackDll,
calling my malicious DLL to go and perform a specific function.
The rest of the options returned no results back.
But this gives you an idea of what the module looks for.
So now let's go ahead and actually perform one of these attacks so that
we can elevate our privileges and steal credentials.