In this demonstration,
we're going to look at how we can obtain a high integrity agent.
And the reason for this is that some persistence techniques
are available in a non‑elevated agent,
and some are available in an elevated agent.
So, during your red team engagement,
you probably would need to elevate to a high integrity agent if
you would like to perform a certain type of persistent techniques.
Let's take a look at our environment.
In this demonstration,
we will focus on the help desk PC. On the help desk PC, we
already have a C2 channel established.
However, the agent that's reporting in is not a high integrity agent.
So in the demo,
we will leverage that existing agent and establish a high
integrity agent on the same machine.
Let's get started.
Let's take a look at the agents that are currently reporting to Empire.
Right now I have one agent which is active.
I will interact with this agent and view the info to see what type of integrity
level I currently have. From the output of the info command.
I have some information related to the agent. I can see the
name of the agent, the listener that's being used, the
PowerShell version, IP address information,
OS details, and a lot more. With the current agent of an
integrity level of 0, I can perform some attacks.
However,
some attacks require elevated rights. In order to get elevated
rights, we need a high integrity value of 1.
There are a number of modules that we can use that can perform this,
but let's use one within Empire which is called PowerUp.
I will use the module on the PowerUp which is called AllChecks,
and what AllChecks does, it performs various checks to see how
we can obtain a higher privilege.
When I issue the info command, it gives me information about the module.
Since I'm using this module within an active agent,
I don't need to define any options.
The only option that's available is to set the agent name,
but in my case, this is already defined.
I'm going to go ahead and execute this now,
and it will run a task on the agent, and once the task is completed,
it will return back some results.
Now that PowerUp is completed, let's take a look at what it did.
We can see that a job was started,
and within this job it ran the command Invoke‑AllChecks.
What this does is it goes and it checks for various things.
The next step is it started to look at what type of
administrative privileges exist.
So it looked at the user,
and we can see that the user is in the local group that
will grant administrative privileges.
It then returned the type of attack that I can run to elevate my privileges.
In this case,
it's the BypassUAC attack. From there, it continued to do some
additional checks where it looked at service paths, service
permissions, hijackable DLLs, registry keys,
autologon credentials, and a lot more, and eventually it completed.
So now I'm going to use the output from PowerUp to
obtain administrative privileges.
And in this case, it's going to be the BypassUAC attack.
So, I'll exit out of the module,
and I'm going to issue the command bypassuac, and you can see
that now I need to define a listener name. So I will issue
bypassuac again with the listener name.
Next, a new job will be started, and we can see that after a few minutes,
I have a new agent which is reported in. Let's take a look at this agent.
So, I will exit out of my current agent, and I will list my agents.
And now you can see I've got two agents reporting; the
first one which we initially used,
and the new one which was created using the bypassuac attack.
I'm going to interact with this new one, and I will issue the info command.
And now you will notice that I have an integrity level of 1. This
shows that I now have an administrative agent, which was obtainable
by using the PowerUp module within Empire.
My next step would be to rename these agents to
something that's more user‑friendly.
I will also prep the rest of the machines so we can
leverage them in the upcoming demos.