Hey there.
Welcome to the course, Privilege Escalation with SharpUp.
My name is Ricardo, and in here,
you'll learn how to get admin level access to a machine using the SharpUp tool.
So, imagine that you're in a red team engagement.
After exploiting a vulnerability, you got initial access to a server,
and although this is already a really good achievement,
you cannot do much with a low level user account.
To be able to do more advanced things like accessing sensitive data,
you need admin level access to the server,
and that's why you need to know how to escalate privileges.
And in this course,
you'll learn how to find misconfigurations that will allow you
to get admin level access to the server,
so then you pretty much own the machine.
There are dozens of techniques for privilege escalation,
and it would take a lot of time for us to test each technique manually.
For this reason, we have the SharpUp tool,
which automates the testing of several privilege escalation techniques.
The SharpUp tool was developed by Will Schroeder, who is known as @harmj0y.
If you've never heard about @harmj0y before,
I'd definitely recommend you checking out some of his other tools.
He has a lot of interesting publications teaching
exploitation and privilege escalation.
SharpUp is a C# tool that ports several
functionalities from the PowerUp framework.
Basically,
this tool is really useful to discover misconfigurations
that could lead to privilege escalation.
What I love about SharpUp is that it's an open source tool,
meaning that you can download the source code and
customize it for whatever you need.
Also, as I mentioned,
SharpUp is really useful to audit Windows machines to find common
misconfigurations that could lead to privilege escalation.
In reality, this tool has 13 different modules to find common misconfigurations,
including AlwaysInstallElevated, CachedGPPPasswords,
HijackablePaths, RegistryAutoruns, UnquotedServicePath,
and much more.
If you're familiar with the kill chain methodology,
we can use SharpUp during the escalation phase of this process,
meaning that after exploiting a machine,
we can use the SharpUp tool to discover both the vulnerabilities and
misconfigurations that could help us on privilege escalation.
Also, if you're familiar with the MITRE ATT&CK framework,
we can map this course to the privilege escalation phase of this framework.
Inside privilege escalation, we'll be focusing on two main techniques.
The first one is the T1574, which is hijack of execution flows.
In more specifics, we'll be covering the sub‑technique 005,
which is executable installer file permission weakness,
and this means that we'll be able to abuse some permission
misconfigurations to run a malicious installer in the target systems.
And this will give us admin access to the machine.
The second technique that we'll cover is the T1547,
which is boot or logon autorun execution.
In more specifics, we'll be covering the sub‑technique 001,
which is registry run keys and startup folders,
and this means that we will exploit some of the autorun scripts to
execute malicious commands as administrator.
And although those are the two main techniques, as you see in our demos,
we can use SharpUp to test for several other privilege escalation techniques.
If you want to follow our demos in your own environment,
you need two things. First, you need an attacker machine.
And in here, I'm using a Kali Linux version 2021.2 because it comes
with pretty much everything we need for this demo.
But in theory, you can use any Linux or Windows version you want.
Also, you need a victim machine. In here, I'm using a Windows 2016 server,
but, again, it could be any Windows machine you want. And that's it,
that's all you need for this demo.
So, enough of theory,
let's go to our lab environment and see how those attacks are done in real life.