Welcome back to our lab environment.
Now that we have here the SharpUp tool running fine,
we can start to use this tool to escalate our privileges.
To use this tool is really simple.
You just have to type SharpUp.exe audit,
and then the module that you want to use.
For example,
let's see if we can find any CachedGPPPasswords using this module here.
Once I press Enter,
SharpUp will perform several checks to see if any GPPPasswords are in cache.
In my case, I have none, so we should try to run some of the other modules.
To make things easier, we can simply type SharpUp with the audit parameter,
and this will execute all 13 modules for us.
In this way, we don't need to try it module by module.
So, let's run this.
Then, as you can see from the 13 privilege escalation techniques,
we have only two that might work in the server.
And actually, quick pause here,
if you're running these two on a brand‑new virtual
machine with a fully patched Windows,
you most likely will not find any privilege escalation path.
This tool checks for common misconfigurations that
admins implement in real companies.
For this demo,
I made this machine vulnerable on purpose to simulate a real‑world scenario.
For example, see here this Always Install Elevated vulnerability?
This is something really common in companies with bad security practices.
This means that the IT administrator created GPO policy
allowing all installer files to run as admin,
and they do that so their regular users can install software on
their laptop without intervention of the IT team.
And as a really common configuration,
that is a huge security risk because if you are able to
create a fake Windows installer file, it will execute with admin privileges.
So, we can create a Windows installer with a malicious payload
and you it give us admin level execution.
So let me show you how that's done.
I'll go to my Kali Linux machine,
then open the terminal and use the msfvenom to to
create a malicious Windows installer.
If you're not familiar with msfvenom, don't worry, let's
take a look at this command together.
First, I have here the option ‑p specifying that I want my Windows
installer to have a Windows reverse shell payload.
I also have here the flags lhost to define the IP address of my
attacker machine and the lport to define the ports in which will
be listening for the reverse shell.
After that, I have the ‑f flag msi, which will tell msfvenom that I want a
Windows MSI file, and this is a Windows installer file. And after that, I will
output this to a file called shell.msi. And that's it.
Once I run this, msfvenom will create a fake Windows installer
with a reverse shell inside of it, and this reverse shell will
connect back to our attacker machine.
Now, let me set up the listener for this reverse shell. I'll open
Metasploit using the msfconsole command. And in here, I will use
the listener exploit/multi/handler.
Now, I will set the same payload as I use in the msfvenom, and I will also set
the same lhost an lport that we had in the msfvenom command.
Okay, now let me run this. Perfect.
We have a listener ready. Once we have executed the
installer, we will get a session here.
Now, all we have to do is translate this file to the victim computer,
and you can do that in any way you want. In here, I'll simply use a
Python HTTP server to share the file.
I'll use this command here to start the HTTP server.
Then, I'll go to my victim machine and access my attacker machine IP
and port. And from this list, I will download the shell.msi file.
Then, now that we have the installer here,
we just have to run it.
Take a look. It looks like it failed,\ but that's just a decoy.
If we go to our Kali Linux machine,
we can see that we got a new Meterpreter session here.
Pretty cool, right? And the best part is that this session
is running as a system, which is the highest privilege
that we can have in a machine.
We can even start the show and do whatever we want in there.