Before we go,
I want to show you one more privilege escalation technique
that we can use on this victim computer.
If you remember from the previous demo, whenever we execute SharpUp tool,
we actually get two different techniques that we could use.
The first one we already explored the previous demo.
Now, let's take a look at the second one.
This one here, Modifiable Registry AutoRun Files,
basically means that it's a file that runs automatically
every time someone logs into the system.
And because it's modifiable, it means that we have permissions to edit the file.
So again, think about that.
We can edit a script that runs every time someone logs on.
Now think, how could you exploit that?
If the script runs every time someone logs on,
it means that the script is executed with the person's privileges.
So, when an admin logs on, the script will execute with admin privileges.
And think about that, if we can edit the script,
we can add malicious code to it.
So, when the admin logs in,
the malicious code will be executed with the admin privileges.
Interesting, right?
So now let's take a look at this modifiable file.
Take a look.
It looks like a pretty simple script.
It cleans up the old backup files every time someone logs on.
And it's a batch script, so it's fairly easy to add this.
So we have two options here.
First, I could create a reverse shell using Metasploit and add the code to here,
and this will work perfectly.
But as we've already done this in a previous demo,
let me show you something different in here.
Instead of using Metasploit, I'll do something a little bit simpler.
I will add two comments to this file.
The first one is to add a new user to the machine,
something like this, net user /add,
then the username that I want to add and the password for the account.
One important thing here is that this password should meet the
password complexity requirements of the domain.
After adding the new user, I will add one more comment in here,
which is to add this user to the administrator groups of this machine.
And this looks like this, net localgroup administrators,
and then the username that I want to add and then /add.
Done.
Those two lines will do everything we need.
They will add a new user and then make this user an admin.
So, we just need to save the script and wait for an admin to log into the system.
As in here we're in a lab environment,
I'll log in to the machine using admin credentials to
simulate a new admin login to the system.
Done.
Take a look.
We are logged in as admin.
And there's nothing suspicious in here, everything seems normal.
So, let me log out and go back to my normal session to this server.
Cool.
So let's take a look if that worked.
I'll use the comment net users to list out the local users in this machine.
Amazing.
Take a look. We have here a new user called hacker, and that's us.
So, let's take a look on what kind of permissions this user has.
Nice. Take a look.
We have admin privileges.
Pretty cool, right? Now,
all we have to do is log into this server using our
new admin user. And there you go.
We are logged in as the hacker,
which is an administrator account. We even have here the Server Manager
dashboard. And one important thing. After you're done with your red team
work, don't forget to remove the malicious code from the original script and
clean any other changes you might have made.