[Autogenerated] in this video,
we're going to start looking at how we can use wind peas to discover any type of
privilege escalation parts in Windows on my target machine.
I am currently logged in as a low privileged user.
I'm gonna go ahead and confirm this by trying to run command
prompt in administrator mode and right away you'll see that I
am prompted for admin credentials.
So now let's go ahead and use WinPE S and we are specifically looking
for any type of services that utilize a DLL allowing us to hijack that
DLL and gain administrative privileges.
So the first thing I'm gonna do is take a look at wind peas
when I look at the help function of wind peas,
you'll see that it's got a lot of different checks
similar to what we've seen with Lynn pease.
So what I'm gonna do now is just go ahead and run wind
peas without any additional parameters.
This is gonna go and perform all of the checks and
then pipe the output back to me.
So let's give this a minute to complete and then we
will take a look at the results.
So now that we have the results, let's take a look at the output.
I'm going to go ahead and start from the top and immediately we'll see the
awesome colors and again a legend of what each of the colors represent and
then along with some information about the system,
various updates the user environment and so forth.
So now let's go and look at the services information because we
are looking for any type of service that may be running that
leverages a DLL file and more specifically,
we are looking for a service that we can actually
modify using our low privileged account.
Alright, so as I go ahead and find the services information,
you'll see that we've got a number of services currently running.
One service that kind of stands out is the DLL S V C,
which is the DLL hijack service.
This specific service uses a X E file,
but let's go ahead and look at that E X E file and see what it
actually loads because generally E X files would be calling a DLL now
in order to go and actually look at the file,
you can perform like some type of reverse analysis of the file itself.
You could copy that file to your Kali Linux machine or another
Windows machine that you already have admin rights on and open it
up with Process monitor as an example.
So I already have another Windows machine and I'm gonna
go ahead and switch to that machine.
Alright, so looking at my current machine,
I have now loaded that DLL service dot e X E file and
using Sysinternals process monitor.
I'm taking a look at any result that relates to name, not found.
Now this is going to give me any type of file that this
specific e x C is trying to load, which does not exist.
You'll notice that something stands out and this is the hijack me dot Dll file.
There are a number of different locations where the C x C
is searching for that specific DLL.
One such location is the temp location,
which is generally a location that we would have access to.
These are called world writeable folders.
So let's go ahead and switch back to our target machine and
see if we've got access to that folder.
All right.
And I've switched back to my target machine and I know
I've got access to the temp folder because I was able to
copy wind piece to the folder.
What I have also done is I have leveraged MSF venom to create a standard
DLL which will actually go ahead and execute a command that would add my
current local user to the administrators group.
So what I'm gonna do now is go ahead and stop that vulnerable service.
Next I'm gonna go ahead and copy the DLL file to the stem folder.
I'm then going to go ahead and verify that my account is
not part of the administrators group.
Alright, so let's go ahead and start the service.
Now as I start the service,
I should now be added to the administrators group
because of the malicious DLL file.
So let's go ahead and now query the local administrators group and sure enough,
I have my user account added to the group.
So this was another way that you could use wind peas to
specifically escalate your privileges by looking at any type
of DLL s that could be hijacked.