[Autogenerated] in this demonstration,
we're going to look at how we can use wind peas to identify registry
keys that will allow us to escalate our privileges,
I'm currently logged in as a standard user and I have already
downloaded WinPE along with my reverse shell,
my reverse shell has been set up with MSF venom.
Now, generally when you look at privilege escalation parts,
a good place to look would be the registry within the Windows registry.
There are various types of registry keys that allow you to
go ahead and escalate your privileges.
For example,
if I go ahead and look at this specific registry key
which relates to the Windows installer,
allowing it the privilege to always install an
application in an elevated permission.
Now of course the specific target is purposefully vulnerable.
So in this case the specific registry key is set to
one which means that it's enabled.
Now,
what if you wanted to go in search for more registry key is in a very quick way.
Well this is where WinPE is can come into play because over and
above which is searching for the registry keys of course it
performs a lot more checks allowing you to view various other
privileged escalation parts.
Now,
as I take a look at the different checks that when peers is able to
execute because we are looking for registry keys,
these would be found within the Windows creates component.
So what I'm gonna do instead of executing the entire suite of checks,
I'm going to just specify the Windows creds and as I hit
enter wind peas will go ahead and run.
Now of course I could have also piped all of the output to a
text file but for the sake of the demonstration let's keep
all of the output on the screen.
So as we work through the results,
let's take a look at what wind peas actually went and checked again.
We are presented with the awesome colors.
But as we look through the different Windows credentials we can see that
Wind peas has already discovered some stored credentials.
This one here is pretty interesting because this is a local
admin account which has a stored credential so immediately I
could use that to escalate my privilege.
For example using something like rain is with the safe cred either.
Let's not focus on this Super easy, low hanging fruit.
Let's look at the Windows registry.
So as I work through the rest of findings we can see that there
are some additional credential files but then wind piece goes
and looks for other credentials.
For example,
if there are any credentials stored in remote desktop connection manager,
any type of Kerberos, tickets saved, Wi-Fi profiles and so forth.
The one that I want to focus on specifically is this one
which is always installed elevated.
Now what's great about wind piece?
It actually gives you a link allowing you to read up about the specific
finding and how you can use it to escalate your privileges.
Let's take a look at how we can use this miss
configured registry key to our advantage.
The first thing that I'm gonna do is generate a malicious M.
S.
I.
executable this can be done with MSF venom or any other tool that you choose.
In my case I have just generated a simple reverse shell using
MSF venom and I have already copied it to the target machine and
you can see the file listed here.
Now let's go ahead and test if we are able to
establish a reverse shell as system.
Currently I am logged in as a standard user and I'm gonna go ahead and
quickly start up my listener on my Kali Linux machine.
I'm gonna go ahead and use nat cat and a simple listener listening
on port 53 as I switch back to my target machine.
I'm going to go ahead now and use the Microsoft installer and within the
Microsoft installer I'm going to give it some additional switches such
as running in quiet mode as I hit enter.
Of course nothing happens because this specific M.
S.
I.
File does not install anything.
But now let's take a look at my listener to see if we have
received a connection as I switch to my listener.
I have established a connection.
When I take a look at who am I?
I am currently logged in as system.
This means that because of that.
misconfigurations streaky it ultimately allowed any installer to install an M.
S.
I.
File as system in this case using Wind P.
S,
I was able to quickly and easily identify the specific registry key
and get some additional information on how to use this finding to
go ahead and execute a malicious M.
S.
I file so that I could escalate my privileges.