All right, in this demo,
we're going to discover credentials and escalate privileges with Pupy.
To do that,
we're going to dig a little deeper into each of our sessions and see if
we can't use some of the Pupy tools to discover credentials on each
target and escalate our privileges from a user level to an administrator
or system on the Windows target.
Using these tools will allow you to spoof credentials on your
targets or even act as administrator if you did not have access to
the system with that privilege level.
Before we get into running these commands,
we need to create a few users with no admin privileges on our Windows 7 target.
On the Windows target, we'll go to Start,
right‑click Computer, and click Manage.
In this interface, we can add a few users.
For this example, I added Bob, Susan, and testuser.
I set a basic password value just to fill that in for each of them.
They're all the same,
and we'll see how we can tell that from our Pupy server
when we dump the credentials later.
Let's go back to our Pupy server and see if we can dump these credentials.
We'll try to use the IEUser account which has just local administrator
permissions to run a credential dump on the Windows system.
Before we run that,
we need to specify that we want to interact with session
1 by using the command sessions ‑i 1.
Once we we run that command, when we look at our sessions,
we can see that session 2 is grayed out,
indicating that we're not using it.
Now we can try to run the creddump command to get credentials from this machine.
Once this command completes,
we can see that we were able to obtain the usernames
of all accounts on that system, as well as the hashes for their passwords.
We can also determine the identity of the built‑in
administrator account using the relative identifier,
500, which on this machine is still named administrator.
Although it uses a tool other than Pupy,
just for fun,
we could also take these password hashes and use a tool
like hashcat to try to crack them.
Hashcat can take a dictionary file and attempt to match
hashes to words in the file to crack them.
Just to demonstrate the value of the information we obtained,
I'll copy Bob's hash password and place it in a hashcat command and
then run it and see if we can't crack the password.
And we've cracked his password,
although we can see that Bob's password was pretty weak,
and this technique does rely on a dictionary.
If a hacker had a substantial dictionary of possible
passwords and you had any users in your network that happened
to use common passwords like this one, Password1,
or variations of the same,
there's a pretty good chance that somebody who was able to
obtain access could then find additional usernames and
passwords and spoof user actions.
In addition to obtaining credentials, using the built‑in tools,
we can also escalate our privileges to a system level.
To accomplish this, there are two commands that we can try to run.
The first command is beroot.
Beroot will explore potential vulnerabilities that can be
leveraged to obtain higher privileges and test whether the
connected user already has any elevated privileges. Taking a
look at the output from this command, we can see a few different categories,
which show us the startup registry keys, some output from
the task scheduler, a list of interesting files, in this
case, the Unattend.xml file,
which is used to automate the installation of Window 7 and
may contain credentials as a result,
a test of the current account's privileges, and the presence of
well‑known vulnerable surfaces and writeable paths.
We can either exploit these vulnerabilities, or we could use
another built‑in Pupy tool, Get System, to escalate our privileges
to a system level in the local machine.
To run that, we use the command get system,
followed by a ‑m to select the method, in this case, impersonate.
After this tool runs, it opens another session with our server,
which, if we view it in sessions,
we can see here that it has system‑level permissions with our Windows 7 target.
Another method we could use to obtain these permissions or
impersonate other users is to use the Impersonate tool.
To do that, we run the impersonate ‑l command.
This will give us a list of available SIDs to impersonate. At the
bottom, we have a list of our options. To impersonate this system
account, we will need to use impersonate ‑m ‑i followed by the SID
of our system account.
This command will also spawn a new session, again,
with system‑level permissions.
Before we go to the recap,
let's quickly go back to session management. To change our
selection back to all of the sessions, we'd use the sessions
‑i command again, but this time, type 1,2,3, and 4,
which will then give us access to all of our sessions,
which, when we verify with sessions,
we now are running commands on all of our sessions at the same time. We
really don't need two system‑level sessions, so let's kill one of them
using sessions ‑k followed by the number of the session we want to
kill. I'll kill session 4. Careful not to use the uppercase with this
command, in other words,
dash capital K, because it will kill all of your sessions.
Unless, of course, that's what you want to do.
Exploring the sessions command further using sessions ‑h, we
have additional options to drop the connections abruptly. Now
that we understand session management,
let's go over a quick recap of what we covered in this demo.
We covered how to run commands on a single session rather than on
all Pupy sessions and also how to manage interaction with each
session and kill sessions we no longer need.
We used the credential dumping tool to obtain a list of other
users and their hashed passwords and saw an example of use of
another tool to find the password.
We also learned how to use tools within Pupy to find
available paths to escalate privileges,
as well as a tool to obtain system‑level privileges.
In the next demo, we'll be using a few more tools within
Pupy to gather information from our target.