Hey everybody welcome to the next video.
We're gonna be looking at service Miss configurations and windows.
Now we're gonna be using Access check like we've seen in a few other videos.
So what I want to go about doing this is showing you how to actually search for a service mouse configuration
so the mouse configuration we're looking for in this particular case is the ability to modify the service
and because of this we can use this and modify the service point to an executable that we want it to
run.
And then after that we wait for the service to restart or if we have permissions we can restart it ourselves
sometimes we might have configuration permissions but not restart permissions.
So to view this we're going to use access check.
So if you do access check dash you W C Q you star now that's going gonna dump us a lot of info as you
can see here.
So we're gonna pipe this into output gotta go ahead and open that up so we can see here this is the
name of the service and then these are the permissions.
So you know system administrators have read and write so it looks pretty pretty common for the most
part nothing too fancy here going down really don't seem to much here.
So it looks like we missed a character here so let's do dash the.
So this will actually show us all the parameters.
So we'll go back up.
There we go.
So we need this to tell us what service it was.
Don't forget the V.
So if we keep looking here we can see d d com launch administrator have full access then there's power
users have the ability to change configuration and read it.
So that's pretty cool.
We everything looks pretty standard here
so keep going and see what we got here.
Nothing too fancy.
Let's take a look at this one.
So you PMP host which is the Universal Plug and Play looks like SYSTEM HAS ALL ACCESS Ministries of
all access some account has all access.
We're not exactly sure which account this is yet local system or local service has a few things but
we can see here our guest account actually the user logged in as has full access to this.
Now this is for this particular instance as an example however this would be exploit me slash users
if you saw that as well that means all users have access to this which is commonly what you'll see when
you're looking for this vulnerability.
In this case the example I'm showing is as this user just for simplicity's sake.
But keep in mind this would say all users and we can see that we have the service all and because of
that that allows us to work with a few different things.
And what we can do with that is we can actually modify the binary so let's go ahead and create ourselves
a mortar shell just so we can catch it on the back end.
We'll go ahead and run the handler perfect.
So we'll be a python dash simple each server.
Import 80 let's go ahead and open this up and grab that binary
and save that.
Perfect.
So what we'll use is we'll actually use this full path.
Oh sorry not 16.
We'll use this full path here as our binders since we'll just leave the desktop it on the desktop so
to configure the service new SC config in the service name UDP NDP post and then what we're going to
modify so been path is equal to.
And we're gonna go ahead and give it this an exploit and perfectly are able to execute it or change
a service SC QC PMP host.
So we can see we did indeed change a service so let's go ahead and remove a few dependencies and a few
other things like that.
So what we're gonna do is we're gonna set it to a local system but without the password.
So we'll do a c config P NDP host and then Obi J.
Equal to
equal to got Slash local sys and then pass word we're going to set to nothing.
Perfect.
Glenn looked this up one more time so we could see here.
Everything looks good.
We don't see anything relatively out of the way.
Now the last part is we're gonna set the dependencies to nothing so see config PMP host depend
equal to nothing.
And we'll go ahead and do this one more time.
Perfect so we set our dependencies to nothing so we're not going to wait on the service starting so
let's see start PMP.
Oh it's already running so let's do uh stop
and start.
Now if your user doesn't have access to stop and start you just wait for the machine to restart and
then you should have your show.
So if we look here
we do not have our shell yet.
And if we go ahead and start this we see we get our show so let's quickly migrate to another process
doodle do.
Alsace Sasso 6 5 2 before the process dies and we'll go ahead and migrate before the process dies because
right now we're running an exploit.
Here we go and we can see here exploit does no longer exist and it said the services failed so the actual
thread was finished and the process is dead but we still have our full shell access to the machine.
So this is how you abuse a a Windows mis configured aided service.
So always check the permissions on a windows service.
Doesn't matter just run through them all.
Now I have a little bit homework for you guys.
So we use access check to quickly kind of blast through and give us all of our info.
It's just a matter of looking through it at that point.
So what I want you to do is take a moment and try to figure out how to write a batch for loop.
That is a one liner as much as possible that you can run in the command line with a simple copy paste
that will not show you the permissions because that's not presently available on the command line without
some sort of other tool like access check but had it try to actually go and modify the bin path of every
service on the system.
And if you get one that works.
Let the user know with a print statement or an echo statement I tasked you guys with that go ahead and
get that one liner out of the way.
Don't cheat.
There is a there is there is a version of it online already.
Try to build your own.
This is an exercise in learning batch as well so that will also give you more flexibility on the command
line for what what you might want to do.