Hey everybody welcome to the next video.
We're gonna be talking about privilege escalation but I want to take a step first and explain what that
is.
So privilege escalation is the task of moving from one user account.
Into another whether that's the access or the account itself.
Now this is the next logical step after we've exploded the machine we've done our recon we exploded
the machine we now have access to the machine then we have stabilized our shell we've added our persistence.
Now our next step is to gain as much access as possible.
Now on linux machines that is root and force Windows machine that is administrator or system either
one will work because you can always move from administrator to system without any trouble at all so
perfect escalation is a very big topic in and of itself.
There are a thousand different ways to do the same thing.
So you can go from just a simple mouse configuration to an OS level exploit where diversion itself is
vulnerable to something to a service running as route that was configured weirdly.
Some flaws in how binaries were written for the relative paths.
Is.
There's thousands and thousands of ways to do this.
And the best step is to learn some of the basics such as the OS version.
Is there any common things that you can find right away any OS and application specific misc configurations.
So some of the common stuff for Apache and my sequel etc..
Is there any pseudo permissions what permissions does years or have file permissions as you know ATC
pass WD or.
Yeah as you see past WD rival for whatever reason there's a lot of options that you can go with and
the goal of this is just to get you familiar with different aspects on what we're going to be looking
at most commonly because there is there is a point to where looking for something complicated has its
time.
But if you can look first 10 seconds on the machine you know the OS version that you're looking at and
you know what your pseudo rights are.
Then from that point on you can at least have somewhere to go and there's no point in trying to do it
the hard way if there's a Prevent Escalation exploit available for your version let's say you're on
a Windows XP Service Pack 3 machine.
There's countless exploits that work right off the bat just for that type of machine.
There's no reason to go out and find a mis configured service or even bother wasting the time now from
an attacker's point of view.
You only need one way to gain initial access.
My red team or you might gain access to the machine and think OK that's too easy what other ways can
I do it.
And if that's the case then you're going to want to go in and start looking deeper looking at services.
And it just varies depending on the the assessment and the scope of work and the amount of time that
you have to actually attack the specific machine.
In most engagements you're not going to have a single machine that you attack.
You could have an entire network so gaining root or system on one machine is great.
You use that as a pivot point you find more information through the post exploitation phase you find
out passwords etc. But you don't spend the next two or three days finding different ways to escalate
privileges on the same machine or to attack the same machine.
In most cases.
So keep that in mind.
The KISS method Keep It Simple Stupid.
It's the easiest way you can do it.
Look for your rights.
Look for the OS version.
Look for common processes running as root and see if there's any common issues along with them and then
always check Sudo.
That is a very very big one.
You don't know how many times that you log you get access to an account and you go through the whole
process of finding a privilege escalation exploit.
But realizing that your account has sudo access to all and you can just do as pseudo dash and you're
good you just log into route so always keep that in mind.
Keep in mind also that this particular courses a short description of what common things you're going
to look for right off the bat will have in the future that will be more detailed courses on specific
areas of previous escalation that you can actually look through and finding a new configuration flaws
and everything like that.
But a lot of it just comes with experience.