Let's talk about always install elevated.
Now go ahead and close out of your our desktop if you're in it as the TCM slash Administrative user
and what we're gonna do is we're going to establish another connection again and we're going to log
back in as the user so go to other user what is type in user and password.
3 to 1 Now your desktop should be the same from before.
Hopefully it is we can close out of the CIS internals here.
This auto runs and what I want to talk about really quick is it make sure too that you came in here
and you had completed.
If you're done with the auto runs which you are so on the always install elevated what this does is
there are packages for windows which are called MSA packages and MCI packages are Windows installers.
Now we have this registry feature where we can have these packages automatically install elevated so
they will install.
As an avid user I have seen this in the past during real engagements.
This is very very possible.
This is just a configuration where somebody goes in says Yep let anybody who runs this package go ahead
and install elevated.
So if the value is set to 1 in the registry we're going to go ahead and attack this.
So that's what we're gonna do we're going to make a couple of registry queries really quick.
And let me show you two ways to attack this as well.
So we're going to see the exploitation path that you see here.
We're also going to see a neat exploitation path that is basically an auto win.
So let's take a look at it.
So let's go back to our machine and let's go to a command prompt here which we have and I'm just going
to paste this which we copied and you're going to see the 0 x 1.
This is just the number one.
OK.
So it's saying Hey I always install elevated is on.
That's one means on zero is off.
We're going to go ahead and query the other one here.
Just double check and paste here
and you're going to see that.
It's also a one.
So we are good to go.
We've got always installed elevated turn on.
Now we're going to need to abuse this.
Let's abuse it in a quick way first.
How about that.
Now I told you to leave open your power shall command for your invoke all checks on power up.
Now if we kind of look through this somewhere in here will actually be the always install elevated and
it checked for it.
OK.
And it says hey the abuse function for always install elevated.
Is this right user ad MSCI.
So all we're going to do is we're just going to say right user ad FSI and it's going to do this for
us.
So we're going to go ahead and just let that run it's going to install in power up the folder it's going
to install or set up a MSCI that's malicious.
Now what we're gonna do is we're gonna click on this and let's go ahead and take a look first.
Let's just say net local group administrators and we're going to do a few before and after as you could
see that TCM isn't administrator administrators and administrator and that's it.
So if we go to this power up folder we could see now that the user ad has been put in here so I'm gonna
go ahead and do a user ad double click on that and this is going to run is going to take a second and
it's gonna pop up and is going to ask us Who do we want to add as this user.
OK.
So now we can see we have the user ad feature we can add user name password in the group.
So backdoor password 1 2 3 administrators.
Perfect.
Let's go ahead and create that and now if we run our command again you could see that backdoor has been
added to the administrators why we just installed this package as an admin.
That's what we did as an admin.
We installed this.
So we installed elevated.
Let's take a look at another way to do this.
So if we follow the guide here we're going to run the MSF console.
Now this should already be running from your last one if it's not.
Go ahead and set this back up and then I'm going to copy this here and we're going to change just a
little bit to it.
So go ahead.
You should have this.
Go ahead.
Exit out of your your shell if you're not already exited rerun your your command and it should start
listening on the same IP address.
So now we're gonna do is I'm going to control C here.
I'm going to paste this and change my IP address
to ten eleven forward at 1 14.
And what we're saying is hey the file type.
Now I want to run NSI and the output is going to be setup that MSCI.
And we're gonna get a reverse shell when this executes.
There's a lot of different things that we can do here we can actually run a command that says hey windows
execute add a user and we would add a user we could add ourselves to the the administrators group if
we want but this is just an easy way to get a return pretty Rochelle.
You could do lots of different things there's actually a post registry ad as well if you're interested
in that which I'll show you here in a second once we get the shell.
So now we have this setup the MSCI.
And I'm going to just bring this over to the other machine.
I'm just going to say Python simple HP server and we're going to go ahead and just refresh this page
should bring something up for us hopefully.
There you go.
Click on setup that MSR.
And I'm actually just gonna run it.
We're gonna see if it works for us.
Let's go over here and see if we do catch the shell and it might take just a second here.
There goes.
We caught the shell.
So now if we say get you I.T. you can see that we are authorities system we have completely elevated
this machine.
Now if you are curious and running this from a low level users say you had a mature operator shell you
could also background this and you could say something along the lines of use exploit local
actually sorry use exploit windows local always install elevated and then say options and then you would
just set your session and give it a go and this would automatically elevate as well.
So you got a few options here if you want to elevate your session using this always install elevated
so that is it for this lesson.
Next up we're going to move on and we're going to talk about services but we're going to exploit a service
registry so you go ahead and see how that works in the next video.
And I will catch you over there.