Level Up! - Practical Windows Privilege Escalation
-
Upload
jakx -
Category
Technology
-
view
466 -
download
25
Transcript of Level Up! - Practical Windows Privilege Escalation
Practical Windows Privilege Escalation
Andrew Smith
C:\>type disclaimer.txt
•The opinions expressed in this
presentation are mine and not
those of my employer.
C:\>whoami /all
•Andrew Smith
•@jakx_
•Penetration Tester
•OWASP
•Metasploit
•CTF
•Certs
C:\>whois you
What are you talking about?
•Relevant Windows Security Info
•PrivEsc tricks win7
•Limited user -> Local Admin
Why should I care?
•You wanna level up
•You wanna prevent level up
•Hack the planet!
•You like Mario?
Why should I care?
•"People designing defenses who have
never had them evaluated by a good
attacker is kind of like learning one of
those martial arts that look more like
dancing than fighting. They look nice,
but when you get into a fight your
dance kungfu isn’t going to help you
not get your ass kicked."
-Dan Guido
Windows Access Control
*https://msdn.microsoft.com/en-us/library/windows/desktop/aa379557%28v=vs.85%29.aspx
•Securable Objects
•Files
•Directories
•Services
•Registry Keys
•Named Pipes
Windows Access Control
*https://msdn.microsoft.com/en-us/library/windows/desktop/aa379563%28v=vs.85%29.aspx
•Security Descriptor
•Discretionary Access Control List
(DACL)
•Access Control Entries (ACE)
Windows Access Control
*https://msdn.microsoft.com/en-us/library/windows/desktop/aa379563%28v=vs.85%29.aspx
•Access Token
•Container of user
security info
•SID, groups,
privileges
•Tied to process or
thread
Windows Access Control
Windows Access Control
Access Token
Windows Access Control
Access Token
DACL
Windows Access Control
Access Token
DACL
AccessChk
Mandatory Integrity Control
*https://msdn.microsoft.com/en-us/library/bb625963.aspx
•Security feature post-Vista
•Assigns process Integrity Levels
•Indicates “trustworthiness” of
object
Windows Integrity Levels
*Windows® Internals: Including Windows Server 2008 and Windows Vista, Fifth Edition
Windows Integrity Levels
Low Medium High SYSTEM
*https://msdn.microsoft.com/en-us/library/bb625963.aspx
Windows Integrity Levels
*https://msdn.microsoft.com/en-us/library/bb625963.aspx
Low Medium High SYSTEM
UAC Just ask nicely…
The Setup…
•Land on workstation as SKYNET\Luigi
via $method
•Want to escalate privileges
•Limited User -> Local Admin
•Marketing isnt Admin… right?
Time to Level Up!
•Admin somewhere else?
•Creds in files
•Exploit unpatched EoP bugs
•Exploit insecure configs/apps
•Weak Services DACLs
•Weak File DACLs
•AlwaysInstallEvelated
•DLLs
Somewhere Else?
•Luigi in “Domain Users” group
•1 box “Domain Users” in “Administrators”
Somewhere Else?
•Powerview•https://github.com/PowerShellMafia/PowerSploit/blob/m
aster/Recon/PowerView.ps1
• Find-LocalAdminAccess
Somewhere Else?
Creds in Files
•C:\users\luigi\Desktop\passwords.xls•C:\>dir /b /s web.config
•C:\>dir /b /s unattend.xml
•C:\>dir /b /s sysprep.inf
•C:\>dir /b /s sysprep.xml
•C:\>dir /b /s *pass*
•GPP
•\\mushroomkindgom\SYSVOL\????
Windows EoP Buggzz
•Enumerate missing patches•post/windows/gather/enum_patches
•post/multi/recon/local_exploit_suggester
•Pwn
Windows EoP Buggzz
•MS13-053
Weak Service Permissions
Accesschk.exe –qwcu “Authenticated Users” *
Accesschk.exe –qwcu “Users” *
Accesschk.exe –qwcu “Everyone” *
Weak Service Permissions
•Can we edit the service config?
•Can we edit the binary it points to?
Weak Service Permissions
•Demo
Weak File Permissions
•Look for writeable files
•Autoruns?
•Scheduled Tasks?
Accesschk.exe –qwsu “Authenticated Users” c:\
Accesschk.exe –qwsu “Users” c:\
Accesschk.exe –qwsu “Everyone” c:\
Weak File Permissions
•Story time
Weak File Permissions
•Story time
•Main app binary writeable “users”
Weak File Permissions
•Story time
•Main app binary writeable “users”
•Autorun on login
Weak File Permissions
Weak File Permissions
• “Nah bro, UAC”
Weak File Permissions
• Admin logs in
Weak File Permissions
• Admin logs in
• Backdoored binary auto-executes
Weak File Permissions
• Admin logs in
• Backdoored binary auto-executes
• Code execution at medium IL as admin
(UAC)
Weak File Permissions
•“One important thing to know is that UAC is
not a security boundary.”
*https://blogs.msdn.microsoft.com/e7/2009/02/05/update-on-uac/
AlwaysInstallElevated
•Group policy setting that makes installing
packages (.msi) convenient…
•..Any .msi…
•for everyone..
AlwaysInstallElevated
reg query
HKLM\SOFTWARE\Policies\Microsoft
\Windows\Installer /v
AlwaysInstallElevated
reg query
HKCU\SOFTWARE\Policies\Microsoft
\Windows\Installer /v
AlwaysInstallElevated
AlwaysInstallElevated
•Demo
DLL Hijacking
•Windows can dynamically load DLLs
•If full path not used/missing, Windows
executes DLL Search Order
•Eg.
•LoadLibrary(“ohnoes.dll”)
vs
•LoadLibrary(“c:\program files\ohnoes.dll”)
DLL Hijacking
1. The directory from which the application
loaded.
2. The system directory.
3. The 16-bit system directory.
4. The Windows directory.
5. The current directory.
6. The directories listed in the PATH
environment variable.
*https://msdn.microsoft.com/en-us/library/windows/desktop/ms682586%28v=vs.85%29.aspx
DLL Hijacking
1. The directory from which the application
loaded.
2. The system directory.
3. The 16-bit system directory.
4. The Windows directory.
5. The current directory. (Exploitable)
6. The directories listed in the PATH
environment variable. (Exploitable)
*https://msdn.microsoft.com/en-us/library/windows/desktop/ms682586%28v=vs.85%29.aspx
DLL Hijacking
•Privileged app loads missing DLL +
controllable search path element = pwned
•Use Sysinternals Procmon
•Include “.dll”
•Include “NAME NOT FOUND”
•Include folder in path
DLL Hijacking
•Demo
Conclusions
•Know your network/apps
•Don’t run as admin
•UAC IS NOT A SECURITY BOUNDARY
•Patch your shit
•“Hack yourself first”
Tools
•Powerup•https://github.com/PowerShellMafia/PowerSploit/blob/master/Priv
esc/PowerUp.ps1
•Windows-privesc-check•https://github.com/pentestmonkey/windows-privesc-check
•Sysinternals Suite•https://technet.microsoft.com/en-us/sysinternals/bb545021.aspx
References/Resources
https://www.insomniasec.com/downloads/publications/WindowsPrivEsc.ppt
https://labs.mwrinfosecurity.com/system/assets/760/original/Windows_Services_-_All_roads_lead_to_SYSTEM.pdf
https://technet.microsoft.com/en-us/sysinternals/bb545027
http://www.greyhathacker.net/?p=738
Greyhat Hacking 4th edition
Windows Internals 6th edition
https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerUp
http://www.slideshare.net/mubix/windows-attacks-at-is-the-new-black-26665607