Trevor Nugent SEC - 335 Windows Privilege Escalation

Submission Set One

Download and run WinPEAS

Screenshot of WinPEAS banner:

Screenshot of output:

Commands used:
Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy Bypass -Force
mkdir WinPEAS
Add-MpPreference -ExclusionPath "C:\Users\champuser\WinPEAS"
curl -L -O https://github.com/...
Get-FileHash .\winPEASx64.exe

Later edit, Set-MpPreference -DisableRealtimeMonitoring $true Use this instead of making a million exclusion zones

Notes: I did set the execution policy and checked it repeatedly, but could never get it to work without creating an exclusion zone. The file would simply get purged every few seconds.

What hash algorithm does WinPEAS use for verification? What is the file hash?: WinPEAS has its sha256 has listed on github. A file hash is a unique string created from a file to determine if that file has been altered, if the hash matches, then it is (should be) the same file. I'm assuming this question isn't directly asking me to paste the hash, but I did crosscheck against the one listed on github to the file on my VM and they matched.

What does the RED/YELLOW/GREEN color coding indicate? Green means something is enabled properly or well configured. Yellow is simply a link Red is realistically the important one, as it means something is misconfigured or insecure

How long did the full scan take? What factors affect scan duration?: The scan only took about a minute. But I'd imagine the number of files, users, the number of seperate connected drives, and possibly the number of routes into the wider internet could effect the scan time. Likely system resources too.

Submission Set Two

Vulnerabilities Research

Bypass Method: Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy Bypass -Force or Add-MpPreference -ExclusionPath "C:..." if the first doesn't work

Ten Vulnerabilities:

1. Unquoted Service Path

Weakness: Windows does not properly interpret file paths without quotations and with spaces, and will try to run each space as a file.

Exploit: Identify the unquoted path and place a malicious file at a location that the path would attempt to execute prior to the actual file.

Fix: Put quotations around the path and ensure proper permissions.

Link: https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html

2. AlwaysInstallElevated

Weakness: When enabled, any user can install .msi files with full system permissions.

Exploit: A user can use and or install a malicious .msi file with minimal permissions.

Fix: Disable AlwaysInstallElevated

Link: https://learn.microsoft.com/en-us/windows/win32/msi/alwaysinstallelevated

3. Weak Service Permissions

Weakness: A lower-permissioned user can modify a service that runs with higher privileges.

Exploit: Edit a service to perform something malicious when run.

Fix: Restrict modification of these files and settings to higher-permissioned users.

Link: https://www.ired.team/offensive-security/privilege-escalation/weak-service-permissions

4. Weak Registry Permissions

Weakness: A lower-permissioned user can modify the registry of a higher-privileged service.

Exploit: Modify the registry configuration to force it to run something malicious.

Fix: Restrict permissions on sensitive registries.

Link: https://attack.mitre.org/techniques/T1574/011/

5. DLL Hijacking

Weakness: A privileged user loads a DLL from a location editable by a lower-privileged user.

Exploit: Place a malicious DLL in the expected location or modify the DLL typically there such that a service or user loads it instead.

Fix: Prevent users from editing important DLLs and use more secure loading pracrices.

Link: https://securityscorecard.com/blog/what-is-dll-hijacking-understanding-and-preventing-the-threat/

6. Missing Service Binary

Weakness: A refrenced service binary does not exist and its location can be written to by a lower-priviledged user.

Exploit: Place a malicious file at the binary location and run the service.

Fix: Ensure proper binarys are where they should be and fix permissions to the file/directory.

Link: https://owasp.org/www-project-mobile-top-10/2023-risks/m7-insufficient-binary-protection

7. Writeable PATH directory

Weakness: Directory in system PATH can be modified by a lower-privileged user.

Exploit: Place a malicious file that matches a program and priviledged process attempts to run.

Fix: Remove write permissions for that directory.

Link: https://www.praetorian.com/blog/red-team-local-privilege-escalation-writable-system-path-privilege-escalation-part-1/

8. Startup Folder Permissions

Weakness: A lower-privileged user can write to the startup files a higher-privileged user will use.

Exploit: Place a malicious file in the startup location so it runs when the higher-privileged user logs in.

Fix: Restrict write permissions to startup directories.

Link: https://www.picussecurity.com/resource/blog/t1547-001-registry-run-keys-startup-folder

9. Unattend.xml with Credentials

Weakness: An Unattend.xml file contains credentials accessible by a lower-privileged user.

Exploit: Use exposed credentials to authenticate as the exposed account.

Fix: Remove sensative credentials from Unattend.xml files or otherwise restrict access to them.

Link: https://www.immersivelabs.com/resources/blog/the-return-of-unattend-xml-revenge-of-the-cleartext-credentials

10. Scheduled Task

Weakness: A scheduled task that runs with higher permissions can be modified by a lower-permissioned user.

Exploit: Edit a scheduled task before it is run to run malicious code.

Fix: Properly set the permissions on these tasks so they cannot be edited.

Link: https://support.microsoft.com/en-us/servicing/os/windows/2017/01/ms10-092-vulnerability-in-task-scheduler-could-allow-for-elevation-of-privilege

Submission Set Three

Rerun WinPEAS

Told to Skip

Submission Set Four

msfvenom setup

IP: 10.0.17.23 Port: 7779

Submission Set Five

msfvenom setup

No submission

Submission Set Six

3 Vulnerabilities

Video: https://youtu.be/3PWtpYgpaNA