Upload File

windows privilege escalation by dhruv shah

28
Windows Privilege Escalation Because gaining shell to the system is just not enough

Upload: owasp

Post on 13-Apr-2017

304 views

Category:

Internet


3 download

Report

TRANSCRIPT

Page 1: Windows privilege escalation by Dhruv Shah

Windows Privilege Escalation

Because gaining shell to the system is just not enough

Page 2: Windows privilege escalation by Dhruv Shah

C:\> type disclaimer.txt

• The opinions expressed in this presentation are mine and not those of my employer.

Page 3: Windows privilege escalation by Dhruv Shah

• Dhruv Shah• @snypter• http://security-geek.in

http://security-geek.in/
Page 4: Windows privilege escalation by Dhruv Shah

What are we here for ?

• Different scenarios leading to privilege escalation

• Design issues , implementation flaws, untimely system updates , permission issues etc

• We ain’t talking about overflows here , just logics and techniques

Page 5: Windows privilege escalation by Dhruv Shah

Flavours are we looking at ?

• Windows XP• Windows 7 • Windows 2003

Page 6: Windows privilege escalation by Dhruv Shah

Two Types of Escalation

• Admin to System– Easy , not much effort needed

• User to System– Here is where the real deal lies in

Page 7: Windows privilege escalation by Dhruv Shah

Admin to System

( Piece of Cake )

• The famous “at” command

• “psexec” anyone ?

Page 8: Windows privilege escalation by Dhruv Shah

Demo

Page 9: Windows privilege escalation by Dhruv Shah

System Privilege using “at”

Page 10: Windows privilege escalation by Dhruv Shah

Pass the Hash

• Managed to get the user hash• Password is complex will take long time to

crack via rainbowtables• Boom Boom Pow.

Page 11: Windows privilege escalation by Dhruv Shah

Abusing Scheduled Tasks

• Admin creates a scheduler task with System privileges

Page 12: Windows privilege escalation by Dhruv Shah

Abusing Scheduled Tasks

• Sadly the file to be executed is accessible by everyone

Page 13: Windows privilege escalation by Dhruv Shah

Demo

Page 14: Windows privilege escalation by Dhruv Shah

Creds in Files

• C:\users\victim\Desktop\password.xls• C:\>dir /b /s web.config• C:\>dir /b /s unattend.xml• C:\>dir /b /s sysprep.inf• C:\>dir /b /s sysprep.xml• C:\>dir /b /s *pass*• Registries are also a good place to have a look

at

Page 15: Windows privilege escalation by Dhruv Shah

Weak Directory Permissions

Lets have some fun

Page 16: Windows privilege escalation by Dhruv Shah

Demo

Page 17: Windows privilege escalation by Dhruv Shah

Abusing Service misconfigurations

• Possible attack vectors ?– Editing the service config– Editing the binary path

Todays Discusssion – Unquoted Service path Vulnerability

Page 18: Windows privilege escalation by Dhruv Shah

Unquoted Service Path

Page 19: Windows privilege escalation by Dhruv Shah

Unquoted Service Path

• c:\program*files\sub*dir\program*name• c:\program.exe files\sub dir\program name• c:\program files\sub.exe dir\program name• c:\program files\sub dir\program.exe name

Page 20: Windows privilege escalation by Dhruv Shah

Unquoted Service Path

Page 21: Windows privilege escalation by Dhruv Shah

Unquoted Service Path

Page 22: Windows privilege escalation by Dhruv Shah

Demo

Page 23: Windows privilege escalation by Dhruv Shah

Editing Service Binaries

• What are service binaries ? • How do we exploit them ?

• Lets exploit upnphost of the Windows system a default servcice that runs

Page 24: Windows privilege escalation by Dhruv Shah

Editing Service Binaries

Page 25: Windows privilege escalation by Dhruv Shah

Editing Service Binaries

Page 26: Windows privilege escalation by Dhruv Shah

Editing Service Binaries

Page 27: Windows privilege escalation by Dhruv Shah

Demo

Page 28: Windows privilege escalation by Dhruv Shah

Thank you

• Questions ?


SIMPLE%TECHNICS%OF PRIVILEGE%ESCALATION% · PDF fileKamil Stawiarski – Simple technics of privilege escalation in Oracle Database 11.2.0.3!!! 2! Environmentdescription% • OS!B!Oracle!Linux!Server!release!6.3!x64!

A. Cervoise antoine.cervoise@devoteam · Server allows privilege escalation (PHP vulnerability) Attack 1 CMS allows le upload !Code execution PHP allows privilege escalation !Root

Upgrading Your Android, Elevating My Malware: Privilege Escalation Through Mobile OS Updating

A framework for on-device privilege escalation …...2011/06/16  · 2011-06-12 Android Exploit Framework 1 A framework for on-device privilege escalation exploit execution on Android

Efficient Privilege De-Escalation for Ad Libraries in Mobile Apps

Level Up! - Practical Windows Privilege Escalation

Fundamentals of Linux Privilege Escalation

PowerUp - Automating Windows Privilege Escalation

Aide 2014 - Fundamentals of Linux Privilege Escalation

Towards Taming Privilege-Escalation Attacks on Androidbugiel/publications/pdfs/bugiel12-ndss.… · Towards Taming Privilege-Escalation Attacks on Android Sven Bugiel 1, Lucas Davi

Module 7 – Gaining Access & Privilege Escalation Phase II Controls Assessment Scheduling ○ Information Gathering ○ Network Mapping ○ Vulnerability

Hacking and Defending the Big 4 Databases€¦ · Exploiting Privilege Escalation Attack Target: –Oracle11g Release 2 Privilege Level: –CREATE PROCEDURE and EXEC on MDSYS.RESET_INPROG_INDEX

Security Bulletin - July 2019€¦ · Linux kernel Local Privilege Escalation Vulnerability ( CVE-2019-12817 ) Linux Kernel is prone to a local privilege-escalation vulnerability

Extreme Privilege Escalation On Windows 8/UEFI … Privilege Escalation On Windows 8/UEFI Systems ... would now require a ring 3 to ring 0 privilege escalation exploit that attacks

Physical Privilege Escalation and Mitigation in the x86 World

Privilege Escalation via Client Management Software · for privilege escalation attacks within corporate networks. November 21, 2015 Matthias Deeg | BSidesVienna 0x7DF 5. Common Security

Preventing Privilege Escalation

Privilege Escalation - University of Cincinnati

Preventing Privilege Escalation Presented By Chad Frommeyer

Towards Taming Privilege-Escalation Attacks on Android · PDF fileTowards Taming Privilege-Escalation Attacks on Android ... Android’s security framework has been an ... Android

Active Directory Privilege Escalation - Paramount Defenses€¦ · Active Directory Privilege Escalation often involves successively escalating privilege multiple times over, gaining

SIMPLE%TECHNICS%OF PRIVILEGE%ESCALATION% · Kamil Stawiarski – Simple technics of privilege escalation in Oracle Database 11.2.0.3!! 2! Environmentdescription% • OS!I!Oracle!Linux!Server!release!6.3!x64!

Logging. What is a log? What gets logged? Logins / logouts Privilege escalation Security relevant events

Efficient Privilege De-Escalation for Ad Libraries in ...bliu1/Bin_Liu_MobiSys2015_Efficient.pdf · Efficient Privilege De-Escalation for Ad Libraries in ... Android device shipments

Horizontal Privilege Escalation in Trusted Applications

Credential Assessment - Mapping Privilege Escalation at Scale

Ethical Hacking and Countermeasures...Privilege Escalation Using DLL Hijacking Privilege Escalation by Exploiting Vulnerabilities Privilege Escalation Using Dylib Hijacking Privilege

Hunting for Privilege Escalation in Windows Environment · Privilege escalation is the result of actions that allows an adversary to obtain a higher level of permissions on a system

Deserialization, what could go wrong?€¦ · Privilege escalation through object properties ... Python –Vulnerability Background Introduced via: pickle.load() pickle.loads() cPickle.load()

~qwertyoruiop@bluehatIL · trigger a kernel-mode privilege escalation or capture some data • Kernel-mode privilege escalation requires a separate kernel info leak (or a vulnerability

WINDOWS PRIVILEGE ESCALATION THROUGH …MS03-031 - Cumulative Patch for Microsoft SQL Server (Privilege escalation) MS04-044 - Vulnerabilities in Windows Kernel and LSASS (Privilege

20191025 - Windows Privilege Escalation Tricks€¦ · privilege escalation –There are FAR more misconfigurations than vulns –Vulns will be detected and patched by Nessus, Nexpose,

CSW2017 Privilege escalation on high-end servers due to implementation gaps in CPU Hot-Add flow

Controlled Privilege Escalation in Linux/UNIX … · Controlled Privilege Escalation in Linux/UNIX ... or a "guest" admin might be empowered to ... In Solaris 8, Sun introduced RoleBased

Using Advanced Threat Analytics to Prevent Privilege Escalation Attacks