Windows Privilege Escalation - Exploiting Insecure Service Permissions

Key Takeaways

[Music] hey guys hack exploit here back again with another video welcome back to the penetration testing boot camp in this video we will be taking a look at um you know the first privilege escalation uh attack vector within the windows previous chrome on trihakmy so we're going to be exploring uh you know the various privilege escalation attack vectors that can be used in the previous video we took a look at how to essentially gain access to the target system via the web delivery metasploit module and we took a look at how to perform uh enumeration or to automate local enumeration with win peas all right so again we are currently on task three and we're starting off by taking a look at insecure service permissions right so that's what we're exploiting now this particular task doesn't give you an idea of how to identify you know a specific service that is vulnerable or that you can ex that you can actually exploit right now this particular privilege escalation technique essentially involves identifying services that have weak permissions right now when i say weak permissions what do i mean well i mean permissions uh relative to our current user right so we currently have access to the target system via an unprivileged user account called user and what we're trying to do is find various services uh that are misconfigured or that are essentially you know misconfigured to essentially allow us to modify uh or to modify various aspects of that particular service configuration right so as it says here it automatically or already tells you the actual vulnerable service here and that is d a c l lsvc so directory access control list service so that's really the vulnerability that we're exploiting now when it comes down to this particular privilege escalation technique the first step is identifying services with weak permissions or services that could be exploited and in this case this task doesn't cover that so let's see how to do this with uh win peace so i'll go back into the actual my display console here and if i list out my sessions i currently have access to the target so sessions two that's a vyam interpreter my current working directory is under system 32 so let me head back into the temp directory there we are and i'll just hit shell and we can then execute it here so i'm going to say winpees x64.exe and we're going to limit the output to services right so service info because that's what we're primarily interested in or that is the type of information that we're interested in because we're targeting weak services so i'll hit enter we'll give this a couple of seconds to complete as you can see that completes much faster and it'll go through the the first checks here which we already covered and then of course you have your services information so these are interesting services that are non-microsoft right so check if you can override some service binary or perform a dll hijacking attack also check for unquoted parts in our case we're looking for services with weak permissions right now remember this is not file permission um you know and of course we'll cover that but for now we're interested in insecure service permissions and i'll i'll explain the difference there right so one of the services that we can start out with as it recommends here is the dac lsvc right so we can see that right over here provided to us by win peas and it then gives us the actual service path here but it doesn't you know enumerate the permissions and of course we have the file permission service here which again you know throws out the actual path to the executable or the service path and whether or not it's currently running etc right and then of course you have the pulp of the file permissions here everyone has access um so that is for every user on the system if we are looking for services or you know permissions relative to our current user uh then we can utilize the utilities the manual utilities are recommended here one of them is access check which is a sys internals tool so it's part of the assistant uh the sys internal suite right so this particular tool is essentially used to identify uh what kind of access specific users or groups have to resources including files directories services registries etc etc right so you can download it directly from here however the creator of this room has been uh gracious enough to actually uh you know have all of these binaries for us already on the target system which is great so uh what we can do is we can utilize the access chk or access check utility to essentially identify uh the current user account permissions for the dac l svc service right and this of course can be done by executing access check and then of course you need to pass the accept euler flag because it's going to prompt you to accept the ulan we can of course accept it because we're you know executing it from a command line or from a command shell and then we pass in the following flags right so this is going to display the actual permissions for that particular service for our current user and of course you can substitute user with any other user to identify uh the permissions for that specific user so i'll just copy the actual flags here or the options for access check and um if we head back over into the root of the c drive you can see that uh all of the utilities or executables will be saved under a prives directory so we'll navigate into that directory here and we should have the access check executable there we are we have accesscheck.exe so i'm going to execute it access chk.exe and then we can pass in the flags there right so we'll hit enter and what this is going to tell you is your permissions and then of course it'll go over that a little bit more or it will elaborate over your permissions so you can see read and write the directory access control list service so we have the ability to actually check the configuration we can change the actual service configuration which is great which means we can modify the actual binary path and replace it with a a path to a malicious binary that will create that'll provide us with a reverse shell however the key thing that you need to note here is this is all great right and um we can change the the actual service but we can change the actual service configuration we can start it and stop it as it says here that's all great but if we start and stop it or if we execute it as our current user irregardless of the actual binary uh the custom binary path that we specified it's going to be executed with the current user permission so let's see what permissions this particular service runs as so because it could run as uh as administrator or it could run with system privileges in order to do that we can use the sc command sc is the service controller on windows we can say sc qc and then we can specify you know the actual service name so that is daclsvc hit enter and this will tell you uh the actual configuration options or the actual configuration for this service right so you can see the service name is daclsvc the type uh and then of course you have the binary path name right over here okay we have the the the actual display name the service start name and that's very important so if we take a look at the documentation on the lab here you can see that it'll tell us query the service and note that it runs with system privileges service start name so again this means that this particular service whenever executed will start up or will run with system privileges or elevated privileges which means if we modify the actual binary path which we can as our current user and we set up maybe a meterpreter payload and then once we hit once we start the service that meterpreter payload will be executed with system privileges which will consequently give us an elevated meterpreter session now in order to do this we first of all need to generate a interpreter payload with msf venom so i'm just going to use open up a new tab and i'm going to say msf venom if i can type it up correctly so msf venom and then the payload is windows and we'll use a non-staged payload so windows x64 and we'll say shell reverse um sorry that is shell underscore reverse tcp or you can use whatever payload you're comfortable with and then of course um let me just check my actual ip here there we are and that's the tunnel zero interface and let me just close that up there we are so l host is going to be equal to the uh our kali linux ip or your um your offensive you know distribution l port is one two three four just to keep things simple and then of course the format is executable and we'll output that in to we'll just call it reverse dot exe all right so that will generate our malicious payload or binary for us all right so that is generated successfully so what we need to do now is of course you know transfer it onto the target system into a particular directory that we will be setting as the service path because we can essentially modify or change that right so you can see that right over here when we queried or we actually queried this particular service configuration we can see that the the the current binary path is set to c program files dacl service dac service.exe now given the fact that we can change the configuration we can modify the actual binary path name and set up or set the path to our custom payload but we first need to upload it so if you're working with a standard command shell you can use the cert util utility to transfer files to the target system of course you need to be cognizant of antivirus solutions are installed on the system in our case we were able to identify that we don't have an antivirus installed um in this case i'll just use meta i'll just use the interpreter upload command so i'll terminate that channel we're currently under the temp directory i'm just going to uh save this under the privesque or upload it into the uh privesque directory so cd privesque there we are and let me make sure we don't have anything with the same name there all right cool so i'll say upload and then this is under home kelly documents try hack me windows prives and then it is sorry reverse dot exe right and uh we hit enter all right so give that a few seconds if we print our current working directory you can see we're currently under prives etc right so i'll open up a shell again here and we'll take a look at the documentation and you can see it says now we need to essentially modify the actual uh configuration for the service and in this case we're modif modifying the binary path so uh we can copy this here because i it's pretty much saved in the same directory so we'll copy that and uh we'll paste that in there so sc config dacl svc binary path is c prives reverse.exe right so i'll hit enter and it's going to tell us that it was able to successfully change the service configuration so what we can do now is if we say d a c scqdacl s v c and hit enter you can see that it's changed the binary path to that particular part that we specified and whenever we start this service it's going to execute our malicious payload as or with system privileges so let's open up another display framework console session here and i'm just going to copy the payload that we used to generate our malicious binary there we go and we'll give this a couple of seconds and we'll use the multi handler so use multi handler there we are set payload and we'll paste that in there and then we're going to set the lhost to the following ip so set lhost is there we are and then set l port to one two three four and we can then hit run all right so now that we've modified the actual binary path to start a service on windows there's many techniques that you can use uh we can use the sc option the service controller and say sc start and then dac l um svc and we hit enter that's going to start it and let's see if we get a meterpreter session um where it says an instance of the service is already running so what we can do is we can restart it so to restart it we're just going to say sc stop d-a-c-l-s-v-c and then sc start d-a-c-l-s-v-c then if we check our handler let's see whether we're able to receive a interpreter session there we are we get a commercial session and if we say you know if we essentially enumerate our privileges so who am i uh you can see nt authority system net user there we are and you can see that we're on the same system and we've obtained administrative privileges uh you know just by exploiting a misconfigured service right so a misconfigured service through weak permissions that's very important to take note of right so um you can now pretty much upgrade this into a full-blown interpreter session and you know you'll have elevated privileges on the target system so again just going over just to summarize what we've done uh we used win peace to identify uh you know services and then of course we utilize the access check uh executable or tool to identify the actual uh you know the actual permissions for the the current user that we had access to or that we were currently accessing the system with which was the user account and we saw that that user had the ability to change the actual service configuration and part of that allowed us to modify the actual binary path right which allows allowed us to specify a custom path to a malicious binary that when when the service is started or restarted it'll then execute that particular you know custom malicious binary or payload uh and of course we were able to identify that this particular service is executed with system privileges so the key thing that you need to be aware of within uh when it comes down to this particular technique is that the actual service requires or you know actually needs to be running um with system privileges in order for this to work otherwise you're just going to get another session with the current user privileges if it's not running or it doesn't start up with system privileges then you're not going to be able to elevate your privileges right so uh you need to keep that in mind so what is the original binary path name of the dacl service um um let's see whether we can find that here because i didn't log that information uh we should have it here there we are so that's uh c program files dcl service so i'm going to copy that and we'll paste this in here let me get rid of that there there we are so that's correct all right so we can move on to the next privilege escalation attack vector which is uh the unquoted service parts which is again fairly simple to understand in regards to what is vulnerable so we'll actually get to that in the next video all right so that's going to be it for this video guys thank you very much for watching if you have any questions feel free to reach out to me on our discord server the link is in the description you can also reach me via twitter i do respond to your tweets as i get them so you can reach out to me on twitter and on discord i'd love to hear what you guys think if you have any feedback leave it in the comment section and yeah let me know what you guys think let me know what uh you know privilege escalation attack vector uh you're currently working on all that you have experience with and i'll be seeing you in the next video a huge thank you to all of our patreons your support is greatly appreciated and this is a formal thank you so thank you shamir douglas ryan carr sandor michael busby sits up doozy defean barry dustin on president michael hubbard your support is greatly appreciated and you keep us making even more high quality content for you guys so thank you [Music] you