Privilege Escalation for Windows and Linux

1. 1000 to 0
Sunny Neo
1

2. Who am I
•Pen tester from Singapore
•Started learning about security since 15 and still learning
•Want to learn: Reverse Engineering, Kernel Debugging & Exploit
2

3. What I am not talking about
•How to use Kernel exploit
3

4. What I am talking
•How to find typical misconfigurations made by Sysadmins
and Developers
•How to capitalize on the misconfigurations to gain super user
privileges
4

5. Why am I talking about this?
•Running limited shell is not fun
•Running kernel exploit is a high risk activity
•Kernel exploits are rare
•Kernel vulnerabilities usually get patched very quickly
5

6. Linux Privilege Escalation
6

7. SUID/SGID
•Set User ID Bit / Set Group ID Bit
•Enable users to execute file with file owner/group’s
permission
•Improve security by not assigning permissions for sensitive
files to every user
-rwsr-xr-x 1 root root 48920 Nov 13 00:58 /usr/bin/passwd
7

8. SUID/SGID
What if
Buffer Overflow Exists?
Command Injection Exists?
Interactive Shell Exists?
8

9. SUID/SGID
Source: http://www.rebootuser.com/?p=1623
9

10. SUID/SGID
10

11. SUID/SGID
Find all SUID/SGID files
find / -perm /u=s,g=s -type f -exec ls -la {} + 2> /dev/null
11

12. sudo
•Enable users to run command with privilege of
another user
•Commonly found in scripts to run privileged
commands without password authentication
12

13. sudo
13

14. sudo
14

15. sudo
15
VMware vRealize Appliance
Source: http://www.shellntel.com/blog/2016/6/7/weaponizing-nessus

16. sudo
16
VMWare vRealize Appliance
Source: http://www.shellntel.com/blog/2016/6/7/weaponizing-nessus

17. Weak Folder/File Permission
•Reveal sensitive information in history or configuration files
•Enable modification of important files or scripts executed by
Init or Cron job
17

18. Weak Folder/File Permission
•Look out for
• Home Directory (.rhosts, .ssh/authorized_keys, .bashrc, .*_history)
• Config files (httpd.conf, my.cnf, config.inc.php, sshd.config)
• Source codes (.php, .c, .cpp, .pl, .py)
• Init (/etc/rc.*) and Cron job (/etc/cron.*/, /var/spool/cron/)
• Scripts executed by Init or Cron job
18

19. Weak Folder/File Permission
19

20. Weak Folder/File Permission
World Readable Files/Folders
find / -perm /o+r -exec ls -la {} + 2>/dev/null
World Writeable Files/Folder
find / -perm /o+w -exec ls -la {} + 2>/dev/null
Search for ‘password’ in conf files
find / -name *.conf -type f -exec grep -Hn password {} + 2>/dev/null
20

21. PATH
•Environment variable for Shell to search for executable
•Meant for convenience however could be abused for
Relative Path commands
21

22. PATH
Assume this is a complex app that allows an authenticated user to view log
SUID Enabled
22

23. PATH
23

24. PATH
24

25. Symbolic Link Attack
•Symbolic link a.k.a soft link points to another file by filename
•Able to link any files regardless of the existence of target file
•Race Condition
•User with write access
25

26. Symbolic Link Attack
Cron Job runs this Program to ensure foo is always Writable
26

27. Symbolic Link Attack
User has write access for /tmp to create symlink foo
User has NO write access to /etc/cron.d/john YET
27

28. Symbolic Link Attack
After Cron Job executed the Program
User has write access to /etc/cron.d/john
28

29. Symbolic Link Attack
Source: https://packetstormsecurity.com/files/133692/Ubuntu-Security-Notice-USN-2744-1.html
29

30. Linux Enumeration Scripts
•LinEnum - http://www.rebootuser.com/?p=1758
•LinuxPrivChecker -
www.securitysift.com/download/linuxprivchecker.py
30

31. Windows Privilege Escalation
31

32. Weak Folder/File Permission
32

33. Weak Folder/File Permission
The vulnerability is due to incorrect installation and permissions settings on
binary files during the MSE physical or virtual appliance install procedure. An
attacker could exploit this vulnerability by logging into the device and
escalating their privileges. A successful exploit could allow the attacker to
acquire root-level privileges and take full control of the device.
Source: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-privmse
33

34. Weak Folder/File Permission
Get list of Services not in System32
for /f "tokens=2 delims='='" %a in ('wmic service list full^|find /i "pathname"^|find
/i /v "system32"') do @echo %a >> services.txt
Get Permissions
for /f eol^=^"^ delims^=^" %a in (services.txt) do cmd.exe /c icacls "%a" >>
permissions.txt
Source: http://travisaltman.com/windows-privilege-escalation-via-weak-service-permissions/
34

35. Weak Service Permission
•Well known vulnerability for Windows XP SP1 and Windows
2003 Server
•MS06-011 - Upnphost, SCardSvr, SSDPSRV, DnsCache, and
DHCP services
Source: http://www.fuzzysecurity.com/tutorials/16.html 35

36. Weak Service Permission
•sc config upnphost binpath=“ “
Source: http://www.fuzzysecurity.com/tutorials/16.html
36

37. Weak Service Permission
Get permissions on Services
accesschk.exe –uwcqv “Authenticated Users” *
accesschk.exe –uwcqv “Users”|”Everyone”|”Any Other Group” *
Source: http://www.fuzzysecurity.com/tutorials/16.html 37

38. Weak Registry Permission
•Services registered on the System are stored in the Registry
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices
•Weak Registry Permission enables non-privilege user to
modify the Service’s configurations
38

39. Unquoted Service Paths
DisplayName Name PathName
hMailServer hMailServer C:ServerMail ServerhMailServerBinhMailServer.exe
RunAsService
Mobile Broadband HL
Service
Mobile Broadband HL
Service
"C:ProgramDataMobileBrServmbbservice.exe"
VMware Tools VMTools "C:Program FilesVMwareVMware Toolsvmtoolsd.exe"
39

40. Unquoted Service Paths
•Unquoted Service Paths with Space(s) lead to ambiguous
binary executions
•Windows will attempt to execute a Path ending with the first
space onwards
•Number of attempted execution = Number of Space + 1
40

41. Unquoted Service Paths
C:Program FilesService Dirbinary name.exe
1) C:Program.exe
2) C:Program FilesService.exe
3) C:Program FilesService Dirbinary.exe
4) C:Program FilesService Dirbinary name.exe
41

42. Unquoted Service Paths
•Look out for services installed in C:*Folder*
•“Authenticated Users” has Modify Permission for
C:*Folder* inherited from C: Permissions (except for
folders created by Windows)
42

43. Unquoted Service Paths
43

44. Unquoted Service Paths
The hMailServer service is now registered in Windows with a quoted path, to
prevent the service from being vulnerable to "Unquoted service path".
Unquoted service paths would allow a user with access to the server where
hMailServer runs, but with less privileges than hMailServer, to gain the
privileges of hMailServer by creating a new executable and placing it in
C:ProgramFileshMailServerhMailserver.exe.
Not Right!
44

45. Unquoted Service Paths
C:ServerMail ServerhmailServerBinhMailServer.exe RunAsService
45

46. Unquoted Service Paths
Mail.exe is a reverse shell
46

47. Unquoted Service Paths
47

48. Unquoted Service Paths
Find all Unquoted Service Paths
wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr
/i /v "c:windows" |findstr /i /v """
Quick Exploit
Use Metasploit - exploit/windows/local/trusted_service_path
48

49. DLL Hijacking
•Dynamic Link Libraries (DLL)
•Shared Library Concept – allows application to reuse code in
DLL
•Hijacking happens when an application loads an attacker’s
DLL instead of the intended DLL
49

50. DLL Hijacking
•Loading non-existent DLL
•Loading DLL without fully qualified path
50

51. DLL Hijacking
•Windows 32 bits DLL Search Order with SafeDllSearchMode
Enabled
1. Directory from which application is loaded
2. Windows 32bit System Directory (C:WindowsSystem32)
3. Windows 16 bits System Directory (C:WindowsSystem)
4. Windows Directory (C:Windows)
5. Current Directory
6. Directories listed in %PATH%
51

52. DLL Hijacking
•CVE-2016-2855: Huawei Mobile Broadband HL Service Local
Privilege Escalation
•The Huawei Mobile Broadband HL Service 22.001.25.00.03
and earlier uses a weak ACL for the MobileBrServ program
data directory, which allows local users to gain SYSTEM
privileges by modifying VERSION.dll.
52

53. DLL Hijacking
53

54. DLL Hijacking
54

55. DLL Hijacking
Used ExportsToC++ to generate all Export functions from
C:WindowsSystem32version.dll
55

56. DLL Hijacking
56

57. DLL Hijacking
57

58. DLL Hijacking
58

59. Windows Enumeration Script/Tool
•Windows Privsec Check -
https://github.com/pentestmonkey/windows-privesc-check
59

60. Hot Potato
•Researched and Developed by Stephen Breen @ FoxGlove
Security
•Combined 3 vulnerabilities to perform Privilege Escalation
•NetBIOS Name Services (NBNS) Spoofing
•Web Proxy Auto-Discovery Protocol (WPAD) Man In The Middle
Attack
•HTTP-> SMB Relay
60

61. NBNS Spoofing
•Windows resolves domain name by the order
• Local Host File @ C:WindowsSystem32driversetchosts
• DNS Cache
• DNS Server
• Local LMHOST File @ C:WindowsSystem32driversetclmhosts.sam
• NetBIOS broadcast
•Anyone can respond to the NetBIOS Broadcast ☺
61

62. WPAD Man in the Middle
• WPAD is enabled by default
• IE will automatically look up http://WPAD/wpad.dat for
proxy settings
62

63. NTLM Authentication
•Challenge – Response
•3 Types of Messages
•Negotiation
•Challenge
•Authentication
63

64. SMB -> SMB Relay
•15 years old SMB Relay/Reflection Attack
Attacker MITMed the
connection to
legitimate SMB Server
Legitimate Client
(3) Client sends the Attacker the NTLM
Challenge
(2) Attacker connects to Client SMB
service and asks for a NTLM Challenge
(1) Client connects to SMB Server and
asks for a NTLM Challenge
(4) Attacker modifies Client’s Challenge and
sends it back to Client as his own for (1)
(5) Client receives (1) Challenge, encrypts it using
his credential (hash) and sends it back to Attacker
(6) Attacker sends back the response he
receives and successfully authenticated for (2)
64

65. SMB -> SMB Relay
•MS08-068 stops this by preventing relaying back the
Challenges Keys from where they were issued – SMB to SMB
Relay
•Doesn’t stop cross protocol attack HTTP -> SMB Relay ☺
65

66. HTTP-> SMB Relay
•NTLM is part of Integrated Windows Authentication
•IE supports Integrated Windows Authentication (NTLM
Authentication)
•Automatic Logon is enabled by default for Intranet Zone
•Localhost is part of Intranet Zone ☺
66

67. Hot Potato (Windows 7) Steps
1. Start NBNS Spoofing for WPAD and start Web Server on localhost:80
2. Start Windows Defender Update (NT Authority/System)
3. WPAD settings redirect Windows Defender Update to http://localhost/GETHASHES
4. http://localhost/GETHASHES asks for NTLM authentication and connects to localhost SMB
to obtain Challenge then forward it to Windows Defender Update
5. Windows Defender Update sends NTLM Response
6. Hot Potato resumes the SMB Authentication with the NTLM Response ☺
67

68. DEMO
68

69. More stuff
•Pass The Hash
•Mimikatz – Scraping cleartext credentials in Windows LSASS
subsystem memory for logged on users
69

70. Summary
•Non-exhaustive list of privilege escalation techniques
•More awareness has to be raised for Sysadmin and
developers
70

71. Tools
• LinEnum - http://www.rebootuser.com/?p=1758
• LinuxPrivChecker - www.securitysift.com/download/linuxprivchecker.py
• Windows-privesc-check - https://github.com/pentestmonkey/windows-privesc-check
• Hot Potato - https://github.com/foxglovesec/Potato
• Mimikatz - https://github.com/gentilkiwi/mimikatz (Available on Metasploit and Powerspoits)
• Powersploits - https://github.com/PowerShellMafia/PowerSploit
• PowerOPS (Run Powershell commands without Powershell.exe ) – https://github.com/fdiskyou/PowerOPS
71

72. Reference
• http://www.vantagepoint.sg/news/48-security-wednesdays-9-local-privilege-escalation-nus-greyhats
• https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/
• http://www.dankalia.com/tutor/01005/0100501004.htm
• http://netsec.ws/?p=309
• http://www.fuzzysecurity.com/tutorials/16.html
• https://labs.mwrinfosecurity.com/system/assets/760/original/Windows_Services_-_All_roads_lead_to_SYSTEM.pdf
• http://toshellandback.com/2015/11/24/ms-priv-esc/
• https://foxglovesecurity.com/2016/01/16/hot-potato/
• https://squirtle.googlecode.com/files/NTLM%20is%20Dead%20-%20DefCon%2016.pdf
72