In this lesson, we'll focus on the process
of enumerating permissions.
Permissions enumeration is an important step in pentesting
that can help us identify access controls
and potential vulnerabilities within a target system.
Enumerating permissions involves looking at the rights
and privileges assigned to users and groups
to uncover potential misconfigurations
or weaknesses that could be exploited.
So, why is getting a list of accounts
in their associated permissions important?
Good access control is one of the first line defenses
in maintaining security.
Permissions define what actions users and groups can do
on resources such as files, directories, databases
and network shares.
Misconfigured permissions can lead to unauthorized access,
data leakage, or privileged escalation,
making it a key aspect to evaluate during a pentest.
One of the primary tools we can use
for enumerating permissions in a Windows environment
is PowerView,
which is a PowerShell tool
designed for network enumeration and privilege escalation.
PowerView can list all the permissions assigned to users
and groups on various resources.
For example, the command Get-NetShare can enumerate
all shared folders on the network
and their associated permissions,
showing us if any shares are accessible
to unauthorized users.
In Unix-based systems,
the ls and getfacl commands
are commonly used for permission enumeration.
The ls-l command lists files and directories
along with their permission,
while the getfacl provides a more detailed view
of Access Control Lists.
For instance, let's say I run the getfacl for my directory
/homes/parallels,
This would display the permissions
for the specific directory,
including any additional ACL entries
that may grant or restrict access
beyond the standard Unix file permissions.
Another important aspect of permission enumeration
is looking at database permissions.
Tools like SQLmap can help enumerate database users,
roles, and their privileges.
For example, running the sqlmap -u command
against this URL
with the option --dbs
can enumerate databases,
and other options can list tables, columns, and permissions,
letting us know if any sensitive data is exposed
to unauthorized users.
Now, this is not a legitimate webpage
so you will get a 404 error,
but the structure of the syntax will be similar.
Network shares and their permissions
are another important area to evaluate.
Tools like SMBMap and CrackMapExec
can be used to enumerate shared resources
and their account controls.
For example, running smbmap -H 192
.168.1.100
lists all shared folders on a target machine
and their associated permissions.
This can help identify shares that are accessible
to unauthorized users
or misconfigured to allow excessive access.
Next, let's consider an example using PowerView
in a Windows environment.
Suppose we want to enumerate permissions
on a shared folder name "Finance" on the network.
By running the command
Get-SMBShare -Name
Finance | Get-SMBShareAccess,
PowerView lists all users in groups
with access to the "Finance" share
and their respective permissions like Read, Change, or Full.
This information can help identify
if any unauthorized users have been granted access
or if permissions are overly permissive.
In addition to file and folder permissions,
enumerating permissions on Active Directory objects
is very useful.
PowerView can enumerate permissions
on Active Directory objects,
such as user accounts and organizational units.
For example, running the Get-ObjectAcl
DistinguishedName OU=Sales,
DC=example,DC=com
lists the permissions of the "Sales" Organizational Unit,
revealing if any users or groups have been granted
excessive rights,
such as the ability to create or delete user accounts.
Because cloud networking is a rapidly growing sector,
cloud environments should also be subjected
to thorough permissions enumerations.
Tools like AWS Command Line and Azure PowerShell
can be used to list permissions assigned to users,
roles, and resources in cloud environments.
For example, running the aws iam list-users
followed by aws iam list-user-policies
-user-name username
list the permissions policies
attached to the specific AWS user.
This helps identify any users
having granted excessive permissions
that could be exploited.
So remember, enumerating permissions is a key task
of a pentesting engagement
to help identify potential access control weaknesses
and misconfigurations.
By using tools like PowerView, ls, getfacl,
SQLMap, SMBMap,
and cloud-specific tools,
testers can gather a lot of good information
about the permissions assigned to users and group
on various resources.
This analysis helps uncover potential security gaps
that could be exploited by attackers,
enabling organizations to strengthen
their access control mechanisms
and enhance overall security.