In this lesson,
we're going to explore privilege escalation.
Privilege escalation is a process
of gaining higher level of permissions on a system
than originally intended,
allowing an attacker to access sensitive data
or perform restricted actions.
We will look at the methodology behind privilege escalation
and dive into specific tools like Mimikatz, Seatbelt,
and PowerShell
or the PowerShell Integrated Scripting Environment (ISE).
We'll discuss each tool's purpose,
how they're used in a penetration testing attack,
and provide example command.
Privilege escalation exploits the inherent trust
and misconfigurations of operating systems and applications.
Attackers use various techniques
to elevate their privileges,
such as exploiting vulnerabilities,
misconfigurations, and weak passwords.
There are two main types of privilege escalation:
vertical and horizontal.
Vertical privilege escalation
involves gaining higher privileges,
such as from user to an administrator,
while horizontal privilege escalation
involves accessing peer level accounts,
often to aggregate small privileges to form higher access.
First, let's cover Mimikatz.
Mimikatz is a well-known post exploitation tool
used for extracting plain text passwords, hash dumps,
and Kerberos tickets from memory.
It is particularly effective on Windows systems.
Mimikatz extracts credentials from memory, which can be used
to escalate privileges or move laterally within a network.
Imagine you have gained access to a low-level user account
on a company's network.
You need to escalate your privileges
to gain administrative access.
Using Mimikatz, you can extract credentials
of logged-in users,
including administrators directly from memory.
You'll use the following command:
mimikatz # sekurlsa : : logonpasswords.
The sekurlsa refers to the Windows component
that handles security credentials,
and the logonpasswords indicates the specific action
of extracting logon passwords.
To dump hashes from the Windows environment,
you typically target the security accounts management file,
typically referred to as the SAM file located in the C Drive
at the Window\system32\config\folder.
To do this, you'll use the following command:
mimikatz # lsadump : : sam.
And this is another module within Mimikatz.
The lsadump part refers to dumping information
from the local security authority,
that's the LSA component of Windows,
which is responsible for authentication
and security policies.
The SAM part refers to the security accounts manager
or the SAM database, which stores user account information
including password hashes.
To perform a pass the hash attack,
which bypasses traditional password authentication
by using the hash version,
we'll use the following command with Mimikatz.
Now let's break this command down.
First, we instruct Mimikatz
to utilize the sekurlsa module
for the pass-the-hash attack.
This is indicated by the PTH portion of the command.
Next, we specify the target user account to impersonate,
which in this example is the administrator account,
a high privilege account in Windows.
The user:administrator portion of this command
achieves that.
We then identify the active directory domain
where the administrator account resides
with the domain:example.com part of the command.
The crucial part of this attack
involves providing the NTLM hash
of the administrator account's password
specified with the /ntlm:
followed by the value of the hash.
This hash is typically obtained by dumping password hashes
from the local SAM database
or the active directory database using Mimikatz
or similar tools.
Finally, the command includes the /run: command.exe,
which specifies the action to be taken
after successful authentication.
In this case, it will launch a command prompt window
with the impersonated privileges
of the administrative account.
This sequence allows an attacker or penetration tester
to operate with elevated privileges,
showcasing the importance of securing password hashes
and monitoring for unauthorized access attempts.
Next, we have Seatbelt.
Seat Belt is a C# tool
that performs various security related checks
on Windows systems.
Seatbelt automates the process of finding misconfigurations
and weak spots in a system that can be exploited
for privilege escalation.
Suppose you are assessing the security posture
of your client's network.
You need to identify misconfigurations and weaknesses
that could be exploited for privilege escalation.
Seatbelt automates the process,
making it easier to find vulnerabilities.
To enumerate all checks, you'll use the following command:
Seatbelt.exe [space] all.
To check for high integrity processes,
you'll use the following command:
Seatbelt.exe -group=checkselevated.
And to list auto-run executables,
you will use the command
Seatbelt.exe autoruns.
These were just quick examples
to show the commands you would run using seatbelt.
And finally, let's discuss
PowerShell Integrated Scripting Environment (ISE).
PowerShell ISE is a graphical user interface
in a script development environment for PowerShell.
It allows for script creation, testing and debugging
in a more user-friendly environment
compared to the traditional PowerShell command line.
In a pen testing scenario, PowerShell ISE can be used
to perform a lot of different host-based attacks.
For example, an attacker can use PowerShell scripts
to automate tasks such as extracting information
about the system, running post exploitation modules,
or creating back doors.
Powershell's extensive library and command lists
make it very useful for escalating privileges,
moving laterally across the network,
and also exfiltrating data.
Imagine you need to gather detailed information about a host
for privilege escalation.
Could simply use a PowerShell script
to enumerate user accounts running services
and installed software looking for potential vulnerabilities
or misconfiguration.
PowerShell ISE provides a convenient environment
to write and test these scripts
making the attack process just more efficient.
So remember, tools like Mimikatz, Seatbelt, PowerShell ISE
are essential for penetration testers
to identify and exploit security weaknesses.
Mimikatz is used for extracting credentials
and performing pass-the-hash attacks.
Seatbelt helps automate the detection
of system misconfigurations,
and PowerShell ISE provides a user-friendly environment
for scripting and executing host-based attacks.
By understanding and utilizing these tools,
pentesters can effectively demonstrate
the importance of maintaining strong security practices
and regularly assessing the vulnerabilities.