Privilege Escalation, Persistence & Covering Your Tracks

Windows

Terminal Learning Objectives/Learning Domains

Action:
Explain how to perform privilege escalation and maintain persistence on a Windows OS
Condition:
In a training environment, with appropriate graphical training aids, various learning constructs, and peer and instructor feedback
Standard:
Students will be able to explain Windows Privilege Escalation and persistence methodology

Learning Domains/Level of Learning:

Congnitive:
Knowledge, Comprehension
Affective:
Receiving, Responding, Valuing

Army General Learning Outcomes:
7,8,14

Safety Requirements:
No major considerations
Risk Assessment Level:
LOW
Environmental Considerations:
NONE
Evaluation:
Check on learning questions

Rationale

Privilege escalation and maintaining persistence are among the many post-exploitation skills and tasks that attackers must grasp. Attackers and defenders need to understand how privilege escalation can occur and how persistence can be maintained on a system. This understanding allows attackers to move freely through a network, and allows defenders to prevent privilege escalation, detect attacker movement, and detect/prevent attacker persistence mechanisms.

Objectives

  • Identify and perform privilege escalation and integrity-level elevation

  • Familiarization with OS auditing and logging

  • Perform log cleaning and blending in

  • Identify artifacts

Modes & Levels

  • Kernel Mode vs User Mode

  • Privileged vs Unprivileged

Windows Access Control Model

  • Access Tokens

    • Security Identifier (SID) associations and Token associations

  • Security Descriptors

    • DACL

    • SACL

    • ACEs

DLL Search Order

Executables check the following locations (in successive order):


  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs

  • The directory the the Application was run from

  • The directory specified in in the C+ function GetSystemDirectory()

  • The directory specified in the C+ function GetWindowsDirectory()

  • The current directory

Windows Integrity Mechanism

Integrity Levels

Untrusted

Anonymous SID access tokens

Low

Everyone SID access token (World)

Medium

Authenticated Users

High

Administrators

System

System services (LocalSystem, LocalService, NetworkService)

User Account Control (UAC)

  • Always Notify

  • Notify me only when programs try to make changes to my computer

  • Notify me only when programs try to make changes to my computer (do not dim my desktop)

  • Never notify

DEMO: Checking UAC Settings

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

AutoElevate Executables

Requested Execution Levels:

  • asInvoker

  • highestAvailable

Privilege Escalation

Actions that allow an adversary to obtain a higher level of permissions on a system or network

Scheduled Tasks & Services

Items to evaluate include:


  • Write Permissions

  • Non-Standard Locations

  • Unquoted Executable Paths

  • Vulnerabilities in Executables

  • Permissions to Run As SYSTEM

DEMO: Finding vulnerable Scheduled Tasks

schtasks /query /fo LIST /v

DEMO: DLL Hijacking

  • Identify Vulnerability

  • Take advantage of the default search order for DLLs

  • NAME_NOT_FOUND present in executable’s system calls

  • Validate permissions

  • Create and transfer Malicious DLL

DEMO: Finding Vulnerable Services

wmic service list full
sc query

DEMO: Vulnerable services

  • Identify Vulnerability

  • Validate permissions

  • Validate Executable Paths

  • Replace with Malicious File

Other Vulnerabilities

  • Unpatched Kernel Vulnerabilities

  • Unpatched Systems

  • Unpatched Applications

DEMO: SYSTEM Access and Defeating Protections

The objective of this is to provide yourself unrestricted access to a system, and identify methods to execute malicious activity, through a basic command line prompt


  • Sysinternals

  • Schedule Task

  • UAC Bypass

Persistance

System changes or binary uploads that provide the adversary continued access to system


Survives:

  • Reboots

  • Credential changes

  • DHCP IP reassignment

  • Etc.


Considerations include:

  • File naming

  • File location

  • Timestomping

  • Port selection

Registry

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\

    • Run

    • RunOnce

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\

    • Run

    • RunOnce


  • What are the differences?

  • Do you need to blend in?

Scheduled Tasks

Permission Levels Considerations:


  • What is your objective?

  • Do you need to blend in?

Services

  • At Startup

  • Perform Multiple Functions

  • Typically require Administrative Access

Covering Tracks

When does planning start?

  • Prior Initial Access? After Initial Access? Before Exit?


What will happen if I do X?

  • Logs


Checks

  • Where are things?


Hide

  • File locations, names, times

Know the system!

Considerations

  • Artifacts

    • Determine which events will create a log

    • Event Logs

      • Applications, Security, Setup, System

  • Blending In

  • TimeStomping

System usage

Where should you run commands from?


  • Locally?

  • Remote?


Are system resources a important, and how can we check them?

wmic
net
netstat

DEMO: Audit Logging

Show all audit category settings
auditpol /get /category:*
What does the below command show?
auditpol /get /category:* | findstr /i "success failure"

Important Microsoft Event IDs

4624/4625

Successful/failed login

4720

Account created

4672

Administrative user logged on

7045

Service created

DEMO: Event Logging

Storage: c:\windows\system32\config\

File-Type: .evtx/.evt

wevtutil el
wmic ntevent where "logfile="<LOGNAME>" list full
Get-Eventlog -List

PowerShell Logging

  • Windows CLI CMD history is per instance (doskey /history)

  • Powershell can be set to log sessions

    • 2.0 little evidence

      • Nothing about what was executed

    • 3.0 Module logging (EventID 4103)

    • 4.0 Module logging

    • 5.0 Can set module, script block (EventID 4104) and transcription

DEMO: Additional Logging

Determine PS version (bunch of ways)
reg query hklm\software\microsoft\powershell\3\powershellengine\

powershell -command "$psversiontable"
Determine if logging is set (PowerShell and WMIC)
reg query [hklm or hkcu]\software\policies\microsoft\windows\powershell
reg query hklm\software\microsoft\wbem\cimom \| findstr /i logging
# 0 = no | 1 = errors | 2 = verbose
WMIC Log Storage
%systemroot%\system32\wbem\Logs\

DEMO: Manipulating Logs and Files

Find Files and Alter File attributes
forfiles /P c:\windows\system32 /S /D +05/14/2019
wmic datafile where name='c:\\windows\\system32\\notepad.exe' get CreationDate, LastAccessed, LastModified
copy /b filename.ext +,,
$(Get-Item file.ext).lastaccesstime=$(date) |$(Get-Item test.txt).lastaccesstime=$(Get-Date "07/07/2004")

Clear Event Logs (produces logging!):

wevtutil clear-log Application
Clear-Eventlog -Log Application, System

DEMO: Windows Covering Tracks with Persistance

Let’s add a backdoor, hidden in plain-sight!

Questions?