Try Hack Me : Windows Privilege Escalation Part 1.

Summary

In this video, the host delves into Windows privilege escalation, an essential skill in the junior penetration testing path. They discuss the common scenario of starting with unprivileged user access and leveraging it to gain administrative rights. Techniques include exploiting misconfigurations, service accounts, and scheduled tasks. The host demonstrates practical methods like using saved credentials and manipulating scheduled tasks for privilege escalation, providing a hands-on learning experience for viewers.

Takeaways

• 💻 The video discusses Windows privilege escalation, a technique used in penetration testing to gain higher access rights on a system.
• 🔄 The presenter acknowledges a delay in content release due to the vast amount of material to cover, emphasizing the importance of continuous learning.
• 👤 Unprivileged user accounts are common initial access points in pen testing, reflecting real-world scenarios where most network users have limited privileges.
• 🔑 Privilege escalation often involves exploiting misconfigurations, service accounts with elevated rights, or vulnerabilities in software or missing security patches.
• 🔍 The video highlights the importance of looking for credentials in various places such as text files, service accounts, and scheduled tasks.
• 📂 Different types of accounts like admin, standard users, and special built-in accounts each have varying levels of access and are potential targets for privilege escalation.
• 🔗 The script explains how service accounts, used for running services, can be a gateway to higher privileges due to their often elevated status.
• 🔎 Techniques for finding and exploiting saved credentials, such as those in PowerShell history or saved Windows credentials, are demonstrated.
• 🛠 The video provides practical examples of how to use command-line tools to check for and manipulate scheduled tasks, which can be abused for privilege escalation.
• 🔄 The concept of 'pivoting' through different accounts to gather various permissions and access is introduced as a strategic approach in pen testing.
• 🔒 The script concludes with a discussion on maintaining elevated privileges post-escalation, suggesting methods like editing the registry or using persistent malware.

Q & A

What is the main focus of the video script?

The main focus of the video script is Windows privilege escalation, which is a continuation of the junior penetration testing path.

Why is it common to start with an unprivileged user account during a pen test?

It is common to start with an unprivileged user account during a pen test because statistically, the majority of users on a network are regular users with limited access, and this scenario represents a realistic starting point for testing.

What are some ways unprivileged users can gain elevated privileges?

Unprivileged users can gain elevated privileges by exploiting misconfigurations, finding credentials in text files, spreadsheets, or by taking advantage of excessive privileges assigned to their accounts, vulnerable software, or missing Windows security patches.

Why are service accounts significant when looking for privilege escalation opportunities?

Service accounts are significant because they often have elevated privileges for certain functions, and their passwords are less frequently rotated, making them potential targets for gaining higher access.

What is the difference between a local system account and an administrator user account in Windows?

A local system account has more privileges than an administrator user account. The system account can perform any action on the local machine, while an administrator user account has elevated privileges but is still limited in comparison.

How can saved Windows credentials be exploited for privilege escalation?

Saved Windows credentials can be exploited by using the 'run as' command to execute actions or access resources with the saved user's higher privileges, which can aid in privilege escalation.

What is an unattended Windows installation and why is it relevant to privilege escalation?

An unattended Windows installation is a method used in enterprise environments to deploy a single operating system image across multiple hosts. It is relevant to privilege escalation because admin credentials used in these installations might be stored in files like unattend.xml, which can be exploited if discovered.

How can the history file in PowerShell be used to find credentials?

The history file in PowerShell can be used to find credentials by reviewing the commands that have been previously executed, which might include commands that used or displayed credentials.

What is the significance of the 'web.config' file in IIS and how can it be exploited?

The 'web.config' file in IIS stores the configuration of the web server, including database connection strings and authentication mechanisms, which might contain service account credentials. Exploiting these credentials can lead to privilege escalation.

How can scheduled tasks be abused for privilege escalation?

Scheduled tasks can be abused for privilege escalation by modifying the task to execute a malicious script or command when the task runs, especially if the task is configured to run with higher privileges or as an administrator.

What is the purpose of the 'run as' command in Windows?

The 'run as' command in Windows allows a user to execute a program with the security privileges of a different user account, which can be used to perform actions that the current user does not have permission to execute.