Downloaded 65 times
Uploaded byOWASP Delhi
Windows privilege escalation by Dhruv Shah
The document discusses various techniques for privilege escalation in Windows systems, including methods like abusing scheduled tasks and unquoted service paths. It outlines two main types of escalation: admin to system and user to system, highlighting the more complex nature of user to system escalations. The presentation also indicates various vulnerabilities and misconfigurations that can be exploited to gain higher privileges on Windows systems.
In this document
Powered by AI
Introduction to the concept of Windows privilege escalation, emphasizing the need for gaining system-level access.
A personal disclaimer clarifying that the opinions expressed are those of the speaker, Dhruv Shah.
Introduction of the presenter, Dhruv Shah, with his Twitter handle and website.
Discussion on scenarios for privilege escalation including design flaws, system updates, and permissions.
Identifying the Windows operating systems that will be covered: Windows XP, 7, and 2003.
Explaining two types of privilege escalation: from Admin to System and User to System, emphasizing the latter's complexity.
Introduction to simple methods for escalating from Admin to System, highlighting tools like 'at' command and 'psexec'.
A demo showcasing methods of achieving system privileges using the discussed techniques.
Demonstration of achieving System privilege using the 'at' command.
Discussion on acquiring user hashes, with a note on the complexity of cracking secure passwords.
Description of how scheduled tasks can be exploited if the executing file is accessible to all users.
A demonstration of exploiting scheduled tasks for privilege escalation.
Overview of potential locations for sensitive credentials in user files and registries.
Discussion on the risks associated with weak directory permissions.
A demo related to weaknesses in directory permissions.
Overview of attack vectors related to service misconfigurations with emphasis on unquoted service paths.
Detailed explanation of unquoted service paths and the security implications thereof.
Demonstration of exploiting unquoted service paths.
Discussion on service binaries, how to exploit them, and a specific case of upnphost service.
Conclusion of the presentation and opening the floor for questions.
More Related Content
Similar to Windows privilege escalation by Dhruv Shah
Windows privilege escalation by Dhruv Shah
- 1. Windows Privilege Escalation Becausegaining shell to the system is just not enough
- 2. C:> type disclaimer.txt •The opinions expressed in this presentation are mine and not those of my employer.
- 3. • Dhruv Shah •@snypter • http://security-geek.in
- 4. What are wehere for ? • Different scenarios leading to privilege escalation • Design issues , implementation flaws, untimely system updates , permission issues etc • We ain’t talking about overflows here , just logics and techniques
- 5. Flavours are welooking at ? • Windows XP • Windows 7 • Windows 2003
- 6. Two Types ofEscalation • Admin to System – Easy , not much effort needed • User to System – Here is where the real deal lies in
- 7. Admin to System (Piece of Cake ) • The famous “at” command • “psexec” anyone ?
- 8.
- 9.
- 10. Pass the Hash •Managed to get the user hash • Password is complex will take long time to crack via rainbowtables • Boom Boom Pow.
- 11. Abusing Scheduled Tasks •Admin creates a scheduler task with System privileges
- 12. Abusing Scheduled Tasks •Sadly the file to be executed is accessible by everyone
- 13.
- 14. Creds in Files •C:usersvictimDesktoppassword.xls • C:>dir /b /s web.config • C:>dir /b /s unattend.xml • C:>dir /b /s sysprep.inf • C:>dir /b /s sysprep.xml • C:>dir /b /s *pass* • Registries are also a good place to have a look at
- 15. Weak Directory Permissions Letshave some fun
- 16.
- 17. Abusing Service misconfigurations •Possible attack vectors ? – Editing the service config – Editing the binary path Todays Discusssion – Unquoted Service path Vulnerability
- 18.
- 19. Unquoted Service Path •c:program*filessub*dirprogram*name • c:program.exe filessub dirprogram name • c:program filessub.exe dirprogram name • c:program filessub dirprogram.exe name
- 20.
- 21.
- 22.
- 23. Editing Service Binaries •What are service binaries ? • How do we exploit them ? • Lets exploit upnphost of the Windows system a default servcice that runs
- 24.
- 25.
- 26.
- 27.
- 28.