2. Privilege Escalation
Privilege Escalation techniques to learn for CEH Practical
1. Escalate privileges using Priv Esc tools
After you have a meterpreter session, use the following command to check the user.
We can use BeRoot tool to check for further attack vectors.
uploading with meterpreter. Files go to downloads folder by default
Now run shell and then execute the file. It will list the attack vectors.
Note: Windows privileges can be used to escalated privileges. These privileges include SeDebug, SeRestore & SeBackup & SeTakeOwnership, SeTcb & SeCreateToken, SeLoadDriver, and Selmpersonate & SeAssignPrimaryToken. BeRoot lists all available privileges and highlights if you have one of these tokens.
Ghostpack Seatbelt
Gather information with following commands
Dumping hashes in meterpreter
2. Post exploitation using Meterpreter
Useful commands
To modify the timestamp MACE (modified, accessed,created,entry) attributes
To view timestamp entries
Finding files in meterpreter
search -f flag*.txt (in meterpreter)
Hidden files in shell
First get the shell, then use the following command.
List all running services in shell
Other shell commands
3. Linux privilige esc with pkexec
CVE (2021-4034)
Polkit (formerly PolicyKit) is a component for controlling system-wide privileges in Unix-like operating systems. It provides an organized way for non-privileged processes to communicate with privileged processes. It is also possible to use polkit to execute commands with elevated privileges using the command pkexec followed by the command intended to be executed (with root permission).
Download and run the script
4. Linux priv esc with NFS misconfiguration
Configure NFS in Victim
open /etc/exports file. This file contains the list of shares you want to share in the network. Add the following entry.
restart the server
If we run the nmap scan now, port 2049 will appear as open.
In Attacking Machine
Now install NFS commons
check the mouted folder
Now mount the share
Now move to the directory
to check free space
Now ssh into the machine. Move to the shared directory and run bash and we will get the root shell.
useful commands post exploitation
Now copy nano to current directory and then read shadow file
To see running processes
To view executable binaries
5. Escalate privliges bypassing UAC and sticky keys
After you have a meterpreter session background it and then use the following exploit
Then once you get a new meterpreter session, use the following command
To view the current sessions, you can use the following command.
Using sticky keys to priv esc on Win 11
After the initial meterpreter session, use the following module.
Now set the already priv escalated session in options and exploit it.
Now on Windows 11 , sign in with a normal user and once you press the stick keys(shift 5 times), you will get cmd as admin.
6. Priv esc using Mimikatz
Metasploit has built in module for mimikatz call kiwi.
First get a meterpreter session. Escalate privilege using bypassuac.
In meterpreter load the module
to dump hashes
We can also dump LSA Secrets using the following command. LSA secrets are used to manage local system security policy. it may contain passwords, IE passwords, SQL passwords etc
change the password with kiwi with hash without knowing the original password.
Last updated
Was this helpful?