8.2 - Privilege Escalation

 8.2 - Privilege escalation 

 

Key Terms: 

• Kerberoasting – An offline brute force attack to crack a Kerberos ticket to reveal the service account password in plain text. 
• DLL hijacking – Loading a malicious DLL in the application directory so that when the application executes, it will choose the malicious DLL. 
• cPasswords – The attribute that stores passwords in a Windows group policy preference item. 
• Security account manager (SAM) database – A database that authenticates local and remote users. In Windows, this database stores user passwords as an LM or NTLM hash. 
• Local security authority subsystem service (LSASS) - A Windows service that performs the system’s security protocol. 

 

cPasswords 

cPasswords is the attribute that stores passwords in a Windows group policy preference item. It is easily exploited because Microsoft publishes the public key used for the encryption of the account credentials in the group policy preferences. These preferences allow domain admins access to create and deploy whatever they want in any local user or local admin accounts. 

 

Kerberoasting 

Kerberos is a protective protocol that allows authentication over an unsecure network using tickets or service principle names called SPNs. Kerberos can be exploited because any authorised user can log into an active directory domain and request a service ticket or TGS. An encrypted ticket is returned, and an offline brute-force attack can crack the ticket to reveal the service account password. 

 

Credentials in LSASS 

The LSASS is a file in a Windows directory that performs security protocols. It verifies user logins, creates access tokens, and handles password changes. This file is susceptible to viruses and trojans. The vulnerability risk level is high for this file as it is a critical component for authority domain authentication, active directory management, and the initial security authentication. 

 

SAM Database Vulnerabilities 

A security account manager (SAM) database stores user passwords in windows as an LM or NTLM hash. This database is used to authenticate local and remote users. It also stores the administrator recovery account information. The SAM file can't be copied but it is possible to dump the hashed passwords to an offsite location which can then be decrypted. 

 

Unattended Installation Risks 

When files are left installing unattended, they leave a file named “unattended” on the workstation. This file is an XML file which contains configuration settings used during the installation including the settings which determine whether the account is an admin account. 

 

DLL Hijacking 

DLL hijacking happens during the installation of an application. When Windows applications are loading to an external DLL library, they usually search the application directory they were loaded from before attempting a path. If an attacker installs a malicious DLL in the application directory before the application is installed, the malicious DLL will be ran allowing the hacker to gain remote access. 

 

Tools 

• Trinity rescue kit – This kit helps with repair and recovery operations of Windows machines. It can reset passwords, perform malware scans, run disk cleanup, and fix bugs. 
• Kali Linux 
• Ultimate Boot CD 
• ERD Commander – Software designed to fix bugs that occur during or after reboots. 
• Ophcrack – Used for Windows password cracking. 

 

Countermeasures 

Users should only be given privileges they absolutely need. This prevents escalation if the hacker gains access to a lower-level account. Encryptions should always be used no matter what along with multi-factor authentication. Scanning OS and app coding should be done regularly to quickly fix bugs. Systems should be kept up-to-date and monitored for suspicious activity.