Privilege Escalation Attacks

Privilege escalation is the act of exploiting a bug, design flaw, or configuration oversight in an operating system or application to gain elevated access to resources that are normally protected from an application or user. The result is that the attacker obtains permissions that allow them to perform actions that the system administrator intended to prevent. There are two main types:

Privilege escalation attacks typically follow a multi-step process:

1. Initial Foothold: The attacker compromises a low-privileged account or process, often through phishing, exploiting a vulnerability, or using stolen credentials. 2. Reconnaissance: The attacker enumerates the system to identify potential escalation vectors. Tools like whoami /priv, systeminfo, and accesschk on Windows, or id, sudo -l, and find / -perm -4000 on Linux are used. 3. Exploitation: The attacker leverages a vulnerability or misconfiguration to gain higher privileges. Common techniques include: - Token Manipulation: On Windows, attackers can steal or duplicate access tokens (e.g., using SeImpersonatePrivilege) to impersonate a higher-privileged user. - DLL Hijacking: Placing a malicious DLL in a directory that is searched before the legitimate DLL, causing an application to load the attacker's code with the application's privileges. - Path Interception: Manipulating the PATH environment variable or using unquoted service paths to execute arbitrary binaries. - Unquoted Service Paths: If a service executable path contains spaces and is not enclosed in quotes, Windows will attempt to execute each token in the path, allowing an attacker to place a malicious executable earlier in the path. - Scheduled Tasks: Creating or modifying scheduled tasks to run with elevated privileges. - Exploiting Vulnerabilities: Using known CVEs (e.g., CVE-2021-34527 for PrintNightmare, CVE-2020-1472 for Zerologon) to directly gain SYSTEM or root access. 4. Persistence: The attacker may create a backdoor to maintain elevated access, such as creating a new user in the Administrators group or installing a service. 5. Lateral Movement: With elevated privileges, the attacker can move to other systems, often using Pass-the-Hash or Pass-the-Ticket techniques.

- Privileged Escalation Vectors: - Misconfigurations: Weak file permissions, unquoted service paths, vulnerable scheduled tasks. - Vulnerabilities: Buffer overflows, race conditions, kernel exploits. - Credential Theft: Dumping passwords from memory (Mimikatz), cracking hashes, or pass-the-hash. - Token Theft: Exploiting token privileges like SeDebugPrivilege or SeImpersonatePrivilege. - DLL Hijacking: Exploiting the DLL search order on Windows. - Path Interception: Exploiting unquoted paths or writable directories in the PATH. - Standards and Tools: - Windows: whoami /priv, icacls, sc qc, schtasks, PowerUp.ps1, WinPEAS. - Linux: sudo -l, find / -perm -4000, ls -la /etc/cron*, uname -a, LinPEAS. - Metasploit: getsystem, exploit/windows/local/ modules.

Attackers use automated scripts and manual enumeration to find escalation opportunities. For example, on Windows, they might run:

whoami /priv

If they see SeImpersonatePrivilege enabled, they can use tools like JuicyPotato or RoguePotato to impersonate SYSTEM. On Linux, they might look for SUID binaries:

find / -perm -4000 -type f 2>/dev/null

If a binary like nmap or vim has the SUID bit set, they can run it as root to execute commands. Another common technique is exploiting unquoted service paths:

sc qc <service_name>

If the binary path is C:\Program Files\Vulnerable App\service.exe, an attacker can place a malicious Program.exe in C:\, which will be executed with SYSTEM privileges when the service starts.

Defenders must: - Apply the Principle of Least Privilege: Users and services should have only the minimum permissions necessary. - Patch Systems Regularly: Apply security updates to fix known vulnerabilities. - Harden Configurations: Remove unnecessary privileges, disable unused services, and enforce secure defaults. - Monitor for Escalation Attempts: Use SIEM and EDR tools to detect anomalous behavior like token manipulation, unusual process creation, or privilege elevation. - Conduct Regular Audits: Review user permissions, service configurations, and scheduled tasks. - Use Application Control: Whitelist allowed executables to prevent unauthorized binaries. - Implement User Account Control (UAC): On Windows, UAC can prevent silent elevation. - Disable Unnecessary Privileges: For example, remove SeImpersonatePrivilege from service accounts where not needed.

Windows Token Manipulation with JuicyPotato:

JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -t * -c {CLSID}

Linux SUID Exploit:

./nmap --interactive
nmap> !sh

Checking for Unquoted Service Paths:

wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v "\""

Using PowerUp for Automated Enumeration:

Import-Module .\PowerUp.ps1
Invoke-AllChecks

A help desk analyst receives a call from a user who forgot their password. The analyst resets it but inadvertently uses a weak password. An attacker, who has already compromised the user's machine via a phishing email, now has the new password. The attacker logs in as the user and runs whoami /priv, discovering SeImpersonatePrivilege is enabled. The attacker downloads JuicyPotato from a remote server and executes it to spawn a SYSTEM shell. From there, they dump all local passwords using Mimikatz and move laterally to the domain controller. The SOC analyst reviewing logs sees a process (JuicyPotato.exe) created by a non-admin user that spawned cmd.exe with SYSTEM integrity. The correct response is to isolate the compromised machine, revoke the user's access, and investigate the lateral movement. A common mistake is to assume the user's account is the only compromised entity, ignoring the SYSTEM-level access.

During a routine vulnerability scan, an internal pentester identifies an unquoted service path on a file server running a custom application. The service runs as NT AUTHORITY\SYSTEM. The path is C:\Program Files\Custom App\service.exe. The pentester creates a malicious executable named Program.exe and places it in C:\. They then restart the service using sc stop and sc start. The service executes C:\Program.exe instead of the intended binary, giving the pentester SYSTEM access. The SOC team sees a service restart and a new process (Program.exe) originating from C:\. The correct response is to check the service configuration, verify the executable path, and remove the rogue file. A common mistake is to focus on the service failure rather than the path manipulation.

An attacker gains access to a Linux web server as the www-data user. They run find / -perm -4000 and find that /usr/bin/nmap has the SUID bit set. Nmap is an older version that allows interactive mode. The attacker runs nmap --interactive and then !sh to spawn a root shell. They then add a new user to /etc/passwd with UID 0. The system administrator notices an unexpected user in the passwd file and checks ausearch logs showing nmap executed by www-data. The correct response is to remove the SUID bit from nmap and audit all SUID binaries. A common mistake is to patch the kernel but overlook misconfigured SUID permissions.