---

Linux Exploitation

View some of the notes for this section here - Enumeration Page.

FTP Server

Firstly, let's run an Nmap scan. We can see that vsftpd is running on port 21. We can now search for vsftpd and we see that we have an exploit module (vsftpd_234_backdoor). To open a command shell on the target, we can type /bin/bash -i .

To upgrade our shell to a meterpreter session, we can search for the shell_to_meterpreter module.

SAMBA

We can run an Nmap scan and we see that it has samba open on port 445. We can search for the module is_known_pipename. Once we have obtained a shell. We can upgrade it to a meterpreter session as previously done.

SSH

Again, let's run an Nmap scan and we can see that it's running libssh on port 22. We can use the module libssh_auth_bypass to test if its vulnerable to this exploit. We can now upgrade it to a meterpreter session as previously done.

SMTP

After running our Nmap scan, we see that smtp is running on port 25 and more specifically haraka. We can use the exploit module haraka to exploit the server.

---

Post-Exploitation Fundamentals

These are the actions performed on the target system after initial access has been obtained. This will generally consist of various techniques:

• Local enumeration

• Privilege escalation

• Dumping hashes

• Establishing persistence

• Clearing your tracks

• Pivoting

Meterpreter Fundamentals

It's an advanced multi-functional payload that operates via DLL injection and is executed in memory on the target system, consequently making it difficult to detect. It communicates over a stager socket and provides an attacker with an interactive command interpreter on the target system that facilitates the execution of system commands, file system navigation, keylogging, etc.

Meterpreter also allows us to load custom scripts and plugins dynamically. Note that it works different on both Linux and Windows for more advanced commands or techniques.

In this case, we will be exploiting the Apache XODA server for which there is a Metasploit module called xoda_file_upload. We will now have a meterpreter session on the target.

Some Useful Commands:

To upgrade a command shell to a Meterpreter shell - using the shell_to_meterpreter module. Another method to do this is to automate the process is to run the sessions command followed by -u and then the session ID.

---

Windows Post-Exploitation

We can utilize these post-exploitation modules to enumerate the following information about the Windows system we currently have access to:

• User privileges

• Logged on users

• Virtual machine check

• Installed programs

• Anti-virus

• Computers connected to that domain

• Installed patches

• Shares

Some Useful Windows Meterpreter Commands

Some Useful Windows Post-Exploitation Modules

If the enum_patches module fails, you can always enumerate the same information by opening up a shell on the target and running the systeminfo command.

Bypassing UAC

UAC stands for User Account Control. It's a security feature introduced in Windows Vista that is used to prevent unauthorized changes from being made to the OS and would require approval from the administrator.

A non-privileged user attempting to execute a program with elevated privileges will be prompted with the UAC credential prompt whereas a privileged user will be prompted with a consent prompt. Attacks can bypass UAC in order to execute malicious executables with elevated privileges.

In order to successfully bypass UAC, we will need to have access to a user account that is part of the local administrators group on the Windows target system. UAC has various integrity levels ranging from low to high, if the UAC protection level is set below high, Windows programs can be executed with elevated privileges without prompting the user for confirmation.

UACMe is an open source, robust privilege escalation tool. it can bypass UAC on multiple versions of Windows ranging from 7 to 10. It allows attackers to execute malicious payloads on a Windows target with elevated privileges by abusing the inbuilt Windows AutoElevate tool. The GitHub repository has more than 60 exploits than can be used to bypass UAC depending on the version of Windows running on the target. You can find the GitHub page here.

Once we have exploited the target, and we have a 64-bit meterpreter session, we can see that the user which we gained access to is part of the administrators group. To bypass UAC with Metasploit, we can use the bypassuac_injection module which will execute it in memory. Now that we have the privileges requires, we can use the getsystem command.

You can view some related UAC notes here.

Token Impersonation with Incognito

Windows access tokens are a core element of the authentication process on Windows and are created and managed by LSASS (Local Security Authority Subsystem Services). A token is responsible for identifying and describing the security context of a process or thread running on a system.

Access tokens are generated by the winlogon.exe process every time a user authenticates successfully and includes the identify and privileges of the user account associated with the thread or process. This token is then attached to the userinit.exe process, after which all child processes started by a user will inherit a copy of the access token from their creator and will run under the privileges of that access token.

Windows access tokens are categorized based on two types of the level tokens which determine which privileges are assigned to what token:

1. Impersonate level tokens

2. Delegate level tokens

Impersonate level tokens are created as a direct result of a non-interactive login on Windows, typically through specific system services or domain logons. They can be used to impersonate a token on the local system and not on any external systems that utilize the token.

Delegate level tokens are typically created through an interactive login on Windows, primarily through a traditional login or through remote access protocols, like RDP. These tokens pose the largest threat as they can be used to impersonate tokens on any system.

The process of impersonating access tokens to elevate privileges on a system will primarily depends on the privileges assigned to the account that has been exploited to gain initial access as well as the impersonation or delegation tokens available. You need one of the following tokens (primarily the SeImpersonatePrivilege token) to perform a successful impersonation attack:

• SeAssignPrimaryToken - allows a user to impersonate tokens

• SeCreateToken - allows a user to create an arbitrary token with administrative privileges

• SeImpersonatePrivilege - allows a user to create a process under the security context of another user typically with administrative privileges

In order to perform this attack, we will be using a Metasploit module called incognito which allows you to impersonate user tokens after successful exploitation. We can use it to display a list of available tokens that we can impersonate. In this case, the target is also vulnerable to the rejetto_hfs_exec Metasploit module that we used previously.

In this case, if you run the getprivs command within the Meterpreter session, we have access to the SetImpersonatePrivilege privilege. To now use the tool incognito within meterpreter:

load incognito
list_tokens -u
impersonate_token "the name of the token you want to impersonate"

We can now migrate to the explorer process, and we will have elevated privileges.

In the case that we do not find any useful or administrative tokens to impersonate; we can utilize the potato attack which will cover later.

Dumping Hashes with Mimikatz

Mimikatz is a Windows post-exploitation tool that allows for the extraction of clear-text passwords, hashes and Kerberos tickets from memory. We can use it to extract hashes from the lsass.exe process memory where hashes are cached. We can use the pre-compiled Mimikatz executable or if we have access to a meterpreter session, we can use Kiwi. We will require elevated privileges to run this.

The first step, as usual is to perform an Nmap scan. We can see that the target is running a BadBlue service on port 80. There is a Metasploit module to exploit this called badblue_passthru. Once exploited, we will have administrator privileges, and we can now migrate to the LSASS service and we will therefore have the highest privileges.

We can now load kiwi in our meterpreter session and dump all the credentials or we could dump the SAM database, which will dump the hashes for all the user accounts on the system.

creds_all
lsa_dump_sam

Alternatively to using Mimikatz, we can use our current meterpreter session and navigate to the Temp directory. We can then upload the Mimikatz executable on the target system.

upload /usr/share/windows-resources/mimikatz/x64/mimikatz.exe

We can then open up a shell session and run the executable. The first thing would be to check our privileges after we have run the executable and then we can dump the SAM database.

privilege::debug
lsadump::sam
lsadump::secrets

Another useful thing we can run with Mimikatz is that if the system is set to log the logon passwords in cleartext, we can view them by running sekurlsa::logonpasswords.

Pass-the-Hash attack with PsExec

It is an exploitation technique that involves capturing or harvesting NTLM hashes or clear-text passwords and utilizing them to authenticate with the target legitimately. This will allow us to gain access as opposed to obtaining access via service exploitation.

We can use the Metasploit PsExec module or the Crackmapexec tool to do this. You need the LM hash as well as the NTLM hash to do this.

The exploit module within Metasploit is:
exploit/windows/smb/psexec

set SMBUser (username)
set SMBPass (LM_hash:NTLM_hash)

You will have to set a target to get a meterpreter session.

crackmapexec smb (target ip) -u (username) -H "NTLM Hash" -X "any command you'd like to run"

Establishing Persistence

Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Gaining an initial foothold is not enough, we have to setup and maintain persistent access to your targets.

Note that to setup persistence, we will need elevated privileges. We can use any of the Windows persistence module available but the module we are looking for is the persistence_service module. Once we have run the module, we can then setup our multi/handler to connect back to the target whenever we need to re-gain access.

Enabling RDP

After gaining access, we can use the Metasploit module enable_rdp. Since we need cleartext credentials for this, we can crack the hashes or just change the administrator password (which is obviously not recommended in a real scenario). To do this, open up a shell and run the following command:

net user administrator password_123

Alternatively, we can use the xfreerdp tool to connect:

xfreerdp /u:administrator /p:password_123 /v:target_ip

Keylogging

This is the process of recording or capturing the keystrokes entered on a target system. It's not limited to post-exploitation, there are plenty of programs and USB devices can be used to capture and transmit the keystrokes entered on a system. We can perform keylogging using meterpreter.

Firstly, we need to migrate to the explorer process, and we can use the keyscan_dump, keyscan_start and keyscan_stop.

Clearing Windows Event Logs

Windows stores and catalogues all actions/events performed on the system and stores them in the Windows Event log. They are categorized based on the type of events they store:

• Application logs - stores application/program events like start-ups, crashes, etc.

• System logs - stores system events like start-ups, reboots, etc.

• Security logs - stores security events like password changes, authentication failures, etc.

Event logs can be accessed via the Event Viewer on Windows. It is very important to clear your tracks after the assessment as the event logs are the first stop for any forensic investigator after a compromise has been detected. To clear the event logs with meterpreter, all you have to do is type clearev. Note that you have to have administrator privileges to do this.

Pivoting

This is a post-exploitation technique that involves utilizing a compromised host to attack other systems on the compromised host's private internal network. After gaining access to the host, we can use the compromised host to exploit other hosts on the same internal network to which we could not access previously.

Since we have gained access to the first target, to pivot to the second target, we add a route using the following meterpreter command:

run autoroute -s 10.10.10.0/20 (replace with target_ip followed by subnet)

We can now run a port-scanning auxiliary module to run a scan from the first target system. Since we can see that port 80 is open and we'd like to scan it, we have to forward it to our system. We can do this from our meterpreter session on target 1.

portfwd add -l 1234 (our port to listen on) -p 80 (port to forward) -r 10.10.10.10 (target2_ip)

We can now run an Nmap scan within Metasploit on target 2.

db_nmap -sS -sV -p 1234 localhost

Since we can see that it is also running the Bad Blue service, we can exploit it, but we have to set the payload to a bind connection as a reverse connection will not work.

set payload windows/meterpreter/bind_tcp

---

Linux Post-Exploitation

Again, the objective is the same as we would do for Windows - but this time for Linux. We can enumerate some extra information on Linux systems via opening up a command shell:

Some Useful Windows Post-Exploitation Modules

Linux Privilege Escalation

Metasploit offers very little with regards to Linux kernel exploit modules, however, is some cases, there may be an exploit module that can be utilized to exploit a vulnerable service or program in order to elevate our privileges.

Once we have gained initial unprivileged access to the target system, let's upgrade our shell session to a meterpreter session and then spawn a bash session. Now, let's have a look at the process tree using the ps aux command.

We can see that there is a binary which is run by the root user. Let's cat out the contents of the /bin/check-down process. We can see that chrootkit is running. In this case, chrootkit is vulnerable to an exploit. We can use the Metasploit module to exploit it. We need to select the path to the chkrootkit path and run it. Then it will wait for the Cron job to run, and we will have elevated privileges.

Dumping Hashes with Hashdump

Hashdump is a post-exploitation module. It is a direct command within meterpreter that work on Windows systems but we will have to use the module for Linux systems.

Linux password hashes are stored in the /etc/shadow file and can only be accessed by the root user or a user with root privileges. The hashdump module can be used to dump the hashes from the /etc/shadow file and to unshadow the hashes for password cracking with John the Ripper.

Establishing Persistence

In order to establish persistence on a Linux system, you will require root privileges.

The first way to do this, is to set up a backdoor user that will allow us to reconnect to the system. This will only work if the system is running SSH. We can do this by opening up a bash shell.

useradd -m ftp (or other username) -s /bin/bash   <-- Create the user
passwd ftp                                        <-- Setting the password
usermod -aG root ftp                              <-- Adding user to root group
usermod -u 15 ftp                                 <-- Modifies the account ID

One Metasploit module we can use to establish persistence is cron_persistence or sshkey_persistence or service_persistence.

---

Metasploit GUIs

Armitage

Armitage is a free Java based GUI front-end for the Metasploit Framework. It's used to simplify network discovery, exploitation and post-exploitation.

Armitage requires the MSF database and the Metasploit backend services to be enabled and running in order to function correctly. It comes pre-packaged with Kali Linux. So once you have Metasploit started up and running, you can type armitage in the terminal to open it up.

---

That’s it for this section. Next one up is the CTF or skill check that iNE has put up.

— Hmad