I still cannot understand one concept of Windows system exploitation.

There are many ways to get a shell on Windows machine - BO exploit, Web reverse shell, .exe launch. After that you gain a non-interactive cmd.exe version without any credentials.

Many local privilege escalation exploits require interactive/RDP environment e.x. to create second cmd window with system rights.

I can't understand how to overstep that gap between these two points. In most cases it's not a problem to route traffic to even firewalled 3389, but still - you do not know user's creds.

What are the possible ways to create interactive shell in such scenario?

  • "you gain a non-interactive cmd.exe version without any credentials" - why do you not gain an interactive shell? Why can't you use the permissions of user/account that launched the shell? I think that you are skipping over a lot of steps and that's why you are seeing a gap. – schroeder Jun 13 '18 at 6:48
  • Example: msf payload windows/x64/shell_reverse_tcp, it spawns cmd.exe process to you via defined TCP connection. But you cannot use interactive command in here, such as ftp or powershell, that drops you to their own interpreters. This access is way more limited that native cmd.exe window, often called as "non-interactive". What you think about as "interactive shell"? meterpreter? And yes, all the programming logic I execute is launched with user privileges that holds the shell creation process. But in this scenario it's only regular user on box without administrative privileges. – dtrizna Jun 13 '18 at 9:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.