3

I have a few computers at home on which i hack for fun. Until now google has been able to answer my questions. But now I need your help. What ways are there to elevate from a non-admin user to NT system? Source code, how to's and explenation on how they operate would be awesome!

3
  • 3
    Hi @filip I'm afraid this isn't the place to come for exploit code. We can give answers on protection strategy and explanation of technique, but we avoid the black hat end of things. A quick google will get you lots of exploits anyway.
    – Rory Alsop
    Oct 2, 2011 at 16:15
  • 4
    I would add that "what are some" generally asks for a list, and that such a list is likely to be out of date very, very quickly. Generally, an exploit targets a specific process running in the desired privilege and injects code through that exploit. So it depends entirely on whether there is a bug and how long the bug stays unpatched.
    – user2213
    Oct 2, 2011 at 16:31
  • @Rory Isn't this qualified as white-hat since i have permission (my own computers) to to this? I am doing this to learn entry points. If I know how some exploit works then I'll have a better chance of stopping it. Oct 2, 2011 at 19:02

4 Answers 4

3

Firstly, there's the runas application, which allows you to impersonate any user on a system. Just pass the call to the program you want to run through runas and it can be run with any user you like.

Secondly, there's the WindowsIdentity class for .NET which allows you to impersonate users if you have sufficient rights.

WinAPI also features some functions to create processes for a user different than the one executing the current process, see the CreateProcessAsUser function for further details.

1
  • Worth noting that while runas does let you impersonate a different user, it doesn't allow elevation. ss64.com/nt/runas.html "RunAs is not able to launch an application with an elevated access token." "The RunAs command predates elevation, so it has no switch for running an elevated command." Mar 29, 2021 at 16:34
2

One of the more common ways that a security tester would use to try and escalate privileges using something like Metasploit.

Using Metasploit you can deploy a meterpreter payload to the target system and then use the getsystem command to attempt to escalate to administrator. This command uses a number of techniques under the hood, but as it's all open source you can read the relevant Metasploit files to get the details.

1
  • i know metasploit. It was actually the reason to this question since their getsystem has multiple ways of doing this. The file i found (way #1 or something like that) tho was a .dll = quite hard to inspect. Will check out the source next week to see if i can find it. Oct 2, 2011 at 19:23
1

nmap your 3rd party apps for versions and look at sites such as securityfocus and exploit-db or even pre-built metasploit exploits for escalations.

3rd party apps that run under higher privs can be a goldmine

There's a million ways to find privilege escalations .. you just need to look around .. run a nessus scan to look for weaknesses

You should do the offensive-security pen testing course .. it will answer all your questions :)

1
  • A bit too buzy for that right now tho :/ Gonna do it sometime Oct 6, 2011 at 16:41
0

Recent research at Google Project Zero has unearthed a fascinating privilege escalation method (Microsoft's CTF protocol). He even developed a scripting tool to exploit it.

This method exploits weaknesses in the system that allows windows with varying privileges to message one another. The article details the reverse engineering and debugging steps he used to find this technique.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.