TryHackMe — Windows PrivEsc WalkThrough
By: Aniket Badami
Tags: Infosec, Pentesting, PrintSpoofer.exe, Tryhackme, Privesc

Task is Service Exploits — Insecure Service Permissions

If our user has permission to change the configuration of a service which runs with SYSTEM privileges, we can change the executable the service uses to one of our own. “Potential Rabbit Hole: If you can change a service configuration but cannot stop/start the service, you may not be able to escalate privileges!”

We are going to use some tools which will allow us to automate the reconnaissance that can identify potential privilege escalations.

winPEAS is a very powerful tool that not only actively hunts for privilege escalation misconfigurations, but highlights them for the user in the results. AccessChk is an old but still trustworthy tool for checking user access control rights.You can use it to check whether a user or group has access to files, directories, services, and registry keys.

Will start our recon with winPEAS application which is already on the target machine. winPEAS can scrape a lot of information, so we restrict with some parameters. The below command will only search for services related misconfigurations on target machine.

winPEAS

Note: We have to run these commands from netcat session on Kali Linux.

Upon execution, it gives you a a lot of information and it is color coded and every color has a meaning. See below

Color Code

Let’s concentrate on red color to find first service related misconfiguration.

daclsvc misconfig

As you can see, there is a service called DACL which is misconfigured and we can take advantage of this to elevate our privileges. To do that, we need to switch the daclservice.exe with our reverse shell (rev.exe) and need to start the service manually. Before we switch the exe file, we need to find whether we have to permission to start the service or not. If we don’t have the permission then its a dead end.

To check available permission, we use accesschk application.

accesschk

Run above command to get the permission list. As you can see, we have permission to start and stop the service. So, we can definitely exploit this to gain elevated privileges.

-v verbose -w write access -q quite/omit banner -e Only show explicitly set Integrity Levels -c Windows service name

So, if we exploit this misconfiguration, then what kind of privilege we gain? To check that we can run below command.

service control manager

Using sc (service control manager) we can query the configuration information for a service. As you can see from the result, “SERVICE_START_NAME : LocalSystem”, we would get local system privileges upon successful exploit.

We also need to make sure whether the service is running or stopped at the moment. To do that run below command.

SC Query

As you can see, the service is stopped for time being. But, we have to permission to start it back.

So, now we switch the binary file with our own. To do that, run below command.

sc config

Make sure to use exact name of your binary file and give space after = . Now we switched the binary file with ours. Now we need to start another netcat listener on kali machine. To do that open a new tab/window and run bellow command.

netcat listener

We are using the same reverse shell (rev.exe) file so, we have to use same port#.

Our listener is set, now from remote command prompt, run below command to start the daclsvc service.

start daclsvc

The moment you run that command, you’d get a reverse connection from target OS on second netcat listener.

elevated privilege

As you can see, we now have system level access on target machine. We got this successfully by exploiting a service misconfiguration.

What is the original BINARY_PATH_NAME of the daclsvc service?

Find the answer from service control manager

Exit the second netcat session (system).