2017-2018-2 20155315 "cyber-confrontation Technology": Windows Rights Waiver

Principle

• After the target machine is successfully connected using Metasploit, further attacks require elevated operation permissions. For a lower-version Windows system, using Getsystem at the time of the connection is successful, but will be rejected for higher system operations. To get full access to the compromised machine, you need to bypass the restrictions and get some permissions that you don't have, which can be used to delete files, view private information, or install special programs such as viruses.
• Metasploit has a number of post-infiltration methods that can be used to bypass permissions on the target machine and ultimately gain access to the system.

Uac

User Account Control, UAC, is an important new security feature for Windows Vista. With UAC, applications and tasks can always run in the security context of a non-administrator account, unless the administrator specifically grants administrator-level access to the system. UAC prevents unauthorized applications from automatically installing and prevents inadvertent changes to system settings.

• Bypassuac is a tool that uses Windows system built-in autoelevate backdoor to compromise Windows user Account Control (UAC) mechanism.

Process

• kali:192.168.19.130
• win7:192.168.19.133
• First of all, the process of the malicious program to other programs, here to choose IE Browser, as long as the computer is still open, back to the connection will not be interrupted.
• The goal of practice is to bypass UAC to raise rights
• To place a session in the background:background
• Search local/bypassuac Module
• Can see a lot of new modules, that will be the more new modules the easier to succeed?
• Select windows/local/bypassuac_fodhelper Settings Session set session 6 is not running successfully
• Select windows/local/bypassuac_injection_winsxs Run not successful
• It doesn't seem that the more new the easier it is to succeed
• Try it.
• Select windows/local/bypassuac_injection , view parameters
• After running or not succeeding
• Build up, use windows/local/bypassuac , set up a session, get the right success

Summarize

The power of Windows is a terrible thing, and once an attacker has administrator privileges, it can do anything. Windows may modify the registry, steal secret files and so on, while attacking can also hide themselves, modify the directory files to erase their own traces of intrusion. Therefore, in order to avoid the right to be raised, regular patching, upgrading the system, to avoid being the object of attack.

Resources

• Metasploit under Windows Multiple right-of-way
• Msf_bypassuac the right to withdraw

2017-2018-2 20155315 "cyber-confrontation Technology": Windows Rights Waiver