OK so the next couple of videos are going to talk about Path escalations.
One being the binary path or the bin path and the other being the UN quoted service path.
Now these are common.
You will see these in CTF style games and in labs et cetera.
So pay close attention on how we enumerate these and how we find these types of exploits.
Now in the detection here for the binary parts what we're seeing is that it's kind of already giving
it to us and we're going to go a little bit above that.
Now we can actually use power up.
So if we go to our machine and we say hey power up I want to know what you can find.
We'll let that run really quick.
So let's go ahead and just shift right click and open a command window here.
And what I'm going to say is.
Power show execution policy bypass we'll quickly load up power up and then we'll run the invoke called
checks now while this is running.
Let's go ahead and look at a more manual method and we'll talk about what the binary path is.
So let's do a command prompt and what we'll say here is we're going to run axis checks.
Let's see these over to our desktop and then tools and access check and we're just gonna run access
check 64 and we're going to give it the following switches.
We're going to give it a U W C V and we're gonna say everyone with a Asterix or a wildcard and this
should have a space here.
I'm sorry.
So before I hit enter let's talk about what we're doing with Axis check.
We are looking for a few things.
The U is going to say hey let's suppress the air so we don't want to see any errors when we're doing
this checks we just want to bring back only the positive findings with the W We only want to show the
objects that have write access so we're not going to show anything where we cannot write to and the
C is gonna say hey I want you to display the service name for this and the v is verbose so let's go
ahead and enter and what I'm doing to as I'm saying everyone as a group so everybody on this computer
what can everybody do and where do we have right access as everyone and you're gonna see we have read
right to this a d ACL service and if we go look through our power up really quick it should show up
in here as well so you're going to see that we're going to have the service permissions and we have
DSL service and we can invoke service abuse name D ACL service you can give that one a try if you want
the big thing is here is we can restart the service that's important because if we can restart the service
we control it so if it's running right now we have the ability to add something militias and then restart
it.
Super important there on top of that if we look a little bit above we'll see that we have unquote in
service pass which we'll get to hear in the next video so make sure you know that these exist too but
back to the binary path and let's scroll down just a little bit we have the service provisions for this
DSL service we we bring this up and we should query this just a little bit further.
So what we can do is we can just say something like access check 64 to see and we'll make these same
kind of call oh we'll just do a w you the C same thing again and we'll say D A C L SBC.
So now we found this we're just going to run the same thing but we're gonna run it against the service
itself and we're gonna see a little bit more information here we could see read write for everybody
and we see also that we have this service change config which was in the other one as well so we can
change the configuration here but it's always good to see the whole settings as to what everybody has.
So why do we pull everyone will we put everyone because that's our group we could have pulled on administrators
we could have pulled on authority system but we want to see where everybody has.
So remember we pulled down who has right access to a wild card so the only thing that came back was
this DSL service we have changed config status which means we can change the configuration.
Now how can we do that let's go ahead and query the service so we'll say SC QC we'll say D ACL SPC
in you're gonna see that we have this binary path name which is calling out this ACL serve as well because
we have the change config we can actually change its configuration of what you're seeing here.
So let's go ahead and get malicious let's change the configuration so what we're gonna do is we're going
to say S C config and we're gonna say D.
ACL S.V. C and we're gonna say bin path is equal to and we'll say net local group administrators user
at and it says success.
So let's query one more time you can see that net local group administrators user ad.
Now let's go ahead and just do a net local group administrators and you'll see that administrators and
TCM is just the only two in here right now.
So let's go ahead and say SC start DACA.
SPC let's do a net real quick.
We might get in there and actually have this working and we do.
So the air threw me off there for a second but the the air is fine.
We're not starting anything because we remove the application.
So if you see through here the ACL service that you see there's nothing to start anymore.
So what we're doing is just running a command and you're gonna see an error here.
So here we go.
The user has been added in and we can tell now we are part of the administrator's group.
So we have successfully elevated the privileges using the bin path exploit so in the next video we're
gonna do is we're going to focus instead on the escalation using unquote ad service parts.
So let's go ahead and meet me in the next video and we directly move on to the unquote service.
Beth.