System Privilege Escalation by Obtaining windows Patch Information

Overview

• Privilege escalation through overflow vulnerabilities elevates privileges by exploiting vulnerabilities at the target operating-system layer. During penetration testing, privilege escalation usually begins after obtaining a Shell on the target machine.
• The steps are: obtain the target machine's patch information -> identify the corresponding vulnerabilities from the patch information -> exploit the vulnerabilities

Obtain the Target Machine's Patch Information

View Patch Information Through wmic

wmic qfe get Caption,description,hotfixid,installedon

Use windows-exploit-suggester to Help Discover Vulnerabilities

• First, open powershell, use the systeminfo command to obtain system information, and save it to a local txt file

systeminfo > systeminfo.txt

• Download the windows-exploit-suggester tool. The download address is as follows:

https://github.com/AonCyberLabs/Windows-Exploit-Suggester

• Use windows-exploit-suggester to download the latest public Microsoft vulnerability database to a local xls file. Note that python2 is used here

python2 windows-exploit-suggester.py --update

• Then compare the xls vulnerability-database file downloaded by windows-exploit-suggester with the systeminfo.txt file to discover possible vulnerabilities

python2 windows-exploit-suggester.py --database 2022-01-21-mssb.xls  --system systeminfo.txt

Exploit Possible Vulnerabilities to Escalate Privileges

windows Privilege-Escalation Vulnerability Exploitation Tool

https://github.com/SecWiki/windows-kernel-exploits/ # 项目地址

• This project integrates most EXPs for windows overflow-vulnerability privilege escalation, and they can be used directly.

Exploits for Common System Versions

Windows2003：pr、巴西烤肉、2018-8020
Windows2008：利用 ms16-075劫持token
Windows 2012/2016：ms18-8120