3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

Ethical Hacking Blog (http://ethicalhackingblog.com/)

A Simple Way To Learn Cyber-Security

(http://ethicalhackingblog.com/)

Practical Privilege Escalation Using Meterpreter

 August 31, 2017 (http://ethicalhackingblog.com/2017/08/31/)  GusKhawaja
(http://ethicalhackingblog.com/author/ghassankhawaja/)

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 1/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

Practical Privilege Escalation Using Meterpreter

A privilege escalation is a big challenge when you have a Meterpreter session opened with your victim
machine. In this tutorial, I will show you a practical way to elevate your privileges and become admin
accurately without hesitation.

So, let’s see what this tutorial lab will look like.

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 2/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/Slide2.png)

My attacker host will be a Kali Linux of course, then I will use the Social Engineer toolkit to generate a
Meterpreter payload. Probably you’re asking yourself, why Am I using the social engineer toolkit and not
using Metasploit directly. Well, the social engineer toolkit will use Metasploit anyway and it will automate
everything for you.

Next, we will send the payload to the windows 7 machine and infect it by executing the malicious le. At this
stage, we will have a Meterpreter session opened and from there I will show you how to elevate your
privileges to be an admin on the victim machine remotely.

Let’s start.

Demo

Open your terminal window and execute the social engineer toolkit, using the setoolkit command.

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_04_setoolkit.png)

Next, choose option number one, for the social engineering attacks.

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 3/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog




(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_05_setoolkit.png)

To create a Meterpreter payload you will choose option number 4 which is to create a payload and listener,
the name is pretty clear and it’s self-explanatory.

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_06_setoolkit.png)

In this area, I will be using the Windows Reverse TCP Meterpreter, which is option number 2.

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 4/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_07_setoolkit.png)

Next, I need to write my Kali IP address which is 192.168.0.102

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_08_setoolkit.png)

Next, SET is asking me for the port that I will be listening on my Kali machine.

I will choose the port number 443. I like this port because it’s https and rewalls will not block it in a real-life
scenario.

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_09_setoolkit.png)

Check this out, the payload is saved in this directory.

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_10_setoolkit.png)

Next, I will say yes to start the listener now using Metasploit.

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_11_setoolkit.png)

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 5/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

Wait for few seconds and the social engineer toolkit will start the Metasploit framework. After that,
Metasploit will execute few commands to start the listener.

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_12_setoolkit.png)

Do you how easy this is! I will open a new terminal window to show you the location of this le. First, in my
home root directory, I will list its contents. I will use the -a option to show the hidden les as well.

(http://ethicalhackingblog.com/wp-

content/uploads/2017/08/0001_13_setoolkit.png)

And somewhere down here I have the set folder, it starts with a dot which means that this folder is hidden by
default.

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 6/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_14_setoolkit.png)

Let’s open it and check its contents, and voila this is the payload le that we need to copy over the windows 7
host.

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_15_setoolkit.png)

On the victim machine, all I need is to double click on this le to infect it (execute it).

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 7/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_16_setoolkit.png)

Let’s go back to the Kali host, here you go we have a Meterpreter session opened.

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_17_setoolkit.png)

To interact with this session type sessions -i followed by its ID number. I know it’s 1 because we only have one
session opened so logically speaking the ID will be one.

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 8/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_18_setoolkit.png)

Let me show you the work ow of Meterpreter Escalation Privilege before we proceed.

First, you will need to list the processes on the windows machine and pick one to migrate to that process.

After this, I will check the user I’m logged on with to have an idea about who I am.

Finally, we will execute the getsystem command to elevate our privilege, let’s see if this is going to work.

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/Slide3.png)

Let’s go back to Kali. To list all the processes on the windows 7 machine I will use the PS command.

(http://ethicalhackingblog.com/wp-

content/uploads/2017/08/0001_19_setoolkit.png)

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 9/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

Next, I will locate the explorer.exe process and note its ID. Let’s migrate to this process:

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_20_setoolkit.png)

Let’s take a look at the user that we’re using to log on by executing the getuid command.

(http://ethicalhackingblog.com/wp-

content/uploads/2017/08/0001_21_setoolkit.png)

I will switch to the command prompt using the shell command to get more information about this user.

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_22_setoolkit.png)

It looks like that it is a member of the local administrator’s group.

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 10/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_23_setoolkit.png)

Wait don’t party yet, this doesn’t mean that we’re there yet.

Let’s go back to the Meterpreter prompt and try to see if we can elevate our privileges, rst I will execute the
use priv command and then the getsystem command.

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_24_setoolkit.png)

Check this out, the operation has failed to execute. What now, right? After all these hassles and now we’re
stuck.

Don’t worry I have a solution for you and it’s not Meterpreter, in fact, you need a powerful post-exploitation
technique because Meterpreter is probably good for windows XP but now this operating system is a history.
So, what is the solution, Gus? Well! You need PowerShell and there is a tool that o ers post exploitation using
PowerShell and it’s called EMPIRE! I already have a dedicated tutorial about this tool, check it out.

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 11/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

So, I’ll open my terminal window and browse to the empire folder located at my home root directory.

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_25_setoolkit.png)

If I list its contents I will see that the executable is here and waiting for my commands. Let’s execute this
monster!

(http://ethicalhackingblog.com/wp-

content/uploads/2017/08/0001_26_setoolkit.png)

Since this is a fresh copy and I have 0 listeners and 0 agents active at this moment.

(http://ethicalhackingblog.com/wp-content/uploads/2017/07/07_home_screen.png)

Not a problem, let’s start! First, Type listeners to switch to the listeners mode.

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 12/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

(http://ethicalhackingblog.com/wp-

content/uploads/2017/07/08_listeners.png)

Second, I will use the http listener (using the uselistener command then the execute command) and I will type
listeners one more time to list my active listeners.

(http://ethicalhackingblog.com/wp-content/uploads/2017/07/09_listeners_info.png)

Here you go we have a listener active at this stage. Now, I need to generate my PowerShell script that I need
to infect the window seven machine.

Type Launcher then the language name PowerShell and the listener name is HTTP.

(http://ethicalhackingblog.com/wp-content/uploads/2017/07/011_launcher_powershell.png)

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 13/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

Awesome, all I need to do now is to copy this fancy script and then go back to the Meterpreter session and
paste there but rst let’s switch into the command prompt (using the Shell command).

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_27_setoolkit.png)

And we’re done! Close this useless Meterpreter session because we don’t need it anymore.

On the Empire side, we can see that we have an agent active:

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_28_setoolkit.png)

Next, press enter and type agents to list the active agents. Let’s rename the agent to something more
meaningful, and start interacting with the Non-Admin Agent.

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 14/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_29_setoolkit.png)

If I show the options using the info command you will realize that the High Integrity is set to 0 and this means
that we’re not admin.

(http://ethicalhackingblog.com/wp-
content/uploads/2017/08/0001_30_setoolkit.png)

(http://ethicalhackingblog.com/wp-content/uploads/2017/07/019_info_agent1.png)

To elevate our privileges at this moment all I need is to execute the magical command bypassuac followed by
the listener name. Pay close attention to this message, we have a second agent active, let’s see the
information about this new guy. Check this out we have an asterisk before the user name and that means it’s
an admin!

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 15/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_31_setoolkit.png)

Let’s rename the new agent and interact with it.

(http://ethicalhackingblog.com/wp-

content/uploads/2017/08/0001_32_setoolkit.png)

I will double check to see if it’s really an admin (using the info command), and you bet I’m right because the
High Integrity is set to one.

(http://ethicalhackingblog.com/wp-content/uploads/2017/07/023_highintegrity.png)

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 16/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

Let’s have some fun and extract the accounts credentials using Mimikatz.

(http://ethicalhackingblog.com/wp-

content/uploads/2017/07/025_mimikatz.png)

Be patient for few seconds before Mimikatz executes and nishes extracting all the passwords. Exciting!
When you see the bye here it means we’re done, so press enter on your keyboard,

(http://ethicalhackingblog.com/wp-

content/uploads/2017/08/0001_33_setoolkit.png)

let’s see the credentials using the creds command.

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 17/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

(http://ethicalhackingblog.com/wp-content/uploads/2017/08/0001_34_setoolkit.png)

What a beautiful piece of art, check out these cleartext passwords.

It's only fair to share... (http://www.facebook.com/sharer.php?

u=http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/)
(https://plus.google.com/share?url=http://ethicalhackingblog.com/practical-privilege-
escalation-using-meterpreter/) (http://twitter.com/share?
url=http://ethicalhackingblog.com/practical-privilege-escalation-using-
meterpreter/&text=Practical%20Privilege%20Escalation%20Using%20Meterpreter%20)
(http://www.linkedin.com/shareArticle?
mini=true&url=http://ethicalhackingblog.com/practical-privilege-escalation-using-
meterpreter/)

 Ethical Hacking (http://ethicalhackingblog.com/category/ethical-hacking/), Exploiting

(http://ethicalhackingblog.com/category/exploiting/), Post-Exploitation (http://ethicalhackingblog.com/category/post-
exploitation/)  Empire (http://ethicalhackingblog.com/tag/empire/), Ethical Hacking
(http://ethicalhackingblog.com/tag/ethical-hacking/), Metasploit (http://ethicalhackingblog.com/tag/metasploit/), Meterpreter
(http://ethicalhackingblog.com/tag/meterpreter/), Post-Exploitation (http://ethicalhackingblog.com/tag/post-exploitation/),
PowerShell (http://ethicalhackingblog.com/tag/powershell/)

 Post-Exploitation with PowerShell Empire 2.0 Hacking Blogs 

(http://ethicalhackingblog.com/hacking-powershell- (http://ethicalhackingblog.com/hacking-blogs/)
empire-2-0/)

Search...

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 18/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

Recent Posts

 Building A Password Cracking Machine With 5 GPU (http://ethicalhackingblog.com/building-a-password-cracking-

machine-with-5-gpu/)
 Learning The Social Engineer Toolkit (http://ethicalhackingblog.com/learning-social-engineer-toolkit/)
 Hacking Blogs (http://ethicalhackingblog.com/hacking-blogs/)
 Practical Privilege Escalation Using Meterpreter (http://ethicalhackingblog.com/practical-privilege-escalation-
using-meterpreter/)
 Post-Exploitation with PowerShell Empire 2.0 (http://ethicalhackingblog.com/hacking-powershell-empire-2-0/)

Archives

 January 2018 (http://ethicalhackingblog.com/2018/01/)

 October 2017 (http://ethicalhackingblog.com/2017/10/)
 August 2017 (http://ethicalhackingblog.com/2017/08/)
 July 2017 (http://ethicalhackingblog.com/2017/07/)
 May 2017 (http://ethicalhackingblog.com/2017/05/)
 November 2016 (http://ethicalhackingblog.com/2016/11/)
 October 2015 (http://ethicalhackingblog.com/2015/10/)
 September 2015 (http://ethicalhackingblog.com/2015/09/)
 August 2015 (http://ethicalhackingblog.com/2015/08/)
 May 2015 (http://ethicalhackingblog.com/2015/05/)
 March 2015 (http://ethicalhackingblog.com/2015/03/)
 February 2015 (http://ethicalhackingblog.com/2015/02/)

Categories

 Cryptography (http://ethicalhackingblog.com/category/cryptography/)
 Ethical Hacking (http://ethicalhackingblog.com/category/ethical-hacking/)
 Exploiting (http://ethicalhackingblog.com/category/exploiting/)
 General (http://ethicalhackingblog.com/category/general/)
 Movies (http://ethicalhackingblog.com/category/movies/)
 Password Cracking (http://ethicalhackingblog.com/category/password-cracking/)
 Penetration test report (http://ethicalhackingblog.com/category/penetration-test-report/)
 Post-Exploitation (http://ethicalhackingblog.com/category/post-exploitation/)
 Social Engineering (http://ethicalhackingblog.com/category/social-engineering/)
 Uncategorized (http://ethicalhackingblog.com/category/uncategorized/)
 Website Security (http://ethicalhackingblog.com/category/website-security/)

Follow Us

 (https://www.facebook.com/EthicalHackingBlog/) (https://twitter.com/GusKhawaja)

 (https://www.youtube.com/channel/UCMGEw2H8AyjE0hprq7zxZmg)

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 19/20
3/16/2018 Practical Privilege Escalation Using Meterpreter - Ethical Hacking Blog

 (https://www.linkedin.com/in/guskhawaja?
lipi=urn%3Ali%3Apage%3Ad_ agship3_pro le_view_base%3B1OXrSZUYTAGVsN%2FklX%2BvZA%3D%3D)

 (http://www.speci cfeeds.com/follow)

Meta

 Log in (http://ethicalhackingblog.com/wp-login.php)
 Entries RSS (Really Simple Syndication) (http://ethicalhackingblog.com/feed/)
 Comments RSS (Really Simple Syndication) (http://ethicalhackingblog.com/comments/feed/)
 WordPress.org (https://wordpress.org/)

© 2018 All rights reserved

http://ethicalhackingblog.com/practical-privilege-escalation-using-meterpreter/ 20/20