Hackfast Offensive Security Documentation

The kernel is the core intermediary between application software and physical hardware. In Windows, exploiting a kernel vulnerability can allow an attacker to escalate privileges to SYSTEM, which is the highest level of access available on the operating system.

Warning: Kernel exploits are considered a last resort. They are inherently unstable and can frequently cause system crashes (BSOD) or only succeed once before the system becomes unusable.

CrackMapExec (CME) is an open-source post-exploitation tool designed for penetration testers to perform network-level attacks and enumeration, specifically within large Active Directory (AD) environments.

Key Functionalities:

• Enumerating Users and Groups: Lists AD objects like users and groups.
• Password Spraying: Tests a single password against multiple accounts.
• Command Execution: Executes commands remotely on target systems.
• Dumping Hashes: Extracts password hashes from remote systems.
• Accessing Shares: Lists and accesses SMB shares.

SeTakeOwnershipPrivilege is a Windows privilege that grants a user the ability to take ownership of any securable object. This includes Active Directory objects, NTFS files/folders, printers, registry keys, services, and processes.

Assigning this privilege provides WRITE_OWNER rights, which allows the user to modify the owner within the object's security descriptor. While typically held by administrators, it may be assigned to specific service accounts.

Before attempting injection, determine the execution context to know how to break out of the existing command string:

• Quoted Context: If the input is wrapped in quotes (e.g., " or '), you must first break out of the quotes before appending your command.
• Unquoted Context: If the input is not quoted, commands can be directly appended to the existing command string.

If an application validates file types using magic bytes (e.g., via PHP's mime_content_type), you can bypass these checks by prepending the magic bytes of a permitted file type to your malicious file.

Applications that perform custom image processing or file manipulation on uploaded filenames may be vulnerable to command injection. Injecting shell metacharacters into the filename can trigger Remote Code Execution (RCE).

Example Payloads:

• a$(whoami)z.jpg -> Executes whoami
• a;sleep 30;z.jpg -> Causes a 30-second delay (tests for injection)
• a$(id)z.jpg -> Executes id
• a$(cat /etc/passwd)z.jpg -> Executes cat /etc/passwd

DLL hijacking occurs when an attacker manipulates the resolution of Dynamic Link Libraries (DLLs). In the context of Windows services, this works through several mechanisms:

• Privilege Inheritance: Services load DLLs with the same privileges as the service itself. Controlling the DLL allows code execution at that privilege level.
• Absolute Path Vulnerability: If a service is configured to load a DLL from a directory that is writable by a lower-privileged user, the user can replace the legitimate DLL with a malicious one.
• Search Order Exploitation: If an application fails to find a required DLL, Windows searches through a specific order of directories. An attacker can place a malicious DLL in a directory that appears earlier in the search order than the legitimate one.

SUID (Set Owner User ID) and SGID (Set Group ID) are special executable permissions that change the privilege context of a process during execution:

• SUID (Set User ID): When executed, the file runs with the privileges of the file owner instead of the user who launched it. This is commonly used for tasks requiring elevated privileges.
• SGID (Set Group ID): When executed, the file runs with the privileges of the file group.

Security Note: Environment variables like LD_PRELOAD and LD_LIBRARY_PATH are ignored by the system when executing SUID binaries to prevent library hijacking and security breaches.

The /etc/sudoers file defines how sudo privileges are granted. Common patterns include:

• (ALL : ALL) ALL: Allows running any command as any user or group.
• (ALL : ALL) /some/program: Restricts sudo usage to a specific program.
• (root) NOPASSWD: ALL: Allows running any command as root without a password.
• (user) /some/program: Allows a specific user to run a specific program.

In Windows environments, service security is governed by Access Control Lists (ACLs). These ACLs define the specific actions (such as starting, stopping, or modifying configuration) that a user can perform on a service. If these permissions are misconfigured, they can be leveraged for privilege escalation.

Critical Pre-exploitation Check: Before attempting to exploit a service, verify that you have sufficient permissions to not only modify the service configuration but also to stop and start the service. If you can modify the configuration but lack the permission to control the service state, the privilege escalation attempt will likely fail.

Cron jobs are managed via two primary types of crontabs:

1. System Crontab: Used for system-wide jobs. The default configuration file is located at /etc/crontab.
2. User Crontab: Used for user-level jobs. These are created and edited using the crontab -e command and are stored in /var/spool/cron/crontabs.

Note on Visibility: User crontabs created via crontab -e are considered "hidden cron jobs" because they are only visible to the user who created them. Standard users cannot access the /var/spool/cron/crontabs directory or enumerate these jobs through standard means; they must use the crontab command to view their own.