Book Image

Privilege Escalation Techniques

By : Alexis Ahmed
5 (2)
Book Image

Privilege Escalation Techniques

5 (2)
By: Alexis Ahmed

Overview of this book

Privilege Escalation Techniques is a detailed guide to privilege escalation techniques and tools for both Windows and Linux systems. This is a one-of-a-kind resource that will deepen your understanding of both platforms and provide detailed, easy-to-follow instructions for your first foray into privilege escalation. The book uses virtual environments that you can download to test and run tools and techniques. After a refresher on gaining access and surveying systems, each chapter will feature an exploitation challenge in the form of pre-built virtual machines (VMs). As you progress, you will learn how to enumerate and exploit a target Linux or Windows system. You’ll then get a demonstration on how you can escalate your privileges to the highest level. By the end of this book, you will have gained all the knowledge and skills you need to be able to perform local kernel exploits, escalate privileges through vulnerabilities in services, maintain persistence, and enumerate information from the target such as passwords and password hashes.
Table of Contents (18 chapters)
1
Section 1: Gaining Access and Local Enumeration
6
Section 2: Windows Privilege Escalation
12
Section 3: Linux Privilege Escalation

Dumping Windows hashes

In this section, we will take a closer look at Windows passwords and how they are hashed. The hash dumping process on Windows can be performed by using various techniques and tools, most of which we will explore in this section. Before we begin using any tools or techniques, we need to take a brief look at how Windows passwords are stored.

SAM database

Security Account Manager (SAM) is a database that is responsible for managing user accounts and passwords on Windows. All the passwords that are stored in the SAM database are hashed. Authentication and verification of user credentials is facilitated by the local security authority (LSA).

The SAM database is stored in the Windows Registry and can be accessed from the following location:

HKEY_LOCAL_MACHINE\SAM

Now that we know where Windows user credentials are stored, we need to take a closer look at LanMan (LM) and NTLM authentication.

LM and NTLM hashing

LM is an authentication protocol...