Book Image

Privilege Escalation Techniques

By : Alexis Ahmed
5 (2)
Book Image

Privilege Escalation Techniques

5 (2)
By: Alexis Ahmed

Overview of this book

Privilege Escalation Techniques is a detailed guide to privilege escalation techniques and tools for both Windows and Linux systems. This is a one-of-a-kind resource that will deepen your understanding of both platforms and provide detailed, easy-to-follow instructions for your first foray into privilege escalation. The book uses virtual environments that you can download to test and run tools and techniques. After a refresher on gaining access and surveying systems, each chapter will feature an exploitation challenge in the form of pre-built virtual machines (VMs). As you progress, you will learn how to enumerate and exploit a target Linux or Windows system. You’ll then get a demonstration on how you can escalate your privileges to the highest level. By the end of this book, you will have gained all the knowledge and skills you need to be able to perform local kernel exploits, escalate privileges through vulnerabilities in services, maintain persistence, and enumerate information from the target such as passwords and password hashes.
Table of Contents (18 chapters)
1
Section 1: Gaining Access and Local Enumeration
6
Section 2: Windows Privilege Escalation
12
Section 3: Linux Privilege Escalation

Cracking Windows hashes

We can now use the password hashes we dumped in the previous section for legitimate authentication. However, before we do that, we still need to crack these hashes to obtain the cleartext passwords.

This section will be split into two main subsections. The first part will go over the process of cracking Windows password hashes with John the Ripper, while the second subsection will cover the process of authentication.

Before we can begin dumping and cracking password hashes, we need to take a look at the structure of a typical Windows hash.

As highlighted in the following screenshot, the hash ID is broken down into four sections:

Figure 7.24 – Hash structure

The four sections can be further classified as follows:

  • The first section is the username.
  • The second section is the unique RID.
  • The third section is the LM hash.
  • The fourth section is the NTLM hash.

Now that we understand what makes up...