nerdexam
GIAC

GPEN · Question #480

A penetration tester used a client-side browser exploit from metasploit to get an unprivileged shell prompt on the target Windows desktop. The penetration tester then tried using the getsystem command

The correct answer is B. Run getuid command, then getpriv command, and try getsystem again. When getsystem fails in Meterpreter, running getuid to confirm user context and getprivs to enumerate and enable token privileges can expose missing privileges needed for local privilege escalation to succeed.

Exploitation & Post-Exploitation Techniques

Question

A penetration tester used a client-side browser exploit from metasploit to get an unprivileged shell prompt on the target Windows desktop. The penetration tester then tried using the getsystem command to perform a local privilege escalation which failed. Which of the following could resolve the problem?

Options

  • ALoad priv module and try getsystem again
  • BRun getuid command, then getpriv command, and try getsystem again
  • CRun getuid command and try getsystem again
  • DUse getprivs command instead of getsystem

How the community answered

(35 responses)
  • A
    3% (1)
  • B
    83% (29)
  • C
    11% (4)
  • D
    3% (1)

Why each option

When getsystem fails in Meterpreter, running getuid to confirm user context and getprivs to enumerate and enable token privileges can expose missing privileges needed for local privilege escalation to succeed.

ALoad priv module and try getsystem again

In modern Metasploit, priv extension functionality is built into Meterpreter by default and does not need to be loaded separately, so this step alone does not address why getsystem failed.

BRun getuid command, then getpriv command, and try getsystem againCorrect

Running getuid first confirms the current user context of the Meterpreter session, while getprivs (the answer abbreviates this as 'getpriv') enumerates and attempts to enable all privileges on the current process access token. Some escalation techniques used by getsystem require specific token privileges such as SeDebugPrivilege to be enabled; running getprivs can activate these dormant privileges, allowing a subsequent getsystem call to succeed.

CRun getuid command and try getsystem again

Running getuid only reveals the current username and does not enable or modify token privileges, so getsystem would still fail for the same underlying reason.

DUse getprivs command instead of getsystem

The getprivs command lists and attempts to enable privileges on the current token but does not itself perform escalation to SYSTEM, so it cannot replace getsystem.

Concept tested: Meterpreter local privilege escalation with getsystem and token privileges

Source: https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-basics.html

Topics

#Metasploit#privilege escalation#getsystem#Meterpreter

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice