Adventures in Limited User Post Exploitation

Presented at Black Hat USA 2010, July 28, 2010, 1:45 p.m. (75 minutes).

Just how much damage *can* be done with EIP under a non-Administrative Windows environment? Much, much more than you likely think. Through new techniques and live examples, attendees will be guided through the modern day attack surface of a restrictive corporate Windows world. Based purely on the Windows privilege model, demonstrations and new code will cover techniques related to collecting and replaying passwords and password hashes, destroying the browser trust model, attacking the network and the domain, and more, all without administrative access. Moving into a world of Windows Vista, 7, and hardened XP environments, the days of easily popping shells with Admin access are becoming less common. When a Limited User is exploited via a client side vulnerability, damage is often believed to be lessened due to the inability of attacker code to access sensitive portions of the OS, such as those containing passwords and password hashes, without an additional privilege escalation exploit. Despite conventional wisdom from vendors and security press, taking your users out of the 'Local Administrators' OU doesn't mean your environment is magically protected from privilege-agnostic attackers.

Presenters:

• Nathan Keltner / Natron   as Nathan Keltner
• Tim Elrod

Links:

• https://www.blackhat.com/html/bh-us-10/bh-us-10-archives.html#Keltner
• https://media.blackhat.com/bh-us-10/whitepapers/Keltner/BlackHat-USA-2010-Keltner-Elrod-Adventures-In-Limited-User-Post-Exploitation-wp-v1.3.pdf

Similar Presentations:

• DEF CON 22 (2014) / Acquire current user hashes without admin privileges
• Wild West Hackin' Fest 2019 / Elevating your Windows privileges like a boss!
• DEF CON 31 (2023) / #NoFilter: Abusing Windows Filtering Platform for privilege escalation