The $env:PATH less Traveled is Full of Easy Privilege Escalation Vulns

Presented at DEF CON 22 (2014), Aug. 8, 2014, 12:30 p.m. (30 minutes)

15 years after APT was released for Linux, Microsoft is finally going to ship Windows with a package manager! Windows PowerShell OneGet is the easiest and fastest way to install applications and will be a fundamental part of how Microsoft wants you to administer your enterprise. In this talk we will go over OneGet, Nuget and Chocolatey and observe some of the security problems that will have to be overcome before widespread adoption. We will go over the hundreds of privilege escalation vulnerabilities that were found in the over 1800 unique packages that are already available on the repository server. We will also demo vulnerabilities against one of the package managers and PowerShell itself. Come see how to find third-party privilege escalation bugs at scale with the newest addition to PowerSploit.

Presenters:

• Christopher Campbell - Security Researcher
  Chris is a security practitioner with over a decade of experience attacking and securing enterprise networks. Currently, he is a security researcher and developer for the Harris Corporation. Formerly, Chris spent over 12 years in the U.S. Army Reserve and spent four years as an operator in the Computer Exploitation section of the U.S. Army Red Team. He has a Master of Science in Information Assurance from Capitol College and holds several industry certifications that he’d prefer you not hold against him. Chris is one of the developers of PowerSploit and has given presentations at BlackHat USA, Derbycon, Shmoocon Firetalks and multiple Bsides events. He maintains a blog at www.obscuresec.com and is active on twitter (@obscuresec).

Links:

• https://defcon.org/html/defcon-22/dc-22-speakers.html#Campbell2
• https://infocon.org/cons/DEF CON/DEF CON 22/DEF CON 22 slides/DEF CON 22 - Hacking Conference Presentation Christopher Campbell - The $env - PATH less Traveled is Full of Easy Privilege Escalation Vulns - Slides.mp4
• https://infocon.org/cons/DEF CON/DEF CON 22/DEF CON 22 slides/DEF CON 22 - Hacking Conference Presentation Christopher Campbell - The $env - PATH less Traveled is Full of Easy Privilege Escalation Vulns - Slides.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 22/DEF CON 22 video and slides/DEF CON 22 - Christopher Campbell - The $env - PATH less Traveled is Full of Easy Privilege Escalation Vulns - Video and Slides.mp4 (Video and Slides)
• https://www.youtube.com/watch?v=-SqAlpANtIs

Similar Presentations:

• DeepSec 2019 „Internet of Facts and Fears“ / Well, That Escalated Quickly! - A Penetration Tester's Approach to Windows Privilege Escalation
• ShmooCon XII (2016) / The Road to SYSTEM: Recycling Old Vulnerabilities for Unpatched Privilege Escalation and A New Network Attack
• Black Hat USA 2019 / Battle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically