Privilege escalation — Hands-on lab

Three escalations, three different paths, three complete cards. Ideally an AD chain (Kerberoast → escalation). You produce the deliverable that sets a pentester apart from a scanner.

Plan for: 3 h.

Deliverable: ~/labs/semaine-09/rapport/elevations.md with 3 structured cards + preuves/ with traces + bonus: a BloodHound report.

---

Prerequisites

• Existing lab: 10.10.10.5 (Kali), 10.10.10.12 (Windows), 10.10.10.20 (Linux).
• A standard user access obtained in previous modules:
  • Linux: msfadmin or www-data shell on Metasploitable 2.
  • Windows: vagrant Meterpreter session on Metasploitable 3.
• Optional: GOAD AD lab for the Kerberoasting part (see github.com/Orange-Cyberdefense/GOAD).
• Tools on Kali:

sudo apt install -y hashcat impacket-scripts bloodhound-python neo4j
# WinPEAS and LinPEAS: in /usr/share/peass/ or from GitHub

Create:

mkdir -p ~/labs/semaine-09/{preuves,rapport}

---

Step 1 — Choose 3 paths (10 min)

Do not take the ones from the walkthrough. Suggestions to cover:

Linux (pick 1 to 2):

• SUID on a GTFOBins binary other than nmap (find, less, awk, perl, python).
• Write access to a root-owned directory with the sticky bit (the S or T bit).
• Offensive capabilities (cap_setuid, cap_dac_read_search).
• Kernel exploit (lab only, never in production).
• Docker socket reachable without sudo (docker.sock mounted on the host).
• Container escape from a privileged container.

Windows (pick 1 to 2):

• Unquoted Service Path.
• Modifiable service binary.
• Modifiable registry HKLM\SYSTEM\CurrentControlSet\Services\....
• DLL hijacking.
• AlwaysInstallElevated (MSIs installed as SYSTEM by any user).

AD (pick 0 or 1):

• Kerberoasting.
• AS-REP roasting (accounts with DoesNotRequirePreAuth).
• Internal password spraying with nxc.
• ACL abuse (a user can modify a privileged group).

Note your 3 choices at the top of rapport/elevations.md with a one-sentence justification.

---

Step 2 — Escalation 1 (45 min)

Follow the structure from the walkthrough. Complete card:

## Escalation 1 — <short title>

### Context
- Target: <IP + machine name>
- Starting account: <user>
- Goal: <root / SYSTEM / DA>

### Discovery
- Command(s) used:
  ```bash
  ...
  ```
- Revealing output:
  ```
  ...
  ```

### Exploitation
- Payload / exploitation command:
  ```
  ...
  ```
- Confirmation:
  ```
  whoami / id / getuid
  ```

### Impact
- <one to three strong lines>

### Recommendation
- Immediate:
- Long-term:

### Evidence
- preuves/01-*.log, preuves/01-*.txt, ...

Save all commands and outputs in preuves/01-*.

---

Step 3 — Escalation 2 (45 min)

Another target or another path. Same structure.

---

Step 4 — Escalation 3 (45 min)

Same rule.

If you set up the GOAD AD lab, try Kerberoasting:

impacket-GetUserSPNs -request -dc-ip 10.10.10.100 \
                     acme.local/<user>:<pass> \
                     -outputfile preuves/03-tgs.txt

hashcat -m 13100 preuves/03-tgs.txt /usr/share/wordlists/rockyou.txt \
        -r /usr/share/hashcat/rules/best64.rule \
        --potfile-path preuves/03-hashcat.potfile

Document the cracking time and the password found.

---

Step 5 — Bonus: BloodHound mapping (30 min)

If you have an AD lab:

sudo neo4j start
# Web UI: http://localhost:7474 (neo4j/neo4j then change)

bloodhound-python -u <user> -p <pass> -d acme.local -ns 10.10.10.100 \
                  -c All -o preuves/bloodhound/

# Open the BloodHound GUI
bloodhound
# Drag & drop the .json files into the UI

In BloodHound, run the ready-made query "Shortest Paths from Owned Users to Domain Admins". Capture the graph.

Add to the report:

## Bonus — BloodHound mapping

The shortest path from <account> to Domain Admin goes through:
<node1> → <node2> → <node3> → DA.

The full graph is in preuves/bloodhound/graph-<date>.png.

This graph is worth more than the rest of the report to a CISO discovering their own AD.

---

Step 6 — The overall report (30 min)

Before the 3 cards, add a summary:

# Privilege escalation report — <date>

## Executive summary (5 lines)

Three escalation paths identified and exploited. Two lead to root/SYSTEM
on their respective machines, one leads to the full compromise of the
Active Directory domain <acme.local>. No kernel exploit was used — every
escalation relies on configuration mistakes.

## Table

| # | Target | Start | End | Attack type |
| - | ------ | ----- | --- | ----------- |
| 1 | ... | ... | ... | ... |
| 2 | ... | ... | ... | ... |
| 3 | ... | ... | ... | ... |

## Detailed cards
(the 3 cards above)

## Bonus — BloodHound
(the graph)

## Global recommendations

1. Audit sudoers and remove overly broad NOPASSWD entries.
2. Remove non-essential SUID bits.
3. Move service accounts to Managed Service Accounts.
4. Passwords for accounts with an SPN >= 25 characters.
5. Monitoring: alert on any Windows service creation, any token
   impersonation, any massive TGS request.

---

Self-assessment checklist

• Three different escalations, different paths (not 3 SUIDs).
• Each card: context + discovery + exploitation + impact + recommendation + evidence.
• Complete evidence in preuves/ (at least 3 files per escalation).
• No card is limited to a screenshot of a whoami.
• Concrete recommendations (not just "fix the configuration").
• BloodHound bonus attempted (if an AD lab is available).
• A 1-page summary report at the top.
• No kernel exploit run outside a VM you are willing to lose.

---

Optional extension — Write a bash-persist.sh

Once root on Linux, how does an attacker stay? Write a bash-persist.sh that installs three persistence mechanisms:

1. An SSH key added to /root/.ssh/authorized_keys.
2. A @reboot cron that calls back to you.
3. A SUID binary hidden in /tmp/.X11-lock.

Document each mechanism, and the command to remove it cleanly at the end of the engagement. A pentester who forgets a backdoor is no longer a pentester.

---

What usually gets stuck

Symptom	Cause	Fix
LinPEAS blocked by noexec /tmp	Restrictive mount	Write to ~/ or /dev/shm.
SUID bash = bash-3.2$ without being root	Bash drops SUID at startup	Use bash -p (privileged mode).
Meterpreter dies while migrating	Unstable target	Migrate to explorer.exe rather than a service.
Kerberoast finds no SPN	AD lab with no service account	Add svc_sql and assign it an SPN.
Hashcat cracked nothing	Strong password	Document it as a sound security measure.
BloodHound has no data	Empty Neo4j	Reload the .json files via the Upload button.

---

What you take away from this lab

• Three escalation paths actually exploited.
• A precise vocabulary (SUID, cap_setuid, Kerberoast, ACL abuse).
• A BloodHound graph (bonus but transformative).
• A 3-5 page report presentable to a client.
• The ability to do this week's work, on your own, in 3 h, on any future engagement.

Next step: the quiz. Then we move on to lateral movement — how you leave a compromised machine to compromise 20 more.