Exploiting BITS Misconfigurations with PowerUp and Mimikatz

---

Situation:

This project focused on identifying and exploiting misconfigurations on the costumes.artstailor.com host within the artstailor.com network. Using PowerUp and its obfuscated counterpart PowerDown, the goal was to elevate privileges, create an administrative account, and extract sensitive credentials using Mimikatz.

---

Obstacles:

1. Antivirus Interference: PowerUp.ps1 was flagged as a threat by Windows Defender, requiring the use of PowerDown.ps1.
2. Execution Policy Restrictions: Running PowerShell scripts with limited permissions required bypassing execution policies.
3. Privilege Escalation: Identifying and exploiting the Background Intelligent Transfer Service (BITS) misconfiguration for escalation.

---

Actions Taken:

1. Environment Setup:
   • Created a shared /tmp/ex9/ directory on Kali to store the PowerSploit and Mimikatz tools.
   • Established a remote desktop session with costumes.artstailor.com using the credentials from Ex080 (s.wilkins:Fall2021).
   • Verified the connection by confirming the IPv4 address of the remote session.
2. PowerDown Usage:
   • Mounted the shared directory using the net use command.
   • Ran PowerDown.ps1 in PowerShell with execution policy bypass enabled.
   • Executed the Do-AllChecks command to identify system vulnerabilities.
3. BITS Exploitation:
   • Used Do-ServiceAbuse -Name 'BITS' to modify the BITS service binary path.
   • Restarted the BITS service to execute the binary and create a local administrative account (pasta:Password123!).
4. Administrative Access:
   • Logged into the new administrator account and disabled Windows Defender real-time protection.
   • Successfully imported and executed Mimikatz to collect sensitive data.
5. Mimikatz Operations:
   • Extracted credential hashes, Kerberos tickets, and Security Account Manager (SAM) database entries.
   • Generated a Golden Ticket using kerberos::golden for persistent domain access.
   • Saved all extracted data to plunder.pr0b3.com.

---

Results:

1. Vulnerability Identified:
   • BITS Weak Service Permissions: Allowed modification of the service binary path, leading to privilege escalation.
2. Access Achieved:
   • Created a local administrator account (pasta:Password123!) and gained SYSTEM-level privileges.
3. Sensitive Data Extracted:
   • Credential hashes for local user accounts, including n.nolan, were dumped.
   • A Golden Ticket was successfully generated for long-term access.
4. Risk Level:
   • Critical: Exploitation enabled full compromise of the target host.

---

Tool Purpose Overview:

PowerUp:

• A PowerShell module for privilege escalation, used to identify and exploit system misconfigurations.

PowerDown:

• An obfuscated version of PowerUp designed to bypass antivirus detection.

Mimikatz:

• A post-exploitation tool used to extract sensitive data such as credentials, Kerberos tickets, and password hashes.

rdesktop:

• A remote desktop client used to connect to the target system and share tools from the attacker’s machine.

---

Recommendations:

1. Harden Service Permissions:
   • Restrict modification of the BITS service to administrative users only.
   • Regularly audit service configurations for misconfigurations.
2. Enhance Antivirus Capabilities:
   • Ensure antivirus is configured to detect obfuscated scripts and block malicious binaries like PowerDown.ps1.
3. Implement Strong Credential Policies:
   • Disable default administrator accounts and enforce strong, unique passwords.
   • Regularly rotate service account credentials.
4. Monitor for Privilege Escalation Attempts:
   • Use logging and monitoring tools to detect unusual modifications to services like BITS.

---

View PDF Document