Are you using a computer running Windows operating system but have a lot of Users but you want to access CMD and Powershell of other Users but you don’t want to get out of your current User? You don’t want to close your applications but you need access to another User to work? Don’t worry, today I will show you how to access the Console of other Users using a script called PowerRunAsAttached

PowerRunAsAttached – Script to support you in information technology

Personally, on my computer there are many different Users to serve different jobs. For example, I will normally have 3 Users including: 1 User for gaming, 1 User for coding and 1 User for others to use and they all have different purposes for more focus at work. But sometimes I also have things I will need to use the rest of the User but I don’t want to get out of the current User?

Pretty lucky for me when I found a script on the github community. Your 1st PowerRunAsAttached Script has Username DarkCoderSc and this script is generated for the purpose of calling Console (CMD or Powershell) of other users.

Join me and set up now to be able to access the Console of other Users through PowerRunAsAttached!

Instructions for using PowerRunAsAttached to escalate privileges on Windows

Part 1: Setup Script

To do this part, your device requires:

• Windows license has been activated
• Fully updated
• Have at least 2 Users or more

After you have completed the above requirements, let’s go into how to Setup this script!

Step 1: You download the script from github here. Then proceed to extract the file

Step 2: In the PowerRunAsAttached-main folder, that folder will have a file named PowerRunAsAttached. Do you remember the path to that file?

Step 3: Start Powershell as Administrator

Step 4: In Powershell, write the following commands:

# mẫu tham khảo
$p = [Environment]::GetEnvironmentVariable("PSModulePath")
$p += ";[đường dẫn tới file PowerRunAsAttached trong bước 2]"
[Environment]::SetEnvironmentVariable("PSModulePath",$p)

# Ví dụ
$p = [Environment]::GetEnvironmentVariable("PSModulePath")
$p += ";C:\Users\hoang\Desktop\PowerRunAsAttached-main\PowerRunAsAttached-main"
[Environment]::SetEnvironmentVariable("PSModulePath",$p)

Step 5: Please add the following command to import the script as a module

Import-Module PowerRunAsAttached

Note: If it shows an error as shown below, then run the following command:

Set-ExecutionPolicy -ExecutionPolicy Unrestricted

At this point, you have completed the setup. Now I will show you how to use the script!

Part 2: Instructions for using scripts

What you just need to enter on your Powershell is the command below:

Invoke-RunAsAttached -Username "[Tên username của user đó]" -Password "[password của user đó (để trống nếu không có)]"

Eg:

Invoke-RunAsAttached -Username "wdchocopie" -Password "anonyviet123@"

You can use the whoami command to check which user you are in! Good luck

This article will explain what privilege escalation is and how we can upgrade our privileges using the SUID permissions file. You can use this knowledge to solve Christmas Advent of Cyber ​​challenge number 8.

What is privilege escalation?

Computer systems are designed to be used by many users, and privileges mean what users are allowed to do. Common privileges include viewing and editing files or modifying system files.

Privilege escalation is the act of exploiting a bug, design or configuration flaw in an operating system or software application to gain higher access to normally protected resources from an application or user. .

What is SUID?

SUID is a special type of file permission granted to a file. When a user runs a program, if they have the correct read/execute permissions, that program will run using their account privileges. SUID allows a user to run a program using the privileges of another user. To learn more about file perks, complete challenge 4 in the Christmas room or read the supporting material here.

In some cases, we can take advantage of running the file as another user, to execute mining commands. You might be thinking, why allow anyone to run the file as another user, right? However, we need to have certain binaries run as root by an unprivileged user.

For example, if we change our password on Linux, the program that does this needs permission to change the file system. You may not have write permission to the /etc/ directory, but root does. This is why the password binary has the SUID bit.

If a binary file has a SUID bit then it will have permissions S. If we check the permissions for the password binary, we can see the permissions -rwsr-xr-x.

The SUID bit is set on execute permission, which means that when a user runs this file, it will run as the file owner (as root).

In essence, SUID files execute with the permission of the file owner.

Make use of SUID files

Some administrators will manually set the SUID bit to allow certain programs to be run. Let’s say you are a system administrator and an unprivileged user wants to programmatically require the file to run with higher privileges. They can set the SUID bit, then unprivileged users can execute the program without any additional account permissions.

We can scan the entire file system to find all files with the SUID bit, with the following command:

find / -user root -perm -4000 -exec ls -ldb {} \;

We can see some binaries running as root, which are legitimate programs with the right permissions set up to do the right task.

If a sysadmin has manually set the SUID bit on a binary file, the above command will find those files. You can take advantage of this command to elevate your privileges or run commands you wouldn’t normally be able to do.

Tips for the SUID challenge

A regular standard Linux binary (such as the find command), which can change the file owner and the SUID bit.

For example, if we want to know what user is running the find command, we can do the following:

touch foo
find foo -exec whoami \;

This command will find the file foo (which we just created), then run the command with the -exec parameter.

If you find a file that looks suspicious? Try running it and see what you can do with it? Run the whoami command to see if the file is actually running as root.

If you are given the option to run the command as another user. Why not run /bin/bash to run bash (for the shell) as another user?

Also, you can check out Shodan.io readings on TryHackMe here.