Escalating from administrator to system
Administrator privileges allow an attacker to create and manage accounts and access most data available on a system. However, some complex functionality mandates that the requester have system-level access privileges. There are several ways to continue this escalation to the system level. The easiest way is to run PsExec to get system-level access by uploading PsExec to the desired folder and run the following command as a local administrator:
PsExec -s -i -d cmd.exe
This command should open up another Command Prompt as the system user, as shown in Figure 12.7:
Figure 12.7: Escalating from local administrator to SYSTEM using Psexec
DLL injection
DLL (Dynamic Link Library) injection is another easy technique that is utilized by attackers to run remote code in the context of the address space of another process. This process must be running with excess privileges that can then be used to escalate privilege in the form...
