{"id":125,"date":"2018-07-10T13:31:26","date_gmt":"2018-07-10T13:31:26","guid":{"rendered":"https:\/\/int64software.com\/blog\/?p=125"},"modified":"2018-07-10T13:31:26","modified_gmt":"2018-07-10T13:31:26","slug":"tutorial-privilege-escalation-vulnerability-scan-tool-and-overcee","status":"publish","type":"post","link":"https:\/\/int64software.com\/blog\/2018\/07\/10\/tutorial-privilege-escalation-vulnerability-scan-tool-and-overcee\/","title":{"rendered":"Tutorial: Privilege Escalation Vulnerability Scan Tool and Overcee"},"content":{"rendered":"

We previously mentioned that the free Privilege Escalation Vulnerability Scan (PEVS) Tool released last week could be perfectly combined with our Delegated Device Managements platform, Overcee<\/a>. So we thought we’d delve in and show you how this simple task can be setup.<\/p>\n

<\/p>\n

\"Overcee\"<\/p>\n

Sharing Tools for Execution<\/h2>\n

In our development environment, we already have a shared folder configured for deploying various tools and installers across the network. Its NTFS permissions are simple as the Remote Execution tool run as Local System on our client devices.<\/p>\n

\"Overcee<\/p>\n

Here we’ve just added the Domain Computers and granted it Read & execute permissions.<\/p>\n

Now we just need to copy the PEVS files into it.<\/p>\n

\"Overcee<\/p>\n

Configuring the Overcee Tool<\/h2>\n

That done, we can head straight into Overcee and create a new Remote Execution tool to run PEVS.<\/p>\n

\"Overcee:<\/a><\/p>\n

We’ve been over the creation and configuration of tools in previous blog posts<\/a>, as well as having extensive information in the Overcee documentation, so we won’t go over the all of the options here.<\/p>\n

\"Overcee:<\/a><\/p>\n

Here we’ve set the new tools name, description and help text to relevant values to help identify the tool and what it does.<\/p>\n

\"Overcee:<\/a><\/p>\n

The Command Line is the most important section for us here as we point it to our development server’s “Deploy” shared folder and the privesc.exe PEVS executable.<\/p>\n

By default, PEVS doesn’t require any command line options when it’s running locally on the remote computer (i.e. through the Remote Execution tool).<\/p>\n

Note that we lock down the tool completely so that future tools derived from this one, and when this tool itself is run, none of the variables can be modified (unless the user has write access to this tool). For more information on this, see our article on Understanding Overcee Permissions<\/a>.<\/p>\n

\"Overcee:<\/p>\n

Conclusion<\/h2>\n

That’s it, with the tool created, we are now free to run it on our client devices.<\/p>\n

Here you can see the result of running it on a device which has a couple of (deliberately placed) vulnerabilities.<\/p>\n

\"Overcee:<\/a><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

We previously mentioned that the free Privilege Escalation Vulnerability Scan (PEVS) Tool released last week could be perfectly combined with our Delegated Device Managements platform, Overcee. So we thought we’d delve in and show you how this simple task can be setup.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","footnotes":""},"categories":[13,4,7],"tags":[5,41,31,39,40,8],"class_list":["post-125","post","type-post","status-publish","format-standard","hentry","category-blog","category-overcee","category-tutorial","tag-overcee","tag-pevs","tag-privilege-escalation","tag-remote-execution","tag-tool","tag-tutorial"],"_links":{"self":[{"href":"https:\/\/int64software.com\/blog\/wp-json\/wp\/v2\/posts\/125","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/int64software.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/int64software.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/int64software.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/int64software.com\/blog\/wp-json\/wp\/v2\/comments?post=125"}],"version-history":[{"count":3,"href":"https:\/\/int64software.com\/blog\/wp-json\/wp\/v2\/posts\/125\/revisions"}],"predecessor-version":[{"id":136,"href":"https:\/\/int64software.com\/blog\/wp-json\/wp\/v2\/posts\/125\/revisions\/136"}],"wp:attachment":[{"href":"https:\/\/int64software.com\/blog\/wp-json\/wp\/v2\/media?parent=125"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/int64software.com\/blog\/wp-json\/wp\/v2\/categories?post=125"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/int64software.com\/blog\/wp-json\/wp\/v2\/tags?post=125"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}