☑️Legacy Systems
Legacy Operating Systems
During our assessments, we will undoubtedly encounter legacy operating systems (especially against large organizations such as universities, hospitals/medical organizations, insurance companies, utilities, state/local government). It is essential to understand the differences and certain additional flaws that we need to check to ensure our assessments are as thorough as possible.
End of Life Systems (EOL)
Over time, Microsoft decides to no longer offer ongoing support for specific operating system versions. When they stop supporting a version of Windows, they stop releasing security updates for the version in question. Windows systems first go into an "extended support" period before being classified as end-of-life or no longer officially supported. Microsoft continues to create security updates for these systems offered to large organizations through custom long-term support contracts. Below is a list of popular Windows versions and their end of life dates:
Windows Desktop - EOL Dates by Version
Windows XP
April 8, 2014
Windows Vista
April 11, 2017
Windows 7
January 14, 2020
Windows 8
January 12, 2016
Windows 8.1
January 10, 2023
Windows 10 release 1507
May 9, 2017
Windows 10 release 1703
October 9, 2018
Windows 10 release 1809
November 10, 2020
Windows 10 release 1903
December 8, 2020
Windows 10 release 1909
May 11, 2021
Windows 10 release 2004
December 14, 2021
Windows 10 release 20H2
May 10, 2022
Windows Server - EOL Dates by Version
Windows Server 2003
April 8, 2014
Windows Server 2003 R2
July 14, 2015
Windows Server 2008
January 14, 2020
Windows Server 2008 R2
January 14, 2020
Windows Server 2012
October 10, 2023
Windows Server 2012 R2
October 10, 2023
Windows Server 2016
January 12, 2027
Windows Server 2019
January 9, 2029
This page has a more detailed listing of the end-of-life dates for Microsoft Windows and other products such as Exchange, SQL Server, and Microsoft Office, all of which we may run into during our assessments.
Impact
When operating systems are set to end of life and are no longer officially supported, there are many issues that may present themselves:
Lack of support from software companies
Certain applications (such as web browsers and other essential applications) may cease to work once a version of Windows is no longer officially supported.
Hardware issues
Newer hardware components will likely stop working on legacy systems.
Security flaws
This is the big one with a few notable exceptions (such as CVE-2020-1350 (SIGRed) or EternalBlue (CVE-2017-0144)) which were easily exploitable and "wormable" security flaws which affected thousands of systems worldwide (including critical infrastructure such as hospitals). Microsoft will no longer release security updates for end-of-life systems. This could leave the systems open to remote code execution and privilege escalation flaws that will remain unpatched until the system is upgraded or retired.
Windows Server - 2008 Case Study
Windows Server 2008/2008 R2 were made end-of-life on January 14, 2020. Over the years, Microsoft has added enhanced security features to subsequent versions of Windows Server. It is not very common to encounter Server 2008 during an external penetration test, but I often encounter it during internal assessments.
Server 2008 vs. Newer Versions
The table below shows some notable differences between Server 2008 and the latest Windows Server versions.
For an older OS like Windows Server 2008, we can use an enumeration script like Sherlock to look for missing patches. We can also use something like Windows-Exploit-Suggester, which takes the results of the systeminfo command as an input, and compares the patch level of the host against the Microsoft vulnerability database to detect potential missing patches on the target. If an exploit exists in the Metasploit framework for the given missing patch, the tool will suggest it. Other enumeration scripts can assist us with this, or we can even enumerate the patch level manually and perform our own research. This may be necessary if there are limitations in loading tools on the target host or saving command output.
Let's first use WMI to check for missing KBs.
A quick Google search of the last installed hotfix shows us that this system is very far out of date.
Let's run Sherlock to gather more information.
From the output, we can see several missing patches. From here, let's get a Metasploit shell back on the system and attempt to escalate privileges using one of the identified CVEs. First, we need to obtain a Meterpreter reverse shell. We can do this several ways, but one easy way is using the smb_delivery module.
smb_delivery
Open a cmd console on the target host and paste in the rundll32.exe command.
We get a call back quickly.
Privilege Escalation
From here, let's search for the MS10_092 Windows Task Scheduler '.XML' Privilege Escalation module.
Before using the module in question, we need to hop into our Meterpreter shell and migrate to a 64-bit process, or the exploit will not work. We could have also chosen an x64 Meterpeter payload during the smb_delivery step.
Once this is set, we can now set up the privilege escalation module by specifying our current Meterpreter session, setting our tun0 IP for the LHOST, and a call-back port of our choosing.
If all goes to plan, once we type exploit, we will receive a new Meterpreter shell as the NT AUTHORITY\SYSTEM account and can move on to perform any necessary post-exploitation.
Windows Desktop Versions - 7 Case Study
Windows 7 was made end-of-life on January 14, 2020, but is still in use in many environments.
Windows 7 vs. Newer Versions
Over the years, Microsoft has added enhanced security features to subsequent versions of Windows Desktop. The table below shows some notable differences between Windows 7 and Windows 10.
To this date, estimates state that there may be over 100 million users still on Windows 7. According to NetMarketShare, as of November 2020, Windows 7 was the second most used desktop operating system after Windows 10. Windows 7 is standard in large companies across the education, retail, transportation, healthcare, financial, government, and manufacturing sectors.
Let's look at a Windows 7 host that we may uncover in one of the sectors mentioned above. For our Windows 7 target, we can use Sherlock again like in the Server 2008 example, but let's take a look at Windows-Exploit-Suggester
First we need to install the necessary dependencies:
Once this is done, we need to capture the systeminfo command's output and save it to a text file on our attack VM.
We then need to update our local copy of the Microsoft Vulnerability database. This command will save the contents to a local Excel file.
Once this is done, we can run the tool against the vulnerability database to check for potential privilege escalation flaws.
Suppose we have obtained a Meterpreter shell on our target using the Metasploit framework. In that case, we can also use this local exploit suggester module which will help us quickly find any potential privilege escalation vectors and run them within Metasploit should any module exist.
Looking through the results, we can see a rather extensive list, some Metasploit modules, and some standalone PoC exploits. We must filter through the noise, remove any Denial of Service exploits, and exploits that do not make sense for our target OS. One that stands out immediately as interesting is MS16-032. A detailed explanation of this bug can be found in this Project Zero blog post which is a bug in the Secondary Logon Service.
MS16-032
On PowerShell:
Thats it.
Last updated