Double-Click the file to establish a connection to the client endpoint ‘ESeC-User.rdp’ (Win10-1709-ESEC). using credentials on page 4. Run ‘cmd.exe’ Type on the command line ‘whoami’ Right-Click the cmd.exe icon on taskbar Right-Click on Line’ ‘Command Click As Administrator’ ‘Run Enter details at UAC prompt ‘ESeC-Admin’ In the new window, type on the command line ‘whoami’ This example shows that normally when an application runs which requires Administrative privileges then the context of what the application runs in is changed. i.e. UAC is not simply a permissive action. This can lead to problems if the application in question relies on objects are in the users’ ‘current context, session variables/drives etc. Elevating cmd.exe via configuration Create a new Control Configuration’ (as per previous exercise) ‘Application In the group > Privileges’ ‘Everyone’ ‘User Right-Click the white space Click ‘File’ Enter in the field and click ‘cmd.exe’ ‘File’ ‘Add’ Click As’ ‘Save’/’Save Name the configuration and Click Click ‘OK’; ‘Close’ Assign the Configuration to Agent Policy; Deploy and Test configuration (See Exercise 2). NB. A pre-defined configuration is available for review Elevate cmd.exe (Everyone)’ – ‘UPM – If configured and deployed correctly, running cmd.exe from the ESeC-Users session should result in the process being elevated and showing that it is being ran in the context of an administrator. This shows that Application Control has altered the security token on demand when cmd.exe has been ran.
Double-Click the ‘ESeC-User.rdp’ file to establish a connection to the client endpoint (Win10-1709-ESEC). using credentials on page 4. Run ‘cmd.exe’ Type ‘whoami’ on the command line Right-Click the cmd.exe icon on taskbar Right-Click on ‘Command Line’ Click ‘Run As Administrator’ Enter ‘ESeC-Admin’ details at UAC prompt In the new window, type ‘whoami’ on the command line This example shows that normally when an application runs which requires Administrative privileges then the context of what the application runs in is changed. i.e. UAC is not simply a permissive action. This can lead to problems if the application in question relies on objects are in the ‘current users’ context, session variables/drives etc. Elevating cmd.exe via configuration Create a new ‘Application Control Configuration’ (as per previous exercise) In the ‘Everyone’ group > ‘User Privileges’ Right-Click the white space Click ‘File’ Enter ‘cmd.exe’ in the ‘File’ field and click ‘Add’ Click ‘Save’/’Save As’ Name the configuration and Click ‘OK’; Click ‘Close’ Assign the Configuration to Agent Policy; Deploy and Test configuration (See Exercise 2). NB. A pre-defined configuration is available for review – ‘UPM – Elevate cmd.exe (Everyone)’ If configured and deployed correctly, running cmd.exe from the ESeC-Users session should result in the process being elevated and showing that it is being ran in the context of an administrator. This shows that Application Control has altered the security token on demand when cmd.exe has been ran.
OSL510%20-%20Lab%20Guide.docx