Windows Privilege Escalation
Privilege Escalation (PrivEsc) in Windows is a process that get the Administrator credential and login.
We might be able to find vulnerabilities on target Windows machine with automation tools as below:
LOLBAS provides misuses tools and executables already in the Windows system. So check the website.
hostname
systeminfo
systeminfo | findstr "OS"
ver
[System.Environment]::OSVersion.Version
# Datetime
Get-Date
Copied!After investigating the OS information, find the vulnerabilities of OS version.
Right-click on the Windows icon.
Click Run.
Type
recentin the search form.
Using the Windows Management Instrumentation command-line (WMIC) mainly.
We might be able to find interesting information about users by checking histories of web browsers such as Chrome, Microsoft Edge, Internet Explorer, etc.
VSS coordinates the actions that are required to create a consistent a shadow copy (also known as a snapshot or a point-in-time copy) of the data that is to be backed up.
We may be able to retrieve sensitive information in registry hives. See also: Windows PrivEsc with Registry Keys
Reference: Atomic Rea Team
We can collect the information about emails such as Outlook on the following directories.
If we found the listening ports, we need to port forwarding to access the port in local machine.
For example, assume the port 8000 is listening. We can access to the target port 8000 by accessing to [http://localhost:8000](http://localhost:8000) in local by executing the following command.
Please refer to this page to check how to use Chisel for port forwarding.
We can find all local users in Computer Management utility. To open, enter "computer management" in search form at the bottom of the windows screen.
In Computer Management, click "Local Users and Groups".
Click "Users".
Double-click each user to get details e.g. "Member Of".
Click "Groups".
Double-click each group.
Attempt to add new user in the group because we might be able to do that even if we are not an administrator.
Right-click on the file.
Select the Properties.
Click the Security tab.
Click “Advanced”.
In the Permissions tab, click the “Add”.
Click “Select a principal”.
Enter the username in the text field.
Click OK and Apply.
Also we can change permissions in CommandPrompt or PowerShell.
If we could change the permission, connect to the target via WinRM or RDP.
If we cannot switch user due to such as reverse shell sessions, we can spawn another shell as another user by using RunasCS.
First, start a listener in local machine.
Then execute the following command in target machine.
Replace username and password with the credential of the user that we want to switch to.
If we’re Local Service or Network Service account, it maybe possible to grant all privileges to the account.
FullPowers is a powerful tool for doing that.
Event Viewer
FullEventLogview
Task Schedular
Tools that offer technical resources and utilities to manage, diagnose, troubleshoot, and monitor a Microsoft Windows environment.
References
Last updated