Windows Privilege Escalation

Windows Privilege Escalation Checklist

This skill provides a systematic approach to enumerating and exploiting Windows privilege escalation vectors. Follow the sections in order, but prioritize based on what you discover.

Quick Start

1. Run the bundled enumeration script: ./scripts/winpeas-enumerate.ps1
2. Review the output for high-value findings
3. Follow up on specific vectors using the detailed sections below

System Information

Gather baseline system information first:

# System info
systeminfo
ver
whoami /all
net user
net localgroup administrators

# Check for kernel exploits
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" -Name "OSVersion"

Action items:

• Search for kernel exploits using the version info found
• Use searchsploit windows <version> or Google the version number
• Check environment variables for credentials or paths

Credential Discovery

PowerShell History

Get-Content "$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt" -Tail 100

Saved Credentials

# Windows Vault
cmdkey /list

# DPAPI credentials
ls "C:\Users\*\AppData\Local\Microsoft\Credentials"

# Browser credentials (Chrome/Edge)
ls "C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Login Data"

# RDP saved connections
reg query "HKCU\Software\Microsoft\Terminal Server Client\Default"

Registry Credentials

# SSH keys
reg query "HKCU\Software\SSHAgent" /s

# AutoLogon
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

# Stored passwords
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogon"

File-based Credentials

# Unattended install files
ls C:\Windows\System32\Sysprep\unattend.xml
ls C:\Windows\Panther\unattend.xml

# IIS web.config
ls C:\inetpub\wwwroot\web.config -Recurse

# McAfee SiteList
ls C:\ProgramData\McAfee\SiteList.xml

# GPP cached passwords
ls C:\Windows\System32\GroupPolicy\Machine\Preferences\Groups\ -Recurse

Service Enumeration

Service Permissions

# List all services
Get-Service | Select-Object Name, DisplayName, Status

# Check service binary paths
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\*" -Name "ImagePath" -ErrorAction SilentlyContinue

# Find unquoted paths
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\*" -Name "ImagePath" -ErrorAction SilentlyContinue | 
  Where-Object { $_.ImagePath -notlike '"*"' }

Service Exploitation

• Can you modify any service binary? Check permissions on the binary path
• Can you modify service registry keys? Check ACLs
• Are there unquoted service paths? Create a DLL/exe with the same name in an earlier path
• Can you trigger service restarts? Restart-Service <service>

DLL Hijacking

# Check PATH for writable locations
$env:PATH -split ';' | ForEach-Object { 
  if (Test-Path $_) { 
    $acl = Get-Acl $_
    if ($acl.Access | Where-Object { $_.FileSystemRights -match 'Write' }) { 
      Write-Output "Writable PATH: $_"
    }
  }
}

# Find missing DLLs for services
# Look for services that load DLLs from their directory

Token Privileges

Check for dangerous privileges:

whoami /priv

# Key privileges to look for:
# SeImpersonatePrivilege - Token impersonation
# SeAssignPrimaryPrivilege - Assign primary token
# SeTcbPrivilege - Act as part of OS
# SeBackupPrivilege - Backup files
# SeRestorePrivilege - Restore files
# SeCreateTokenPrivilege - Create tokens
# SeLoadDriverPrivilege - Load drivers
# SeTakeOwnershipPrivilege - Take ownership
# SeDebugPrivilege - Debug programs

File and Folder Permissions

# Check permissions on critical directories
Get-Acl "C:\Windows\System32" | Select-Object -ExpandProperty Access
Get-Acl "C:\Program Files" | Select-Object -ExpandProperty Access

# Find writable files in Program Files
ls "C:\Program Files" -Recurse -File | ForEach-Object {
  $acl = Get-Acl $_.FullName
  if ($acl.Access | Where-Object { $_.FileSystemRights -match 'Write' }) {
    Write-Output $_.FullName
  }
}

Network Enumeration

# Network configuration
ipconfig /all
netstat -ano
route print

# Check for local services
netstat -ano | findstr "127.0.0.1"

# Network shares
net share
net use

Security Controls

Check Security Features

# UAC level
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -v EnableLUA

# AppLocker
Get-AppLockerPolicy -Effective

# Credential Guard
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" -v CredentialGuard

# WDigest
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" -v UseLogonCredential

# LSA Protection
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" -v RunAsPPL

AV/EDR Detection

# Check for AV processes
Get-Process | Where-Object { $_.ProcessName -match "(av|antivirus|defender|mcafee|symantec|kaspersky|bitdefender|eset|trend|sophos|crowdstrike|carbonblack|sentinelone|cylance)" -ci }

# Check AV services
Get-Service | Where-Object { $_.DisplayName -match "(av|antivirus|defender|protection|security)" -ci }

Exploitation Vectors

AlwaysInstallElevated

# Check if enabled
reg query "HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer" -v AlwaysInstallElevated
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer" -v AlwaysInstallElevated

# If enabled, create a malicious MSI and install it
msiexec /i malicious.msi

WSUS Exploitation

# Check WSUS configuration
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"

# Look for WSUS update files
ls "C:\Windows\SoftwareDistribution\Download" -Recurse

Third-party Auto-updaters

# Check for auto-updater services
Get-Service | Where-Object { $_.DisplayName -match "(update|updater|auto)" -ci }

# Check for IPC abuse opportunities
Get-Process | Select-Object ProcessName, Id

Memory and Process Analysis

# Memory password mining
# Use tools like Mimikatz, LaZagne, or ProcDump

# Dump browser credentials
.

# Check for insecure GUI apps
Get-Process | Where-Object { $_.MainWindowTitle -notlike "*" }

Next Steps

1. Prioritize findings - Focus on vectors that require minimal interaction
2. Test exploitation - Try the most promising vectors first
3. Document everything - Keep track of what works and what doesn't
4. Use WinPEAS - Run the full WinPEAS tool for comprehensive enumeration

Tools to Use

• WinPEAS - Primary enumeration tool (https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS)
• Mimikatz - Credential dumping
• PowerSploit - PowerShell post-exploitation
• LaZagne - Password recovery
• ProcDump - Process dumping

Important Notes

• Always check for AV/EDR before running tools
• Some vectors require specific conditions (e.g., AlwaysInstallElevated)
• Document all findings for reporting
• Consider the impact of exploitation on the target system
• Follow responsible disclosure practices