Pentesting Quick Reference OSCP and Beyond
search
⌘Ctrlk
Pentesting Quick Reference OSCP and Beyond
  • Basic Tools & Techniques
  • Linux Basics
  • Windows Basics
  • Shells
  • Uploading Shells/ Transferring Files
  • FootPrinting
  • Host Discovery
  • Scanning
  • Vulnerability assessment
  • Metasploit and Meterpreter
  • Brute Forcing/ Password Cracking
  • Linux Remote Management Protocols
  • Windows Remote Management Protocols
  • Port 20/21 - FTP Pentesting
  • Port 22 SSH
  • Port 23 Telnet
  • Port 25 - SMTP
  • Port 53 DNS
  • Port 110/995 POP3 and IMAP 146/993
  • Port 111 -RPC Bind
  • Port 135 - RPC
  • Port 137 NetBios
  • Port 137, 138 UDP NMDB
  • Port 161 SNMP
  • Port 445 - SMB
  • Port 1433 - MSSQL
  • Port 1521 Oracle TNS
  • Port 1833 - MQTT
  • Port 2049 - NFS
  • Port 3306 MySQL
  • Port 3389 - RDP
  • Port 5985 - WINRM
  • Port 632 (UDP) IPMI
  • Redis (6379)
  • Port 10000 Webmin
  • Jenkins
  • Privilege Escalation
    • Windows Priv esc
      • Initial Enumeration
      • Automated Enumeration Tools
      • Kernel Exploits
      • Impersonating access tokens
      • Potato Attacks
      • Autoruns
      • Registry Escalation - AlwaysInstallElevated
      • Sheduled Tasks
      • Runas
      • Weak Service Permissions
      • Unquoted service path vulnerability
      • Print Spooler
      • Bypassing UAC using the UACME tool
      • UAC Bypass: Memory Injection (Metasploit)
      • Windows Subsystem for Linux
      • Misc
      • Meterpreter Kiwi plugin
      • Group Policy Preference
      • Escalate to SYSTEM from Administrator
    • Linux Priv esc
  • Active Directory
  • Web Pentesting
  • Cryptography
  • More Resources
  • Forensics
  • IoT Security
  • API Security
  • Binary Exploitation
  • Boxes/ Machines
  • Private Challenges
  • Misc tools
  • Clearing Tracks
  • SOC Analyst Resources
  • OSCP Tips and Misc
  • Buffer Overflow
  • Linux Vulnerabilities
  • Different Applications Vulnerabilities
  • Web3 and Blockchain Security
  • WIFI Hacking
  • Misc Tricks
  • CTF Writeups
  • Social Engineering
  • Mobile Hacking
    • Mobile Hacking
    • Extracting APIs from Mobile applications
  • Cloud Pentesting
    • AWS
  • AI-Pentesting
    • AI Based Pentesting tools
  • OT Security
    • OT Security Labs
    • M5StickC
gitbookPowered by GitBook
block-quoteOn this pagechevron-down
  1. Privilege Escalation

Windows Priv esc

hashtag
Check if we are admin

hashtag
Living of the land GTFO Bins for Windows

LogoLOLBASlolbas-project.github.iochevron-right

hashtag
Enumeration with Winpeas

hashtag
Enumeration with powerup.ps1

upload the script with metasploit

Now run the script with Powershell

hashtag
Getsystem Meterpreter

Good easy win

LogoWhat happens when I type getsystem? | Cobalt StrikeCobalt Strikechevron-right

hashtag
Windows compiled exploits

LogoGitHub - SecWiki/windows-kernel-exploits: windows-kernel-exploits Windows平台提权漏洞集合GitHubchevron-right
LogoGitHub - abatchy17/WindowsExploits: Windows exploits, mostly precompiled. Not being updated. Check https://github.com/SecWiki/windows-kernel-exploits instead.GitHubchevron-right

hashtag
Good Resources and Cheetsheets

LogoFuzzySecurity | Windows Privilege Escalation Fundamentalswww.fuzzysecurity.comchevron-right
LogoPayloadsAllTheThings/Methodology and Resources/Windows - Privilege Escalation.md at master · swisskyrepo/PayloadsAllTheThingsGitHubchevron-right
LogoWindows Privilege Escalation Guidewww.absolomb.comchevron-right
LogoPrivilege Escalation - Windows · Total OSCP Guidesushant747.gitbooks.iochevron-right
LogoGitHub - TCM-Course-Resources/Windows-Privilege-Escalation-Resources: Compilation of Resources from TCM's Windows Priv Esc Udemy CourseGitHubchevron-right
TCM Course Resources

PreviousPrivilege Escalationchevron-leftNextInitial Enumerationchevron-right

Last updated 22 days ago

  • Check if we are admin
  • Living of the land GTFO Bins for Windows
  • Enumeration with Winpeas
  • Enumeration with powerup.ps1
  • Getsystem Meterpreter
  • Windows compiled exploits
  • Good Resources and Cheetsheets
wget https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/blob/a17f91745cafc5fa43a428d766294190c0ff70a1/winPEAS/winPEASexe/binaries/x86/Release/winPEASx86.exe
https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1
upload /root/PowerSploit/Privesc/PowerUp.ps1
load Powershell
powershell_shell
.\PowerUp.ps1
Invoke-Allchecks