Windows Local Privilege Escalation
Best tool to look for Windows local privilege escalation vectors: WinPEAS****
If you want to know about my latest modifications/additions, join the PEASS & HackTricks telegram group here. If you want to share some tricks with the community you can also submit pull requests to **[https://github.com/carlospolop/hacktricks**](https://github.com/carlospolop/hacktricks) **that will be reflected in this book. Don't forget to give ⭐ on the github** to motivate me to continue developing this book.
Initial Windows Theory
Access Tokens
If you don't know what are Windows Access Tokens, read the following page before continuing:
Access TokensACLs - DACLs/SACLs/ACEs
If you don't know what is any of the acronyms used in the heading of this section, read the following page before continuing:
ACLs - DACLs/SACLs/ACEsIntegrity Levels
If you don't know what are integrity levels in Windows you should read the following page before continuing:
Integrity LevelsSystem Info
Version info enumeration
Check if the Windows version has any known vulnerability (check also the patches applied).
Version Exploits
On the system
post/windows/gather/enum_patches
post/multi/recon/local_exploit_suggester
winpeas (Winpeas has watson embedded)
Locally with system infromation
Github repos of exploits:
Environment
Any credential/Juicy info saved in the env variables?
PowerShell History
PowerShell Transcript files
You can learn how to turn this on in https://sid-500.com/2017/11/07/powershell-enabling-transcription-logging-by-using-group-policy/
PowerShell Module Logging
It records the pipeline execution details of PowerShell. This includes the commands which are executed including command invocations and some portion of the scripts. It may not have the entire detail of the execution and the output results. You can enable this following the link of the last section (Transcript files) but enabling "Module Logging" instead of "Powershell Transcription".
To view the last 15 events from PowersShell logs you can execute:
PowerShell Script Block Logging
It records block of code as they are executed therefore it captures the complete activity and full content of the script. It maintains the complete audit trail of each activity which can be used later in forensics and to study the malicious behavior. It records all the activity at time of execution thus provides the complete details.
The Script Block logging events can be found in Windows Event viewer under following path: Application and Sevices Logs > Microsoft > Windows > Powershell > Operational To view the last 20 events you can use:
Internet Settings
Drives
WSUS
You can compromise the system if the updates are not requested using httpS but http.
You start by checking if the network uses a non-SSL WSUS update by running the following:
If you get a reply such as:
And if HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v UseWUServer
is equals to 1
.
Then, it is exploitable. If the last registry is equals to 0, then, the WSUS entry will be ignored.
In orther to exploit this vulnerabilities you can use tools like: Wsuxploit, pyWSUS - These are MiTM weaponized exploits scripts to inject 'fake' updates into non-SSL WSUS traffic.
Read the research here:
WSUS CVE-2020-1013
****Read the complete report here. Basically, this is the flaw that this bug exploits:
If we have the power to modify our local user proxy, and Windows Updates uses the proxy configured in Internet Explorer’s settings, we therefore have the power to run PyWSUS locally to intercept our own traffic and run code as an elevated user on our asset.
Furthermore, since the WSUS service uses the current user’s settings, it will also use its certificate store. If we generate a self-signed certificate for the WSUS hostname and add this certificate into the current user’s certificate store, we will be able to intercept both HTTP and HTTPS WSUS traffic. WSUS uses no HSTS-like mechanisms to implement a trust-on-first-use type validation on the certificate. If the certificate presented is trusted by the user and has the correct hostname, it will be accepted by the service.
You can exploit this vulnerability using the tool WSUSpicious (once it's liberated).
AlwaysInstallElevated
If these 2 registers are enabled (value is 0x1), then users of any privilege can install (execute) *.msi
files as NT AUTHORITY*SYSTEM*.
Metasploit payloads
If you have a meterpreter session you can automate this technique using the module exploit/windows/local/always_install_elevated
PowerUP
Use the Write-UserAddMSI
command from power-up to create inside the current directory a Windows MSI binary to escalate privileges. This script writes out a precompiled MSI installer that prompts for a user/group addition (so you will need GIU access):
Just execute the created binary to escalate privileges.
MSI Wrapper
Read this tutorial to learn how to create a MSI wrapper using this tools. Note that you can wrap a ".bat" file if you just want to execute command lines
MSI WrapperCreate MSI with WIX
Create MSI with WIXMSI Installation
To execute the installation of the malicious .msi
file in background:
To exploit this vulnerability you can use: exploit/windows/local/always_install_elevated
Antivirus and Detectors
Audit Settings
These settings decide what is being logged, so you should pay attention
WEF
Windows Event Forwarding, is interesting to know where are the logs sent
LAPS
LAPS allows you to manage the local Administrator password (which is randomised, unique, and changed regularly) on domain-joined computers. These passwords are centrally stored in Active Directory and restricted to authorised users using ACLs. Passwords are protected in transit from the client to the server using Kerberos v5 and AES.
When using LAPS, 2 new attributes appear in the computer objects of the domain: ms-msc-AdmPwd and ms-mcs-AdmPwdExpirationTime. These attributes contains the plain-text admin password and the expiration time. Then, in a domain environment, it could be interesting to check which users can read these attributes...
WDigest
If active, plain-text passwords are stored in LSASS (Local Security Authority Subsystem Service). More info about WDigest in this page.
LSA Protection
Microsoft in Windows 8.1 and later has provided additional protection for the LSA to prevent untrusted processes from being able to read its memory or to inject code. More info about LSA Protection here.
Credentials Guard
Credential Guard is a new feature in Windows 10 (Enterprise and Education edition) that helps to protect your credentials on a machine from threats such as pass the hash. **[More info about Credentials Guard here.*](../stealing-credentials/credentials-protections.md#credential-guard)\***
Cached Credentials
Domain credentials are used by operating system components and are authenticated by the Local Security Authority (LSA). Typically, domain credentials are established for a user when a registered security package authenticates the user's logon data. More info about Cached Credentials here.
AV
Check is there is any anti virus running:
AppLocker Policy
Check which files/extensions are blacklisted/whitelisted.
Useful Writable folders to bypass AppLocker Policy
UAC
UAC is used to allow an administrator user to not give administrator privileges to each process executed. This is achieved using default the low privileged token of the user. More information about UAC here.
Users & Groups
Enumerate Users & Groups
You should check if any of the groups where you belong have interesting permissions
Privileged groups
If you belongs to some privileged group you may be able to escalate privileges. Learn about privileged groups and how to abuse them to escalate privileges here:
Privileged Accounts and Token PrivilegesToken manipulation
Learn more about what is a token in this page: Windows Tokens. Check the following page to learn about interesting tokens and how to abuse them:
Privilege Escalation Abusing TokensLogged users / Sessions
Home folders
Password Policy
Get the content of the clipboard
Running Processes
File and Folder Permissions
First of all, listing the processes check for passwords inside the command line of the process. Check if you can overwrite some binary running or if you have write permissions of the binary folder to exploit possible DLL Hijacking attacks:
Always check for possible electron/cef/chromium debuggers running, you could abuse it to escalate privileges.
Checking permissions of the processes binaries
Checking permissions of the folders of the processes binaries (DLL Hijacking)
Memory Password mining
You can create a memory dump of a running process using procdump from sysinternals. Services like FTP have the credentials in clear text in memory, try to dump the memory and read the credentials.
Insecure GUI apps
Applications running as SYSTEM may allow an user to spawn a CMD, or browse directories.
Example: "Windows Help and Support" (Windows + F1), search for "command prompt", click on "Click to open Command Prompt"
Services
Get a list of services:
Permissions
You can use sc to get information of a service
It is recommended to have the binary accesschk from Sysinternals to check the required privilege level for each service.
It is recommended to check if "Authenticated Users" can modify any service:
You can download accesschk.exe for XP for here
Enable service
If you are having this error (for example with SSDPSRV):
System error 1058 has occurred. The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
You can enable it using
Take into account that the service upnphost depends on SSDPSRV to work (for XP SP1)
Another workaround of this problem is running:
Modify service binary path
If the group "Authenticated users" has SERVICE_ALL_ACCESS in a service, then it can modify the binary that is being executed by the service. To modify it and execute nc you can do:
Restart service
Other Permissions can be used to escalate privileges: SERVICE_CHANGE_CONFIG Can reconfigure the service binary WRITE_DAC: Can reconfigure permissions, leading to SERVICE_CHANGE_CONFIG WRITE_OWNER: Can become owner, reconfigure permissions GENERIC_WRITE: Inherits SERVICE_CHANGE_CONFIG GENERIC_ALL: Inherits SERVICE_CHANGE_CONFIG
To detect and exploit this vulnerability you can use exploit/windows/local/service_permissions
Services binaries weak permissions
Check if you can modify the binary that is executed by a service or if you have write permissions on the folder where the binary is located (DLL Hijacking). You can get every binary that is executed by a service using wmic (not in system32) and check your permissions using icacls:
You can also use sc and icacls:
Services registry modify permissions
You should check if you can modify any service registry. You can check your permissions over a service registry doing:
Check if Authenticated Users or NT AUTHORITY\INTERACTIVE have FullControl. In that case you can change the binary that is going to be executed by the service.
To change the Path of the binary executed:
Services registry AppendData/AddSubdirectory permissions
If you have this permission over a registry this means to you can create sub registries from this one. In case of Windows services this is enough to execute arbitrary code:
AppendData/AddSubdirectory permission over service registryUnquoted Service Paths
If the path to an executable is not inside quotes, Windows will try to execute every ending before a space.
For example, for the path C:\Program Files\Some Folder\Service.exe Windows will try to execute:
To list all unquoted service paths (minus built-in Windows services)
You can detect and exploit this vulnerability with metasploit: exploit/windows/local/trusted_service_path You can manually create a service binary with metasploit:
Applications
Installed Applications
Check permissions of the binaries (maybe you can overwrite one and escalate privileges) and of the folders (DLL Hijacking).
Write Permissions
Check if you can modify some config file to read some special file or if you can modify some binary that is going to be executed by an Administrator account (schedtasks).
A way to find weak folder/files permissions in the system is doing:
Run at startup
Check if you can overwrite some registry or binary that is going to be executed by a different user. Read the following page to learn more about interesting autoruns locations to escalate privileges:
Privilege Escalation with AutorunsDrivers
Look for possible third party weird/vulnerable drivers
PATH DLL Hijacking
If you have write permissions inside a folder present on PATH you could be able to hijack a DLL loaded by a process and escalate privileges.
Check permissions of all folders inside PATH:
Network
Shares
hosts file
Check for other known computers hardcoded on the hosts file
Network Interfaces & DNS
Open Ports
Check for restricted services from the outside
Routing Table
ARP Table
Firewall Rules
****Check this page for Firewall related commands (list rules, create rules, turn off, turn off...)
More commands for network enumeration here
Windows Subsystem for Linux (wsl)
Binary bash.exe
can also be found in C:\Windows\WinSxS\amd64_microsoft-windows-lxssbash_[...]\bash.exe
If you get root user you can listen on any port (the first time you use nc.exe
to listen on a port it will ask via GUI if nc
should be allowed by the firewall).
To easily start bash as root, you can try --default-user root
You can explore the WSL
filesystem in the folder C:\Users\%USERNAME%\AppData\Local\Packages\CanonicalGroupLimited.UbuntuonWindows_79rhkp1fndgsc\LocalState\rootfs\
Windows Credentials
Winlogon Credentials
Credentials manager / Windows vault
From https://www.neowin.net/news/windows-7-exploring-credential-manager-and-windows-vault The Windows Vault stores user credentials for servers, websites and other programs that Windows can log in the users automatically. At first instance, this might look like now users can store their Facebook credentials, Twitter credentials, Gmail credentials etc., so that they automatically log in via browsers. But it is not so.
Windows Vault stores credentials that Windows can log in the users automatically, which means that any Windows application that needs credentials to access a resource (server or a website) can make use of this Credential Manager & Windows Vault and use the credentials supplied instead of users entering the username and password all the time.
Unless the applications interact with Credential Manager, I don't think it is possible for them to use the credentials for a given resource. So, if your application wants to make use of the vault, it should somehow communicate with the credential manager and request the credentials for that resource from the default storage vault.
Use the cmdkey
to list the stored credentials on the machine.
Then you can use runas
with the /savecred
options in order to use the saved credentials. The following example is calling a remote binary via an SMB share.
Using runas
with a provided set of credential.
Note that mimikatz, lazagne, credentialfileview, VaultPasswordView, or from Empire Powershells module.
DPAPI
In theory, the Data Protection API can enable symmetric encryption of any kind of data; in practice, its primary use in the Windows operating system is to perform symmetric encryption of asymmetric private keys, using a user or system secret as a significant contribution of entropy.
DPAPI allows developers to encrypt keys using a symmetric key derived from the user's logon secrets, or in the case of system encryption, using the system's domain authentication secrets.
The DPAPI keys used for encrypting the user's RSA keys are stored under %APPDATA%\Microsoft\Protect\{SID}
directory, where {SID} is the Security Identifier of that user. The DPAPI key is stored in the same file as the master key that protects the users private keys. It usually is 64 bytes of random data. (Notice that this directory is protected so you cannot list it usingdir
from the cmd, but you can list it from PS).
You can use mimikatz module dpapi::masterkey
with the appropriate arguments (/pvk
or /rpc
) to decrypt it.
The credentials files protected by the master password are usually located in:
You can use mimikatz module dpapi::cred
with the appropiate /masterkey
to decrypt.
You can extract many DPAPI masterkeys from memory with the sekurlsa::dpapi
module (if you are root).
Wifi
Saved RDP Connections
You can find them on HKEY_USERS\<SID>\Software\Microsoft\Terminal Server Client\Servers\
and in HKCU\Software\Microsoft\Terminal Server Client\Servers\
Recently Run Commands
Remote Desktop Credential Manager
Use the Mimikatz dpapi::rdg
module with appropriate /masterkey
to decrypt any .rdg files
You can extract many DPAPI masterkeys from memory with the Mimikatz sekurlsa::dpapi
module
AppCmd.exe
Note that to recover passwords from AppCmd.exe you need to be Administrator and run under a High Integrity level.
AppCmd.exe is located in the %systemroot%\system32\inetsrv\
directory.
If this file exists then it is possible that some credentials have been configured and can be recovered.
This code was extracted from PowerUP:
SCClient / SCCM
Check if C:\Windows\CCM\SCClient.exe
exists .
Installers are run with SYSTEM privileges, many are vulnerable to DLL Sideloading (Info from https://github.com/enjoiz/Privesc).
Files and Registry (Credentials)
Putty Creds
Putty SSH Host Keys
SSH keys in registry
SSH private keys can be stored inside the registry key HKCU\Software\OpenSSH\Agent\Keys
so you should check if there is anything interesting in there:
If you find any entry inside that path it will probably be a saved SSH key. It is stored encrypted but can be easily decrypted using https://github.com/ropnop/windows_sshagent_extract. More information about this technique here: https://blog.ropnop.com/extracting-ssh-private-keys-from-windows-10-ssh-agent/
If ssh-agent
service is not running and you want it to automatically start on boot run:
It looks like this technique isn't valid anymore. I tried to create some ssh keys, add them with ssh-add
and login via ssh to a machine. The registry HKCU\Software\OpenSSH\Agent\Keys doesn't exist and procmon didn't identify the use of dpapi.dll
during the asymmetric key authentication.
Unattended files
You can also search for these files using metasploit: post/windows/gather/enum_unattend
Example content:
SAM & SYSTEM backups
Cloud Credentials
McAfee SiteList.xml
Search for a file called SiteList.xml
Cached GPP Pasword
Before KB2928120 (see MS14-025), some Group Policy Preferences could be configured with a custom account. This feature was mainly used to deploy a custom local administrator account on a group of machines. There were two problems with this approach though. First, since the Group Policy Objects are stored as XML files in SYSVOL, any domain user can read them. The second problem is that the password set in these GPPs is AES256-encrypted with a default key, which is publicly documented. This means that any authenticated user could potentially access very sensitive data and elevate their privileges on their machine or even the domain. This function will check whether any locally cached GPP file contains a non-empty "cpassword" field. If so, it will decrypt it and return a custom PS object containing some information about the GPP along with the location of the file.
Search in **_C:\ProgramData\Microsoft\Group Policy\history or in C:\Documents and Settings\All Users\Application Data\Microsoft\Group Policy\history** (previous to W Vista)_ for these files:
Groups.xml
Services.xml
Scheduledtasks.xml
DataSources.xml
Printers.xml
Drives.xml
To decrypt the cPassword:
IIS Web Config
Example of web.config with credentials:
OpenVPN credentials
Logs
Ask for credentials
You can always ask the user to enter his credentials of even the credentials of a different user if you think he can know them (notice that asking the client directly for the credentials is really risky):
Possible filenames containing credentials
Known files that some time ago contained passwords in clear-text or Base64
Search all of the proposed files:
Credentials in the RecycleBin
You should also check the Bin to look for credentials inside it
To recover passwords saved by several programs you can use: http://www.nirsoft.net/password_recovery_tools.html
Inside the registry
Other possible registry keys with credentials
Extract openssh keys from registry.****
Browsers History
You should check for dbs where passwords from Chrome or Firefox are stored. Also check for the history, bookmarks and favourites of the browsers so maybe some passwords are stored there.
Tools to extract passwords from browsers:
Mimikatz:
dpapi::chrome
SharpWeb****
Generic Password search in files and registry
Search for file contents
Search for a file with a certain filename
Search the registry for key names and passwords
Tools that search for passwords
MSF-Credentials Plugin is a msf plugin I have created this plugin to automatically execute every metasploit POST module that searches for credentials inside the victim. Winpeas automatically search for all the files containing passwords mentioned in this page. Lazagne is another great tool to extract password from a system.
The tool SessionGopher search for sessions, usernames and passwords of several tools that save this data in clear text (PuTTY, WinSCP, FileZilla, SuperPuTTY, and RDP)
Leaked Handlers
Imagine that a process running as SYSTEM open a new process (OpenProcess()
) with full access. The same process also create a new process (CreateProcess()
) with low privileges but inheriting all the open handles of the main process.
Then, if you have full access to the low privileged process, you can grab the open handle to the privileged process created with OpenProcess()
and inject a shellcode.
Read this example for more information about how to detect and exploit this vulnerability.
Read this other post for a more complete explanation on how to test and abuse more open handlers of processes and threads inherited with different levels of permissions (not only full access).
Named Pipe Client Impersonation
A pipe
is a block of shared memory that processes can use for communication and data exchange.
Named Pipes
is a Windows mechanism that enables two unrelated processes to exchange data between themselves, even if the processes are located on two different networks. It's very similar to client/server architecture as notions such as a named pipe server
and a named pipe client
exist.
When a client writes on a pipe, the server that created the pipe can impersonate the client if it has SeImpersonate privileges. Then, if you can find a privileged process that is going to write on any pipe that you can impersonate, you could be able to escalate privileges impersonating that process after it writes inside your created pipe. You can read this to learn how to perform this attack.
From Administrator Medium to High Integrity Level / UAC Bypass
****Read this to learn about Integrity Levels and this to learn what is UAC, then read how to bypass it.
From High Integrity to System
New service
If you are already running on a High Integrity process, the pass to SYSTEM can be easy just creating and executing a new service:
AlwaysInstallElevated
From a High Integrity process you could try to enable the AlwaysInstallElevated registry entries and install a reverse shell using a .msi wrapper. More information about the registry keys involved and how to install a .msi package here.
High + SeImpersonate privilege to System
You can find the code here.
From SeDebug + SeImpersonate to Full Token privileges
If you have those token privileges (probably you will find this in an already High Integrity process), you will be able to open almost any process (not protected processes) with the SeDebug privilege, copy the token of the process, and create an arbitrary process with that token. Using this technique is usually selected any process running as SYSTEM with all the token privileges (yes, you can find SYSTEM processes without all the token privileges). You can find an example of code executing the proposed technique here.
Named Pipes
This technique is used by meterpreter to escalate in getsystem
. The technique consists on creating a pipe and then create/abuse a service to write on that pipe. Then, the server that created the pipe using the SeImpersonate
privilege will be able to impersonate the token of the pipe client (the service) obtaining SYSTEM privileges.
If you want to learn more about name pipes you should read this.
If you want to read an example of how to go from high integrity to System using name pipes you should read this.
Dll Hijacking
If you manages to hijack a dll being loaded by a process running as SYSTEM you will be able to execute arbitrary code with those permissions. Therefore Dll Hijacking is also useful to this kind of privilege escalation, and, moreover, if far more easy to achieve from a high integrity process as it will have write permissions on the folders used to load dlls. You can learn more about Dll hijacking here.
From Administrator or Network Service to System
From LOCAL SERVICE or NETWORK SERVICE to full privs
Read: https://github.com/itm4n/FullPowers****
More help
Useful tools
Best tool to look for Windows local privilege escalation vectors: WinPEAS****
PS
****PowerSploit-Privesc(PowerUP) -- Check for misconfigurations and sensitive files (check here). Detected.
JAWS **-- Check for some possible misconfigurations and gather info (check here).
[privesc ](https://github.com/enjoiz/Privesc)-- Check for misconfigurations
[SessionGopher](https://github.com/Arvanaghi/SessionGopher) **-- It extracts PuTTY, WinSCP, SuperPuTTY, FileZilla, and RDP saved session information. Use -Thorough in local.
Invoke-WCMDump **-- Extracts crendentials from Credential Manager. Detected.
[DomainPasswordSpray](https://github.com/dafthack/DomainPasswordSpray) **-- Spray gathered passwords across domain
Inveigh **-- Inveigh is a PowerShell ADIDNS/LLMNR/mDNS/NBNS spoofer and man-in-the-middle tool.
[WindowsEnum](https://github.com/absolomb/WindowsEnum/blob/master/WindowsEnum.ps1) -- Basic privesc Windows enumeration
[~~Sherlock~~](https://github.com/rasta-mouse/Sherlock) ~~**-- Search for known privesc vulnerabilities (DEPRECATED for Watson)
[WINspect](https://github.com/A-mIn3/WINspect) ~~**-- Local checks (Need Admin rights)
Exe
Watson **-- Search for known privesc vulnerabilities (needs to be compiled using VisualStudio) ([precompiled](https://github.com/carlospolop/winPE/tree/master/binaries/watson)\)
[SeatBelt](https://github.com/GhostPack/Seatbelt) **-- Enumerates the host searching for misconfigurations (more a gather info tool than privesc) (needs to be compiled) (precompiled)
LaZagne **-- Extracts credentials from lots of softwares (precompiled exe in github)
[~~Beroot~~](https://github.com/AlessandroZ/BeRoot) ~~**-- Check for misconfiguration (executable precompiled in github). Not recommended. It does not work well in Win10.
[Windows-Privesc-Check~~](https://github.com/pentestmonkey/windows-privesc-check) -- Check for possible misconfigurations (exe from python). Not recommended. It does not work well in Win10.
Bat
****winPEASbat -- Tool created based in this post (it does not need accesschk to work properly but it can use it).
Local
Windows-Exploit-Suggester -- Reads the output of systeminfo and recommends working exploits (local python) Windows Exploit Suggester Next Generation -- Reads the output of systeminfo andrecommends working exploits (local python)
Meterpreter
multi/recon/local_exploit_suggestor
You have to compile the project using the correct version of .NET (see this). To see the installed version of .NET on the victim host you can do:
Bibliography
http://www.fuzzysecurity.com/tutorials/16.html http://www.greyhathacker.net/?p=738 http://it-ovid.blogspot.com/2012/02/windows-privilege-escalation.html https://github.com/sagishahar/lpeworkshop https://www.youtube.com/watch?v=_8xJaaQlpBo https://sushant747.gitbooks.io/total-oscp-guide/privilege_escalation_windows.html https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ https://github.com/netbiosX/Checklists/blob/master/Windows-Privilege-Escalation.md https://github.com/frizb/Windows-Privilege-Escalation https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/ https://github.com/frizb/Windows-Privilege-Escalation http://it-ovid.blogspot.com/2012/02/windows-privilege-escalation.html https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md#antivirus--detections
Last updated