> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/htb-windows-privilege-escalation-skills-assessment-part-ii.md).
# HTB Windows Privilege Escalation Skills Assessment - Part II
## Overview
This walkthrough covers the second HTB Windows privilege escalation skills assessment.
The target is a Windows 10 gold image with RDP access, no local admin rights, and no internet access.
Your job is to enumerate the host, recover exposed credentials, and reach `SYSTEM`.
> As an add-on to their annual penetration test, the INLANEFREIGHT organization has asked you to perform a security review of their standard Windows 10 gold image build currently in use by over 1,200 of their employees worldwide. The new CISO is worried that best practices were not followed when establishing the image baseline, and there may be one or more local privilege escalation vectors present in the build. Above all, the CISO wants to protect the company's internal infrastructure by ensuring that an attacker who can gain access to a workstation through a phishing attack would be unable to escalate privileges and move laterally through the network. Due to regulatory requirements, INLANEFREIGHT employees do not have local administrator privileges on their workstations.
>
> You have been granted a standard user account with RDP access to a clone of a standard user Windows 10 workstation with no internet access. The client wants as comprehensive an assessment as possible. Defender has been disabled for this exercise. Due to regulatory controls, they cannot allow internet access to the host, so you will need to transfer any tools over yourself.
>
> Enumerate the host fully and attempt to escalate privileges to administrator or `SYSTEM` level access.
### Quick plan
I broke this into two tasks:
1. Search the host for exposed credentials.
2. Enumerate local privilege escalation paths.
The box is a standard-user workstation. That makes file discovery and local misconfiguration checks the fastest place to start.
### Objective 1 — Recover left-behind credentials
> Find left-behind cleartext credentials for the `iamtheadministrator` domain admin account.
Start with [Snaffler](https://github.com/SnaffCon/Snaffler).
It is a good first pass because it crawls common paths that often hold notes, scripts, config files, and copied credentials.
#### Transfer the tool
#### Run Snaffler
```powershell
C:\Users\htb-student> .\snaffler.exe -o snaffler.log -m C:\Users\htb-student\Desktop -i C:\
```
This writes the results to `snaffler.log` and scans the local drive from `C:\`.
The goal here is simple. Find anything that looks like a password, credential note, script, or copied admin workflow.
Review the output log for cleartext secrets and credential material. The useful hit here is the left-behind cleartext credential for `iamtheadministrator`.
### Objective 2 — Escalate to SYSTEM
> Escalate privileges to `SYSTEM` and submit the contents of `flag.txt` from the Administrator desktop.
For local enumeration, I used PowerSploit first.
This is a fast way to check for weak services, bad permissions, and policy issues from a low-privileged shell.
Transfer the project, extract it locally, and import the privilege escalation module.
#### Transfer PowerSploit
You do not need admin rights to use it.
Import the module directly from your working directory.
For quick module usage notes, see [PowerShell Module Basics](/breakpoint/windows/htb-windows-privilege-escalation-skills-assessment-part-ii/powershell-module-basics.md).
#### Import the module
Loading it locally is enough. It does not need to live in a global PowerShell modules path.
#### List available commands
This confirms the module imported correctly and shows which functions are available.
#### Run the privilege escalation audit
Use `Invoke-PrivescAudit` to identify misconfigurations worth exploiting.
The key finding here is `AlwaysInstallElevated`.
That setting is dangerous because it allows MSI packages to run with elevated rights. If both policy keys are enabled, a normal user can often install a malicious package as admin.
#### Attempt 1 — Generate and execute the MSI payload
Build the MSI, transfer it to the target, and execute it to land `SYSTEM`.
The first attempt did not work.
The issue was not the finding itself. The uploaded payload was not transferred cleanly.
When that happens, it is usually faster to pivot than to force the same path again.
#### Attempt 2 — Dump and crack local account hashes
The fallback was to extract local account material from the registry hives and crack it offline.
This works well when you can copy files off the target but your executable upload path is unreliable.
{% code title="Dumping local SAM hashes offline" %}
```bash
$ secretsdump.py -sam ./SAM -system ./SYSTEM local
[*] Target system bootKey: 0xfab4b2e32a415ea36f846b9408aa69af
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:7796ee39fd3a9c3a1844556115ae1a54:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:aad797e20ba0675bbcb3e3df3319042c:::
mrb3n:1001:aad3b435b51404eeaad3b435b51404ee:7796ee39fd3a9c3a1844556115ae1a54:::
htb-student:1002:aad3b435b51404eeaad3b435b51404ee:3c0e5d303ec88884ad5c3b7876a06ea6:::
wksadmin:1003:aad3b435b51404eeaad3b435b51404ee:5835048ce94ad0564e29a924a03510ef:::
[*] Cleaning up...
# Note that the NTLM hash is the 4th part, so you can copy or extract it likeso
$ echo "wksadmin:1003:aad3b435b51404eeaad3b435b51404ee:5835048ce94ad0564e29a924a03510ef:::" | cut -d":" -f4
5835048ce94ad0564e29a924a03510ef
```
{% endcode %}
`secretsdump.py` needs both `SAM` and `SYSTEM` here. The `SYSTEM` hive holds the boot key used to decrypt the hashes from `SAM`.
The NTLM hash is the fourth field in the output. That is the value worth sending to Hashcat.
#### Identify the hash type
{% embed url="" %}
This hash is standard NTLM, so the correct Hashcat mode is `1000`.
{% code title="Cracking the wksadmin hash" %}
```bat
> hashcat -a 0 -m 1000 .\wksadmin.hash ".\rockyou.txt"
hashcat (v7.1.2) starting
...
Dictionary cache hit:
* Filename..: .\rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
5835048ce94ad0564e29a924a03510ef:password1
...
```
{% endcode %}
That cracks the `wksadmin` NTLM hash to `password1`.
At that point, you have a reusable local admin credential and a clean path forward on the box.
### Why this path worked
Three things made this assessment straightforward:
* User data exposed cleartext credentials.
* Local policy exposed an `AlwaysInstallElevated` path.
* Offline hive dumping gave a strong fallback when file transfer got messy.
That pattern shows up often in labs and in real environments. Enumerate broadly, validate the easiest path first, and keep a second path ready when tooling or transfer fails.
