> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation.md).
# Windows Privilege Escalation
This series covers all things Windows privilege escalation, an essential domain of penetration testing in production environments. While Mac and Linux may be desirable for developer environments in tech companies, Windows, is still the primary flavor of OS in corporate work environments ranging from financial and legal firms, construction management, and an assortment of industries. 99% of the clients I was managing as an IT consultant were... pause for effect... Windows! I hope these series of blog posts are helpful, they contain my slightly tidied word vomit of notes I've taken from the occasional rabbit holes and assortment of online and college courses.
{% hint style="danger" %}
Use this material only for education or authorized testing. Do not use it for unauthorized access, disruption, or any malicious activity.
{% endhint %}
## RR (Recommended Resources)
* [Windows Command Documentation](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/windows-commands)
* [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md)
* [InternalAllTheThings](https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/windows-privilege-escalation/#summary)
{% file src="/files/hnBw5A9C3oqPoNRTdIjm" %}
{% file src="/files/oWVd1CuCAiX3ejjjkEZE" %}
## Windows PE Tooling
| TOOL | USE CASE |
| ---------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [accesschk](https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk) | Determines what users and groups can access a given object. Useful flags: `-q` to omit the banner, `-u` to suppress errors, `-v` for verbose output, `-c` to target a Windows service, `-w` to show only writable objects, `-k` for registry objects, and `-s` to recurse |
| [diskshadow](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow) | Built-in Volume Shadow Copy Service utility for creating and exposing shadow copies. Useful for copying locked files such as `NTDS.dit` and registry hives from a consistent snapshot |
| [EnableAllTokenPrivs.ps1](https://raw.githubusercontent.com/fashionproof/EnableAllTokenPrivs/master/EnableAllTokenPrivs.ps1) | See this [blog ](https://medium.com/@markmotig/enable-all-token-privileges-a7d21b1a4a77)for more - enables all privileges assigned to a user. |
| [Ghostpack-CompiledBinaries](https://github.com/r3motecontrol/Ghostpack-CompiledBinaries) | A list of pre-compiled binaries |
| [icacls](https://ss64.com/nt/icacls.html) | Lists ACLs for a given file, folder, or other securable object |
| [Inveigh](https://github.com/Kevin-Robertson/Inveigh) | PowerShell tool for spoofing and credential capture on Windows networks. Useful for capturing NTLM challenge-response traffic during name resolution and forced-authentication attacks |
| [InveighZero](https://github.com/Kevin-Robertson/InveighZero) | C# version of Inveigh for performing LLMNR, NBNS, mDNS, DNS, and SMB credential-capture attacks from Windows hosts |
| [Invoke-Clipboard](https://github.com/inguardians/Invoke-Clipboard/blob/master/Invoke-Clipboard.ps1) | PowerShell script for monitoring a user's clipboard in real time and capturing copied credentials, commands, and other sensitive data |
| [JAWS](https://github.com/411Hall/JAWS) | PowerShell script for enumerating privilege escalation vectors written in PowerShell 2.0 |
| [Juicy Potato](/breakpoint/windows/windows-privilege-escalation/juicypotato.md) | Must have SeImpersonate or SeAssignPrimaryToken privileges - leverages privesc chain based on BITS service having the MiTM listener on localhost:6666.
JuicyPotato page
Based on tricking NT AUTHORITY\SYSTEM into authenticating via NTLM to a TCP endpoint we control. MiTM allows us to negotiate a security token for NT AUTHORITY\SYSTEM through a series of Windows API calls and then we can use the token to impersonate.
|
| [LaZagne](https://github.com/AlessandroZ/LaZagne) | Tool used for retrieving passwords stored on a local machine from web browsers, chat tools, databases, Git, email, memory dumps, PHP, sysadmin tools, wireless network configurations, internal Windows password storage mechanisms, and more.
|
| [lnkbomb](https://github.com/dievus/lnkbomb) | Generates malicious `.lnk` files that trigger outbound authentication when a user browses a directory, which can help capture NTLM credentials |
| [Net-Creds](https://github.com/DanMcInerney/net-creds) | Captures cleartext credentials and hashes from live network interfaces or PCAP files. Useful for finding passwords exposed by weak protocols or user activity |
| [Posh Privilege](https://www.powershellgallery.com/packages/PoshPrivilege/0.3.0.0/Content/Scripts%5CEnable-Privilege.ps1) | PowerShell script to enable privileges. You may also adjust token privileges using this [script](https://www.leeholmes.com/adjusting-token-privileges-in-powershell/) |
| [PowerUp](https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1) | PowerShell script for finding common Windows privesc vectors that rely on misconfigs. It can be used to exploit some of the issues found |
| [Procmon](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon) | Sysinternals Process Monitor. Useful for watching process, registry, file system, and command execution activity to spot credentials, unsafe file access, or exploitable behavior |
| [Responder](https://github.com/lgandx/Responder) | LLMNR, NBT-NS, and MDNS poisoner with built-in SMB, HTTP, and other rogue services for capturing or relaying NTLM authentication on local networks |
| [robocopy](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/robocopy) | Built-in file copy utility. Can copy protected files in backup mode with `/b` when the caller has `SeBackupPrivilege`, and is useful for reliably moving data out of shadow copies or restricted paths |
| [SeBackupPrivilege](https://github.com/giuliano108/SeBackupPrivilege) | PowerShell and DLL tooling for abusing `SeBackupPrivilege` to copy protected files by using backup semantics |
| [Seatbelt](https://github.com/GhostPack/Seatbelt) | C# project for performing a wide variety of local privesc checks |
| [SessionGopher](https://github.com/Arvanaghi/SessionGopher) | PowerShell tool that finds and decrypts saved session information for remote access tools. It extracts PuTTY, WinSCP, SuperPuTTY, FileZilla, and RDP saved session information |
| [SharpGPOAbuse](https://github.com/FSecureLABS/SharpGPOAbuse) | A .NET application written in C# that provides tools for manipulating vulnerable GPOs in order to compromise the objects controlled by those GPOs. |
| [SharpUp](https://github.com/GhostPack/SharpUp) | C# version of PowerUp |
| [Snaffler](https://github.com/SnaffCon/Snaffler) | For discovering sensitive information on Windows AD file shares. Spiders Windows stations on AD and their respective connected file shares, enumerating with Learned Artifactual Intelligence for Machines. |
| [symboliclink-testing-tools](https://github.com/googleprojectzero/symboliclink-testing-tools) | A set of binaries for examining and exploiting symbolic links, created by Google's Project Zero |
| [Sysinternals Suite](https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite) | We will use several tools from Sysinternals in our enumeration including [AccessChk](https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk), [PipeLis](https://docs.microsoft.com/en-us/sysinternals/downloads/pipelist)t, and [PsService](https://docs.microsoft.com/en-us/sysinternals/downloads/psservice) |
| [Watson](https://github.com/rasta-mouse/Watson) | Watson is a .NET tool designed to enumerate missing KBs and suggest exploits for PrivEsc vuln |
| [Windows Exploit Suggester - Next Generation](https://github.com/bitsadmin/wesng) | WES-NG is a tool based on the output of Windows' systeminfo utility which provides the list of vulnerabilities the OS is vulnerable to, including any exploits for these vulns. Every Windows OS b/w XP and 10, including their WinServer counterparts, is supported |
| [winPEAS](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS) | winPEAS is a script that searches for possible paths to esc privs on Windows hosts. All the checks are explained [here](https://book.hacktricks.wiki/en/windows-hardening/checklist-windows-privilege-escalation.html) |
## Glossary
| TERM | DEFINITION |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| gold image | generally the version of a cloned disk that can be used as a template for all other workstations for hardware virtualization - |
| .vhdx | a virtual hard drive - can be mounted on a local drive to browse the file system. May contain `SYSTEM`, `SAM`, and `SECURITY` registry hives |
| .vmdk | a virtual hard drive file - can be mounted similarly to a `.vhdx` |
| registry hive | the windows registry is divided into several logical sections a.k.a. hives. For example there exist `HKEY_LOCAL_MACHINE\SYSTEM`, `\SAM`, and `\SECURITY` hives. Secrets may be dumped from these using [secretsdump.py](https://github.com/fortra/impacket/blob/master/examples/secretsdump.py) |
| dual-homed | host server belongs to 2+ different networks and, in most cases, has several virtual or physical network interfaces. |
| DACL | Discretionary Access List, a permission of sorts\` |
| half-duplex | one-way connection |
| duplex | two-way connection |
| WPAD | Web Proxy Auto-Discovery protocol is a method to automatically configure a proxy setting for web clients. Devices that enable **Automatically detect settings** by default are susceptible to proxying attacks where a network will automatically proxy users network information to their own hosted device. |
| UAC | User Account Control are security features introduced with Windows Vista to default to restricting |
| Security Principal | Anything that can be authenticated by the Windows OS |
| SID | Security Identifier, given to every single security principal |
| ACE | Access Control Entry |