- There are various ways of locally escalating privileges on Windows box:
– Missing patches
– Automated deployment and AutoLogon passwords in clear text
– AlwaysInstallElevated (Any user can run MSI as SYSTEM)
– Misconfigured Services
– DLL Hijacking and more
– NTLM Relaying a.k.a. Won't Fix
Run all checks from :
- PowerUp
Invoke-AllChecks
– Privesc:
Invoke-PrivEsc
– PrivescCheck:
Invoke-Privesc Check
– PEASS-ng:
winPEASx64.exe
Unattended Windows Installations
Powershell History
Saved Windows Credentials
IIS Configuration
Retrieve Credentials from Software: PuTTY
Scheduled Tasks
AlwaysInstallElevated
Windows Services
Unquoted Service Paths
Insecure Service Permissions
Windows Privileges
Unpatched Software
Abusing SeLoadDriverPrivilege
Groups
Service Binary Hijacking
Useful Tools
cheat sheet
Initial Enumeration