# Windows privilege escalation

## Manual enumeration

### User

```
whoami
net user username
```

### Other Users

```
net user
```

### Privileges

```
whoami /priv
```

### Hostname

```
hostname
```

### OS and architecture

```
systeminfo
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"
```

### Processes and services

```
tasklist /SVC
```

### Network

```
ipconfig /all (interfaces)
route print (routing table)
netstat -ano (active connections)
arp -a
```

### Firewall/AV status

```
sc query windefend
sc query type=service
netsh
netsh advfirewall show rule name -all
netsh advfirewall dump
netsh firewall show state
netsh advfirewallshow currentprofile
```

### Applications/patch levels/drivers/kernel modules

```
wmic product get name
wmic product get version
wmic product get vendor
wmic product get name, version, vendor
wmic qfe
wmic qfe get Caption, Description, HotFixID, InstalledOn
(PS) driverquery.exe /v /fo csv |ConvertFrom -CSV | Select-Object 'Display Name', 'Start Mode', Path
(PS) Get-WmiObject Win32_PnPSignedDriver | Select-Object DeviceName, DeviceVersion, Manufacturer | Where-Object {$_.DeviceName -like "*VMWare*"} 
```

### Readable/writeable directories

```
accesschk.exe -uws "Everyone" "C:\Program Files"   (SysInternalsSuite)
(PS) Get-ChildItem "C:\Program Files" -Recurse | Get-ACL | ?{$_.AccessToString-match "Everyone\sAllow\s\sModify"}
```

### Mounted/unmounted disks

```
mountvol
wmic logicaldisk
list drives
```

### Passwords

```
findstr /si password *.txt
findstr /si password *.xml
findstr /si password *.ini
dir /s *pass* == *cred* == *vnc* == *.config*
findstr /spin “password” *.*
```

### Scheduled tasks

```
schtasks /query /FO LIST /v
```

### Binaries that auto elevate

```
reg query HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer
reg query HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer
```

## Automated tools

```
winPEAS.exe
PowerUp.ps1
windows-exploit-suggester.py
Metasploit - post/multi/recon/local_exploit_suggester
```

### windows-exploit-suggester.py

* Run `systeminfo` and save the output into a text document 
* Update the database - `./windows-exploit-suggester.py --update` 
* .`/windows-exploit-suggester.py --database DBNameHere --systeminfo filepath.txt`

### Metasploit exploit suggester

* Background session `background`
* Select exploit to use
* Set Session
* Set LHOST and LPORT
* Run