Windows Privilege Escalation Cheatsheet: Your Ultimate Guide for Pentesters
Initial Reconnaissance for Windows Privilege Escalation
Before you can escalate privileges, you need to understand the environment you're in. This initial reconnaissance phase is critical for identifying potential attack vectors and will dictate your next steps. Don't skip it; thorough enumeration saves a lot of time later.Enumerating System Information and User Privileges
Start by gathering basic system and user information. This tells you what you're up against and what your current capabilities are. * **System Information:**The systeminfo command provides a wealth of details about the operating system, including version, build number, installed hotfixes, and system uptime. This is invaluable for identifying missing patches and potential kernel exploits.
systeminfoSpecifically look for the "OS Version," "OS Build," and "Hotfix(s)" sections.
* **User and Group Information:**Knowing your current user's privileges and local group memberships is fundamental. Are you a member of a privileged group, even if not an Administrator?
whoami /priv
whoami /groups
net user
net localgroup administrators
net localgroup "Remote Desktop Users"
net localgroup "Backup Operators" The whoami /priv command lists the privileges held by the current user. Look for interesting ones like SeDebugPrivilege, SeImpersonatePrivilege, or SeTakeOwnershipPrivilege. These often lead directly to privilege escalation. net user and net localgroup help map out the local users and their group memberships, revealing other potential targets or pathways.
Sometimes, sensitive information like passwords or API keys are stored in environment variables.
setIdentifying Running Processes and Services
Processes and services often run with elevated privileges and can be misconfigured. Understanding what's running is a key part of your Windows privilege escalation strategy. * **Running Processes:**The tasklist command shows all running processes. Use the /svc switch to see associated services, which might reveal services running with higher privileges.
tasklist /svc
tasklist /v /fo listLook for processes running as SYSTEM or Administrator. Pay attention to their associated modules and paths. The /v (verbose) and /fo list (format output as list) switches give you more details.
The sc query command lets you query service configurations. You're particularly interested in services configured to run automatically or as SYSTEM.
sc query state= all | findstr "SERVICE_NAME DISPLAY_NAME STATE"Once you identify a service of interest, query its specific configuration:
sc qc Look for the BINARY_PATH_NAME and SERVICE_START_NAME (the account the service runs as). This is crucial for identifying unquoted service paths or weak service permissions.
Checking Network Configuration and Shares
Network settings can expose vulnerabilities or provide access to other systems that might have misconfigurations. * **IP Configuration:**ipconfig /allThis reveals network adapters, IP addresses, DNS servers, and potentially domain information. Knowing the network layout is essential.
* **Active Network Connections:**netstat -anoLists all active connections and listening ports, along with the PID of the process. This can reveal services listening locally or externally, or connections to other internal systems. Use tasklist | findstr to map PIDs to processes.
net shareIdentifies shared folders on the system. Check permissions on these shares; sometimes sensitive files are exposed.
Key Takeaway: Thorough initial reconnaissance with native Windows commands is your foundational step. It helps paint a clear picture of the target system's vulnerabilities, guiding your Windows privilege escalation efforts effectively.
Common Windows Privilege Escalation Vectors
Now that you've enumerated the system, it's time to dig into specific vulnerabilities. These are some of the most frequently encountered Windows privilege escalation techniques in real-world scenarios.Unquoted Service Paths
This is a classic. If a service's executable path contains spaces and isn't enclosed in quotes, Windows might misinterpret the path, attempting to execute an application at an intermediate directory. * **How it Works:**Consider a service path: C:\Program Files\My Application\service.exe. If unquoted, Windows might try to execute C:\Program.exe, then C:\Program Files\My.exe, and so on, before reaching the intended executable. If you can place a malicious executable (e.g., Program.exe) in one of these intermediate directories with appropriate permissions, the service will execute it with its own privileges (often SYSTEM).
Use wmic to query services and filter for unquoted paths running automatically:
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """This command lists services configured to start automatically, excludes Windows system services, and filters for paths not enclosed in double quotes.
* **Exploitation:**If you find a vulnerable service, check if you have write permissions to any of the intermediate directories (e.g., C:\ or C:\Program Files\). If so, compile a malicious executable (like a reverse shell) named to match the potential misinterpretation (e.g., Program.exe) and place it in the highest-level writable directory. Restart the service or wait for the next system reboot/service start.
Weak Service Permissions
Services often run with elevated privileges (SYSTEM, LocalSystem, Administrator). If you can modify a service's configuration or replace its executable, you can escalate. * **How it Works:**If a low-privileged user has write permissions to a service's executable file or its configuration (e.g., the registry key for the service), they can replace the legitimate executable with a malicious one or reconfigure the service to run a different binary.
* **Finding Vulnerable Services:**After finding services of interest with sc qc , check the permissions on the service executable's path using icacls:
icacls "C:\Program Files\VulnerableApp\service.exe"Look for `(M)` (modify) or `(F)` (full control) permissions for your current user or a group you belong to. You can also check permissions on the service's registry key: HKLM\SYSTEM\CurrentControlSet\Services\.
If you have write access to the executable, replace it with your malicious payload. If you have write access to the service's registry key, you can change the ImagePath to point to your payload. Then, restart the service to execute your payload with the service's privileges.
AlwaysInstallElevated
This misconfiguration allows any user to install Windows Installer (MSI) packages with SYSTEM privileges. * **How it Works:**Two specific registry keys, one in HKLM and one in HKCU, enable this. If both are set to 1, the MSI engine will install packages with elevated privileges, regardless of the user's actual permissions.
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevatedIf both commands return a value of 0x1, this vector is exploitable.
Create a malicious MSI package (e.g., using `msfvenom` or `DarkSide-MSI`) that adds a new administrator user or executes a reverse shell. Then, install it:
msiexec /qn /i C:\Path\To\Malicious.msiDLL Hijacking
Many applications and services load dynamic-link libraries (DLLs) from specific paths. If a required DLL is missing, or if an application looks for a DLL in a directory you can write to before checking secure system directories, you might be able to inject your own malicious DLL. * **How it Works:**An application attempts to load malicious.dll. If it searches in a user-writable directory (like its current working directory or a path in the `PATH` environment variable) before the system directories, you can place your own malicious.dll there. When the application starts, it loads your DLL, executing your code with the application's privileges.
Use tools like `Procmon` (Process Monitor) from Sysinternals to monitor applications for "NAME NOT FOUND" errors when trying to load DLLs. This indicates a missing DLL that could be hijacked. Look for applications running with elevated privileges.
* **Exploitation:**Create a malicious DLL (e.g., a reverse shell) named after the missing DLL. Place it in the directory where the application is searching first and has write permissions. When the application starts, it will load your DLL.
Stored Credentials (Registry, Files)
Windows systems often store credentials in various locations, including the registry, configuration files, and even in memory. Finding these can provide direct access or allow you to impersonate a higher-privileged user. * **Searching the Registry:**The registry can hold plaintext passwords, hashes, or other sensitive data. Look for common keywords.
reg query HKLM /f password /t REG_SZ /s
reg query HKLM /f credential /t REG_SZ /sThese commands search the entire `HKLM` hive for entries containing "password" or "credential".
* **Unattended Installation Files:**Files like unattend.xml or sysprep.xml (often found in C:\Windows\Panther, C:\Windows\System32\sysprep) can contain plaintext administrator passwords used during system setup.
dir /s C:\unattend.xml
dir /s C:\Windows\Panther\unattend.xml
dir /s C:\Windows\System32\sysprep\unattend.xmlMany applications store database credentials, API keys, or service account details in their configuration files (e.g., XML, INI, TXT). Search common application directories.
findstr /si password *.config *.xml *.ini *.txtThis command searches for "password" in common configuration file types recursively.
* **Cached Credentials:**The `cmdkey` command can list cached credentials for network resources.
cmdkey /listKey Takeaway: Many Windows privilege escalation vectors rely on misconfigurations rather than complex exploits. Focus on identifying weak permissions, unquoted paths, and cached credentials first, as these are often the easiest wins.
Kernel Exploits and Missing Patches for Windows Privilege Escalation
Sometimes, misconfigurations aren't enough, and you need to leverage a vulnerability in the Windows kernel itself. This usually involves identifying missing security updates. * **How it Works:**Microsoft regularly releases patches for vulnerabilities, including those in the kernel. If a system hasn't been updated, it might be susceptible to publicly known kernel exploits that can grant SYSTEM privileges.
* **Identifying Missing Patches:**You've already used `systeminfo` to list installed hotfixes. Now, you need to compare this list against known vulnerabilities for that specific Windows version.
* **Tools for Patch Analysis:**| Tool | Description | Usage |
|---|---|---|
| Sherlock | A PowerShell script that quickly identifies missing software patches for local privilege escalation vulnerabilities. | Import-Module .\Sherlock.ps1; Find-AllVulns |
| Windows-Exploit-Suggester | A Python script that takes the output of systeminfo and compares it against a Microsoft vulnerability database to suggest potential exploits. |
Requires `systeminfo` output, then `python windows-exploit-suggester.py --database |
| Watson | A .NET tool that enumerates missing KBs and suggests exploits. Similar to Sherlock but often more comprehensive. | Watson.exe |
Once you identify a potential CVE (Common Vulnerabilities and Exposures) through these tools, search Exploit-DB or similar databases for a matching exploit code. Often, these exploits are written in C/C++ and need to be compiled and executed on the target system. Remember to transfer and compile carefully.
Key Takeaway: Kernel exploits are powerful but require precision. Tools like Sherlock and Windows-Exploit-Suggester automate the discovery of missing patches, significantly reducing the manual effort in finding potential kernel-level Windows privilege escalation paths.
Post-Exploitation Tools and Techniques for Windows Privilege Escalation
While native commands are essential for initial recon, specialized tools make the post-exploitation phase more efficient and powerful.PowerShell Scripts: PowerUp.ps1
PowerUp is part of the PowerSploit framework and is specifically designed for Windows privilege escalation checks. It automates many of the manual checks we discussed earlier. * **Key Functions:** * `Get-ServiceUnquoted`: Identifies unquoted service paths. * `Get-ServicePermissions`: Checks for weak permissions on services. * `Get-ModifiablePath`: Finds directories where you can write files that are executed by privileged processes. * `Get-RegistryAlwaysInstallElevated`: Checks the `AlwaysInstallElevated` registry keys. * `Invoke-AllChecks`: Runs all available checks and reports potential privilege escalation vectors. * **Usage:**powershell.exe -nop -ep bypass
. .\PowerUp.ps1
Invoke-AllChecksThis will run all checks and print out potential vulnerabilities. It's a fantastic starting point for automated enumeration.
Metasploit Framework
Metasploit is a go-to tool for exploitation and post-exploitation, including various Windows privilege escalation modules. If you've got a Meterpreter session, you're in a great position. For a deeper dive into Metasploit, you should check out our Metasploit Tutorial for Pentesters. * **Key Modules/Commands:** * `getsystem`: This Meterpreter command attempts several techniques (e.g., service abuse, token impersonation) to elevate to SYSTEM. It's often the first thing you try. * `exploit/windows/local/ask`: Prompts the user for UAC bypass. * `exploit/windows/local/bypassuac_*`: Various modules to bypass User Account Control. * `exploit/windows/local/service_permissions`: Exploits weak service permissions. * `exploit/windows/local/unquoted_service_path`: Targets unquoted service paths. * `post/windows/gather/enum_logged_on_users`: Lists users currently logged into the system. * `post/windows/gather/enum_patches`: Lists installed patches (similar to `systeminfo`). * **Usage Example (Meterpreter):**meterpreter > getsystem
meterpreter > load incognito
meterpreter > list_tokens -u
meterpreter > impersonate_token "NT AUTHORITY\SYSTEM"The `incognito` module allows for token impersonation, which is another powerful Windows privilege escalation technique if you find a token for a highly privileged user.
Mimikatz
Mimikatz is an infamous tool for extracting plaintext passwords, hash values, PIN codes, and Kerberos tickets from memory. It's an essential tool for credential dumping and often leads to lateral movement or further privilege escalation. We have a dedicated, detailed guide on it: Mimikatz Tutorial: A Deep Dive for Pentesters & Red Teamers. * **Key Commands:** * `privilege::debug`: Enables debug privileges for Mimikatz. * `sekurlsa::logonpasswords`: Dumps all available credentials from memory, including plaintext passwords for logged-on users, NTLM hashes, and Kerberos tickets. * `lsadump::sam`: Extracts local SAM database hashes. * `kerberos::list`: Lists Kerberos tickets. * `dpapi::masterkey`: Recovers DPAPI master keys. * **Usage (from a shell, often requires administrative privileges to run effectively):**mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exitRunning Mimikatz often requires high integrity, so you'll typically use it after an initial privilege escalation. The output from `sekurlsa::logonpasswords` is gold for further attacks.
Key Takeaway: Specialized tools like PowerUp and Metasploit streamline the search for Windows privilege escalation vectors, while Mimikatz is indispensable for extracting credentials that can lead to further compromise.
Best Practices for Preventing Windows Privilege Escalation
As pentesters, our job isn't just to break in, but also to advise on how to secure systems. Understanding prevention helps you understand where vulnerabilities often lie. 1. **Principle of Least Privilege (PoLP):** Grant users and services only the minimum permissions necessary to perform their functions. Don't run services as `SYSTEM` if `Network Service` or `Local Service` is sufficient. Don't make users local administrators unless absolutely required. 2. **Regular Patch Management:** Keep operating systems and all installed software (especially third-party applications) up to date with the latest security patches. This prevents many kernel exploits and known application vulnerabilities. Implement a robust patch management process. 3. **Strong Permissions Management:** Regularly audit file system and registry permissions. Ensure that only authorized users/groups have write access to critical system directories, service executables, and registry keys. Use `icacls` to review and enforce permissions. 4. **Application Whitelisting:** Implement application whitelisting solutions (e.g., AppLocker, Windows Defender Application Control) to prevent unauthorized executables, scripts, or DLLs from running, even if placed by a low-privileged attacker. This significantly mitigates unquoted service path, weak service permission, and DLL hijacking attacks. 5. **User Account Control (UAC):** Keep UAC enabled and configured appropriately. While UAC is not a security boundary, it forces applications to request elevation, making it harder for malware or attackers to silently gain administrative rights. 6. **Secure Credential Storage:** Avoid storing plaintext passwords in configuration files, scripts, or environment variables. Use secure credential management solutions, secrets management, or Windows Credential Manager where appropriate. Limit the use of cached credentials. 7. **Monitor and Log:** Implement robust logging and monitoring for security-critical events (e.g., service creation/modification, logon failures, privilege changes). Tools like Sysmon can provide enhanced visibility into system activity, helping detect anomalous behavior indicative of Windows privilege escalation attempts.By focusing on these best practices, organizations can significantly reduce their attack surface and make it much harder for attackers to achieve Windows privilege escalation.
Frequently Asked Questions
What is Windows Privilege Escalation?
Windows privilege escalation is the unauthorized act of gaining higher-level access to a Windows system than initially obtained. This typically involves moving from a standard user account to an Administrator or SYSTEM account, allowing for greater control and impact on the compromised machine.
What are the most common Windows privilege escalation techniques?
Some of the most common techniques include exploiting unquoted service paths, weak service permissions, misconfigured AlwaysInstallElevated registry settings, DLL hijacking, finding stored credentials in files or the registry, and leveraging missing security patches for known kernel vulnerabilities.
What tools are essential for Windows privilege escalation?
Essential tools for Windows privilege escalation include native Windows commands (like systeminfo, tasklist, sc, icacls), PowerShell scripts like PowerUp.ps1, the Metasploit Framework, and credential dumping tools such as Mimikatz.
How can I prevent Windows privilege escalation on my systems?
Preventing Windows privilege escalation involves adhering to the Principle of Least Privilege, maintaining a rigorous patch management schedule, enforcing strong file and registry permissions, implementing application whitelisting, keeping UAC enabled, and effectively monitoring system logs for suspicious activity.