https://garrettoh.dev/notes/500-hacking/03_privilege_escalation/ Recent content in Priv Esc on Garrettoh's Research / Blog Hugo en-us https://garrettoh.dev/notes/500-hacking/03_privilege_escalation/linux_privesc/ Mon, 01 Jan 0001 00:00:00 +0000 https://garrettoh.dev/notes/500-hacking/03_privilege_escalation/linux_privesc/ https://garrettoh.dev/notes/500-hacking/03_privilege_escalation/windows_privesc/ Mon, 01 Jan 0001 00:00:00 +0000 https://garrettoh.dev/notes/500-hacking/03_privilege_escalation/windows_privesc/ <h2 id="tools-ezpz-but-loud">Tools (EZPZ but loud)</h2> <h4 id="touching-disk">Touching Disk</h4> <p>WinPeas &ndash; <a href="https://github.com/peass-ng/PEASS-ng/tree/master/winPEAS">WinPEAS</a> Usage - <code>winpeas.exe &gt; outputfile.txt</code></p> <p>PrivescCheck &ndash; <a href="https://github.com/itm4n/PrivescCheck">PrivescCheck (PS1)</a> Usage -</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-powershell" data-lang="powershell"><span class="line"><span class="cl"><span class="nb">Set-ExecutionPolicy</span> <span class="n">Bypass</span> <span class="n">-Scope</span> <span class="k">process</span> <span class="n">-Force</span> </span></span><span class="line"><span class="cl"><span class="p">.</span> <span class="p">.\</span><span class="n">PrivescCheck</span><span class="p">.</span><span class="py">ps1</span> </span></span><span class="line"><span class="cl"><span class="nb">Invoke-PrivescCheck</span> </span></span></code></pre></div><h4 id="no-disk">No Disk</h4> <p>WES-NG &ndash; <a href="https://github.com/bitsadmin/wesng">WES-NG</a> Usage</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-powershell" data-lang="powershell"><span class="line"><span class="cl"><span class="n">wes</span><span class="p">.</span><span class="py">py</span> <span class="p">-</span><span class="n">-update</span> <span class="c"># Attacker PC</span> </span></span><span class="line"><span class="cl"><span class="n">wes</span><span class="p">.</span><span class="py">py</span> <span class="n">systeminfo</span><span class="p">.</span><span class="py">txt</span> <span class="c"># Attacker PC</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="nb">echo </span><span class="n">systeminfo</span> <span class="p">&gt;</span> <span class="n">systeminfo</span><span class="p">.</span><span class="py">txt</span> <span class="c"># Victim PC</span> </span></span></code></pre></div><h4 id="easy-checks">Easy checks</h4> <p>Metasploit (if meterpreter shell)  <code>multi/recon/local_exploit_suggester</code></p> <h2 id="scheduled-tasks">Scheduled Tasks</h2> <p>If there is a task that you can modify or the binary is lost you can create one in its place</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-powershell" data-lang="powershell"><span class="line"><span class="cl"><span class="n">C:</span><span class="p">\&gt;</span> <span class="n">schtasks</span> <span class="p">/</span><span class="n">query</span> <span class="p">/</span><span class="n">tn</span> <span class="n">taskname</span> <span class="p">/</span><span class="n">fo</span> <span class="n">list</span> <span class="p">/</span><span class="n">v</span> </span></span><span class="line"><span class="cl"><span class="n">Folder</span><span class="err">:</span> <span class="p">\</span> </span></span><span class="line"><span class="cl"><span class="n">HostName</span><span class="err">:</span> <span class="nb">THM-PC1</span> </span></span><span class="line"><span class="cl"><span class="n">TaskName</span><span class="err">:</span> <span class="p">\</span><span class="n">vulntask</span> </span></span><span class="line"><span class="cl"><span class="n">Task</span> <span class="n">To</span> <span class="n">Run</span><span class="err">:</span> <span class="n">C:</span><span class="p">\</span><span class="n">tasks</span><span class="p">\</span><span class="n">schtask</span><span class="p">.</span><span class="py">bat</span> <span class="c"># The File to run</span> </span></span><span class="line"><span class="cl"><span class="n">Run</span> <span class="n">As</span> <span class="n">User</span><span class="err">:</span> <span class="n">taskusr1</span> <span class="c"># This is who can run it</span> </span></span></code></pre></div><p>Next we could check Permissions on that by using <code>icals</code> like so</p>