Windows Privilege Escalation

Manual Checks

A list of useful commands to perform manual privilege escalation on Windows operating system.

Windows Version and Configuration

Get system info

systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

List all env variables

set

Get-ChildItem Env: | ft Key,Value

List all drives

Get-PSDrive | where {$_.Provider -like "Microsoft.PowerShell.Core\FileSystem"}| ft Name,Root

User Enumeration

Get current username

echo %USERNAME% || whoami

$env:username

List user privilege

whoami /priv

whoami /groups

List all users

net user

whoami /all

Get-LocalUser | ft Name,Enabled,LastLogon

Get-ChildItem C:\Users -Force | select Name

Get details about a specific user i.e administrator

net <user-name>

List all local groups

net localgroup

Get-LocalGroup | ft Name

Get details about a group i.e. administrators

net localgroup administrators

Get-LocalGroupMember Administrators | ft Name, PrincipalSource

Get Domain Controller

nltest /DCLIST:<Domain-Name>

nltest /DCNAME:<Domain-Name>

Network Enumeration

List all network interfaces, IP, and DNS

ipconfig /all

Get-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address

Get-DnsClientServerAddress -AddressFamily IPv4 | ft

List current routing table

route print

Get-NetRoute -AddressFamily IPv4 | ft DestinationPrefix,NextHop,RouteMetric,ifIndex

List ARP table

arp -A

Get-NetNeighbor -AddressFamily IPv4 | ft ifIndex,IPAddress,LinkLayerAddress,State

List all current connections

netstat -ano

List all network shares

net share

EoP - Processes Enumeration and Tasks

Windows OS

What processes are running ?

tasklist /v

net start

sc query

Get-Service

Get-Process

Get-WmiObject -Query "Select * from Win32_Process" | where {$_.Name -notlike "svchost*"} | Select Name, Handle, @{Label="Owner";Expression={$_.GetOwner().User}} | ft -AutoSize

Processes running as “system”

tasklist /v /fi "username eq system"

Know if powershell is available

REG QUERY "HKLM\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine" /v PowerShellVersion

List installed programs

Get-ChildItem 'C:\Program Files', 'C:\Program Files (x86)' | ft Parent,Name,LastWriteTime

Get-ChildItem -path Registry::HKEY_LOCAL_MACHINE\SOFTWARE | ft Name

Enumerate scheduled tasks

schtasks /query /fo LIST 2>nul | findstr TaskName

Get-ScheduledTask | where {$_.TaskPath -notlike "\Microsoft*"} | ft TaskName,TaskPath,State

IIS Web config

Get-Childitem –Path C:\inetpub\ -Include web.config -File -Recurse -ErrorAction SilentlyContinue

WiFi Passwords

Find Access Point (AP) SSID

netsh wlan show profile

Get Cleartext Pass

netsh wlan show profile <SSID> key=clear