Privilege Escalation

Recursos

• WinPEAS

• about_Logging_Windows

• Abusing Token Privileges For LPE

• Active Directory privileged accounts and groups reference guide

• Active Directory security groups

• DnsAdmins

• From DNSAdmins to Domain Admin, When DNSAdmins is More than Just DNS Administration

• Guide for all built-in Windows commands

• ServerLevelPluginDll

• Windows Built-in Users, Default Groups and Special Identities

• Windows Commands

• Windows Privilege Abuse: Auditing, Detection, and Defense

• Windows - Privilege Escalation

---

Tools

• PoshPrivilege

• Adjusting Token Privileges in PowerShell

• procdump

• SharpGPOAbuse

• https://github.com/fashionproof/EnableAllTokenPrivs

• wevtutil

• Get-WinEvent

• Dnscmd

---

Abuso de permisos

• Abuse of SeImpersonate and SeAssignPrimaryToken

• Abuse of Take Ownership Privilege

• Abuse of SeDebugPrivilege

• Abuse of SeBackupPrivilege

---

Abuso de grupos

• Attacking a Domain Controller - Copying NTDS.dit

• Leveraging DnsAdmins Access

• Hyper-V Administrators

• Print Operators

• Server Operators

---

Atacar el sistema operativo

• DLL Injection

• Kernel Exploits

• User Account Control

• Vulnerable Services

• Weak Permissions

---

• Citrix Breakout

• Credential Hunting

• Interacting with Users

• Legacy Operating Systems

• Miscellaneous Techniques

• Otros archivos

• Pillaging

• Windows Desktop Versions

• Windows Server

---

Comandos útiles

Interfaces, direcciones IP, información DNS

ipconfig /all

ARP table

arp -a

Routing table

route print

Check Windows Defender Status

Get-MpComputerStatus

List AppLocker Rules

Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections

Test AppLocker Policy

Get-AppLockerPolicy -Local | Test-AppLockerPolicy -path C:\Windows\System32\cmd.exe -User Everyone

Procesos ejecutandose

Tasklist /svc

Variables de entorno

set

Información del sistema

systeminfo

Actualizaciones

wmic qfe

Get-HotFix | ft -AutoSize

Programas instalados

wmic product get name

Get-WmiObject -Class Win32_Product |  select Name, Version

Conexiones activas

netstat -ano

Servicio correspondiente a un PID

tasklist /FI "PID eq 1234"

Get-Process -Id 1234

Usuarios logueados

query user

Usuario actual

echo %USERNAME%

Privilegios de seguridad del usuario actual

whoami /priv

Grupos de usuarios a los que pertenece el usuario actual

whoami /groups

Listar todos los usuarios

net user

Listar todos los grupos

net localgroup

Detalles de un grupo

net localgroup administrators

Políticas de contraseña y otra información de cuenta

net accounts

Listar Named Pipes

pipelist.exe /accepteula

gci \\.\pipe\

Enumerar permisos asignados a un named pipe específico

accesschk.exe /accepteula \\.\Pipe\lsass -v

Event Log Readers

net localgroup "Event Log Readers"

wevtutil qe Security /rd:true /f:text | Select-String "/user"
wevtutil qe Security /rd:true /f:text /r:share01 /u:julie.clay /p:Welcome1 | findstr "/user"
Get-WinEvent -LogName security | where { $_.ID -eq 4688 -and $_.Properties[8].Value -like '*/user*'} | Select-Object @{name='CommandLine';expression={ $_.Properties[8].Value }}
Get-WinEvent -LogName security | where { $_.ID -eq 4688 -and $_.Properties[8].Value -like '*/user*'} | Select-Object @{name='CommandLine';expression={ $_.Properties[8].Value }} -Credential AnotherUser