Checklist - Local Windows Privilege Escalation

Checklist - Local Windows Privilege Escalation

Resources List

• Windows Privilege Escalation cookbook : https://github.com/nickvourd/Windows-Local-Privilege-Escalation-Cookbook
• Hackticks - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation
• https://github.com/nickvourd/Windows-Local-Privilege-Escalation-Cookbook
• Fuzzy Security Guide - https://www.fuzzysecurity.com/tutorials/16.html
• PayloadsAllTheThings Guide - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology and Resources/Windows - Privilege Escalation.md
• Absolomb Windows Privilege Escalation Guide - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
• Sushant 747's Guide (Country dependant - may need VPN) - https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html
• In the Potato family, I want them all : https://hideandsec.sh/books/windows-sNL/page/in-the-potato-family-i-want-them-all

Initial Enumeration

System Enumeration

• Read More here (https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology and Resources/Windows - Privilege Escalation.md#windows-version-and-configuration)

• Enumerating System to find out the system version and running processes.

  • For Command Prompt

  ~# systeminfo
  ~# systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type
  ~# wmic qfe
  ~# wmic qfe get Caption,Description,HotFixID,InstalledOn
  ~# wmic logicaldisk get caption,description,providername
  ~# wmic qfe get Caption,Description,HotFixID,InstalledOn            #Patches
  ~# wmic os get osarchitecture || echo %PROCESSOR_ARCHITECTURE%      #Get system architecture
  

  • For Powershell

  ~# [System.Environment]::OSVersion.Version                                                   #Current OS version
  ~# Get-WmiObject -query 'select * from win32_quickfixengineering' | foreach {$_.hotfixid}    #List all patches
  ~# Get-Hotfix -description "Security update"                                                 #List only "Security Update" patches