HackTricksOrodha ya Ukaguzi - Local Windows Privilege Escalation
Reading time: 7 minutes
tip
Jifunze na fanya mazoezi ya AWS Hacking:
HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: 
HackTricks Training GCP Red Team Expert (GRTE)
Jifunze na fanya mazoezi ya Azure Hacking: 
HackTricks Training Azure Red Team Expert (AzRTE)
Support HackTricks
- Angalia mpango wa usajili!
- Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
- Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.
Chombo bora cha kutafuta Windows local privilege escalation vectors: WinPEAS
Taarifa za Mfumo
- Pata Taarifa za Mfumo
- Tafuta kernel exploits using scripts
- Tumia Google kutafuta kernel exploits
- Tumia searchsploit kutafuta kernel exploits
- Je, kuna taarifa za kuvutia katika env vars?
- Je, kuna nywila katika PowerShell history?
- Je, kuna taarifa za kuvutia katika Internet settings?
- Drives?
- WSUS exploit?
- Third-party agent auto-updaters / IPC abuse
- AlwaysInstallElevated?
Uchunguzi wa Logging/AV
- Kagua Audit na WEF mipangilio
- Kagua LAPS
- Kagua kama WDigest iko imewezeshwa
- LSA Protection?
- Credentials Guard?
- Cached Credentials?
- Kagua kama kuna AV
- AppLocker Policy?
- UAC
- User Privileges
- Kagua current user privileges
- Je, wewe ni member of any privileged group?
- Kagua kama una any of these tokens enabled: SeImpersonatePrivilege, SeAssignPrimaryPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege ?
- Users Sessions?
- Kagua users homes (ufikaji?)
- Kagua Password Policy
- Kuna nini katika Clipboard?
Mtandao
- Kagua taarifa za mtandao ya sasa
- Kagua huduma za ndani zilizofichika zinazotengwa kwa nje
Michakato Inayoendeshwa
- Idhini za [file and folders] za binaries za michakato (permissions) (windows-local-privilege-escalation/index.html#file-and-folder-permissions)
- Memory Password mining
- Insecure GUI apps
-
Pora nywila kwa michakato yenye [vitu vya kuvutia] kwa kutumia
ProcDump.exe? (firefox, chrome, n.k.)
Services
- Je, unaweza kubadilisha service yoyote? (windows-local-privilege-escalation/index.html#permissions)
- Je, unaweza kubadilisha binary inayotekelezwa na service yoyote? (windows-local-privilege-escalation/index.html#modify-service-binary-path)
- Je, unaweza kubadilisha registry ya service yoyote? (windows-local-privilege-escalation/index.html#services-registry-modify-permissions)
- Je, unaweza kuchukua faida ya njia ya binary isiyo na nukuu ya service yoyote? (windows-local-privilege-escalation/index.html#unquoted-service-paths)
Programu
- [Write] ruhusa kwenye programu zilizosakinishwa (windows-local-privilege-escalation/index.html#write-permissions)
- Startup Applications
- Vulnerable Drivers
DLL Hijacking
- Je, unaweza kuandika katika folda yoyote ndani ya PATH?
- Je, kuna binary ya service inayojulikana ambayo inajaribu kupakia DLL isiyokuwepo?
- Je, unaweza kuandika katika folder za binaries yoyote?
Mtandao
- Fanya uorodheshaji wa mtandao (shares, interfaces, routes, neighbours, ...)
- Tazama kwa makini huduma za mtandao zinazolisikiliza localhost (127.0.0.1)
Windows Credentials
- Winlogon credentials
- Windows Vault credentials ambazo unaweza kutumia?
- Je, kuna DPAPI credentials za kuvutia?
- Nywila za Wifi networks?
- Taarifa za kuvutia katika saved RDP Connections?
- Nywila katika recently run commands?
- Remote Desktop Credentials Manager nywila?
- AppCmd.exe exists? Credentials?
- SCClient.exe? DLL Side Loading?
Files and Registry (Credentials)
- Putty: Creds and SSH host keys
- SSH keys in registry?
- Nywila katika unattended files?
- Kuna nakala za kuhifadhi za SAM & SYSTEM?
- Cloud credentials?
- McAfee SiteList.xml file?
- Cached GPP Password?
- Nywila katika IIS Web config file?
- Taarifa za kuvutia katika web logs?
- Unataka kuomba nywila kutoka kwa mtumiaji?
- Faili za kuvutia ndani ya Recycle Bin?
- Mengine registry containing credentials?
- Ndani ya Browser data (dbs, history, bookmarks, ...)?
- Generic password search katika files na registry
- Tools za kutafuta nywila moja kwa moja
Leaked Handlers
- Je, una ufikiaji wa handler yoyote ya mchakato unaoendeshwa na administrator?
Pipe Client Impersonation
- Kagua kama unaweza kuiboresha (abuse) hiyo
tip
Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)
Support HackTricks
- Angalia mpango wa usajili!
- Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
- Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.