Fork: 0
0xRoM / DirtyScripts
Transfer to URL with SHA Find file
Newer
Older
DirtyScripts / privesc / winPEAS.bat
root on 16 Dec 2019 26 KB privesc scripts added
Raw Blame History 
  1. @echo off
  2.  
  3. set long=no
  4.  
  5.  
  6. echo             *((,.,/((((((((((((((((((((/,  */               
  7. echo      ,/*,..*(((((((((((((((((((((((((((((((((,           
  8. echo    ,*/((((((((((((((((((/,  .*//((//**, .*((((((*       
  9. echo    ((((((((((((((((* *****,,,/########## .(* ,((((((   
  10. echo    (((((((((((/* ******************/####### .(. ((((((
  11. echo    ((((((..******************/@@@@@/***/######* /((((((
  12. echo    ,,..**********************@@@@@@@@@@(***,#### ../(((((
  13. echo    , ,**********************#@@@@@#@@@@*********##((/ /((((
  14. echo    ..(((##########*********/#@@@@@@@@@/*************,,..((((
  15. echo    .(((################(/******/@@@@@#****************.. /((
  16. echo    .((########################(/************************..*(
  17. echo    .((#############################(/********************.,(
  18. echo    .((##################################(/***************..(
  19. echo    .((######################################(************..(
  20. echo    .((######(,.***.,(###################(..***(/*********..(
  21. echo   .((######*(#####((##################((######/(********..(
  22. echo    .((##################(/**********(################(**...(
  23. echo    .(((####################/*******(###################.((((  
  24. echo    .(((((############################################/  /((
  25. echo    ..(((((#########################################(..(((((.
  26. echo    ....(((((#####################################( .((((((.
  27. echo    ......(((((#################################( .(((((((.
  28. echo    (((((((((. ,(############################(../(((((((((.
  29. echo        (((((((((/,  ,####################(/..((((((((((.
  30. echo              (((((((((/,.  ,*//////*,. ./(((((((((((.
  31. echo                 (((((((((((((((((((((((((((/"
  32. echo                        by carlospolop
  33.  
  34. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [*] BASIC SYSTEM INFO ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  35. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] WINDOWS OS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  36. echo [i] Check for vulnerabilities for the OS version with the applied patches
  37. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#kernel-exploits
  38. systeminfo
  39. echo.
  40. wmic qfe get Caption,Description,HotFixID,InstalledOn | more
  41. echo.
  42. echo.
  43. set expl=no
  44. for /f "tokens=3-9" %%a in ('systeminfo') do (echo "%%a %%b %%c %%d %%e %%f %%g" | findstr /i "2000 XP 2003 2008 vista" && set expl=yes) & (echo "%%a %%b %%c %%d %%e %%f %%g" | findstr /i /C:"windows 7" && set expl=yes)
  45. IF "%expl%" == "yes" echo [i] Possible exploits (https://github.com/codingo/OSCP-2/blob/master/Windows/WinPrivCheck.bat)
  46. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2592799" 1>NUL
  47. IF "%expl%" == "yes" IF errorlevel 1 echo MS11-080 patch is NOT installed! (Vulns: XP/SP3,2K3/SP3-afd.sys)
  48. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB3143141" 1>NUL
  49. IF "%expl%" == "yes" IF errorlevel 1 echo MS16-032 patch is NOT installed! (Vulns: 2K8/SP1/2,Vista/SP2,7/SP1-secondary logon)
  50. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2393802" 1>NUL
  51. IF "%expl%" == "yes" IF errorlevel 1 echo MS11-011 patch is NOT installed! (Vulns: XP/SP2/3,2K3/SP2,2K8/SP2,Vista/SP1/2,7/SP0-WmiTraceMessageVa)
  52. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB982799" 1>NUL
  53. IF "%expl%" == "yes" IF errorlevel 1 echo MS10-59 patch is NOT installed! (Vulns: 2K8,Vista,7/SP0-Chimichurri)
  54. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB979683" 1>NUL
  55. IF "%expl%" == "yes" IF errorlevel 1 echo MS10-21 patch is NOT installed! (Vulns: 2K/SP4,XP/SP2/3,2K3/SP2,2K8/SP2,Vista/SP0/1/2,7/SP0-Win Kernel)
  56. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2305420" 1>NUL
  57. IF "%expl%" == "yes" IF errorlevel 1 echo MS10-092 patch is NOT installed! (Vulns: 2K8/SP0/1/2,Vista/SP1/2,7/SP0-Task Sched)
  58. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB981957" 1>NUL
  59. IF "%expl%" == "yes" IF errorlevel 1 echo MS10-073 patch is NOT installed! (Vulns: XP/SP2/3,2K3/SP2/2K8/SP2,Vista/SP1/2,7/SP0-Keyboard Layout)
  60. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB4013081" 1>NUL
  61. IF "%expl%" == "yes" IF errorlevel 1 echo MS17-017 patch is NOT installed! (Vulns: 2K8/SP2,Vista/SP2,7/SP1-Registry Hive Loading)
  62. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB977165" 1>NUL
  63. IF "%expl%" == "yes" IF errorlevel 1 echo MS10-015 patch is NOT installed! (Vulns: 2K,XP,2K3,2K8,Vista,7-User Mode to Ring)
  64. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB941693" 1>NUL
  65. IF "%expl%" == "yes" IF errorlevel 1 echo MS08-025 patch is NOT installed! (Vulns: 2K/SP4,XP/SP2,2K3/SP1/2,2K8/SP0,Vista/SP0/1-win32k.sys)
  66. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB920958" 1>NUL
  67. IF "%expl%" == "yes" IF errorlevel 1 echo MS06-049 patch is NOT installed! (Vulns: 2K/SP4-ZwQuerySysInfo)
  68. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB914389" 1>NUL
  69. IF "%expl%" == "yes" IF errorlevel 1 echo MS06-030 patch is NOT installed! (Vulns: 2K,XP/SP2-Mrxsmb.sys)
  70. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB908523" 1>NUL
  71. IF "%expl%" == "yes" IF errorlevel 1 echo MS05-055 patch is NOT installed! (Vulns: 2K/SP4-APC Data-Free)
  72. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB890859" 1>NUL
  73. IF "%expl%" == "yes" IF errorlevel 1 echo MS05-018 patch is NOT installed! (Vulns: 2K/SP3/4,XP/SP1/2-CSRSS)
  74. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB842526" 1>NUL
  75. IF "%expl%" == "yes" IF errorlevel 1 echo MS04-019 patch is NOT installed! (Vulns: 2K/SP2/3/4-Utility Manager)
  76. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB835732" 1>NUL
  77. IF "%expl%" == "yes" IF errorlevel 1 echo MS04-011 patch is NOT installed! (Vulns: 2K/SP2/3/4,XP/SP0/1-LSASS service BoF)
  78. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB841872" 1>NUL
  79. IF "%expl%" == "yes" IF errorlevel 1 echo MS04-020 patch is NOT installed! (Vulns: 2K/SP4-POSIX)
  80. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2975684" 1>NUL
  81. IF "%expl%" == "yes" IF errorlevel 1 echo MS14-040 patch is NOT installed! (Vulns: 2K3/SP2,2K8/SP2,Vista/SP2,7/SP1-afd.sys Dangling Pointer)
  82. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB3136041" 1>NUL
  83. IF "%expl%" == "yes" IF errorlevel 1 echo MS16-016 patch is NOT installed! (Vulns: 2K8/SP1/2,Vista/SP2,7/SP1-WebDAV to Address)
  84. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB3057191" 1>NUL
  85. IF "%expl%" == "yes" IF errorlevel 1 echo MS15-051 patch is NOT installed! (Vulns: 2K3/SP2,2K8/SP2,Vista/SP2,7/SP1-win32k.sys)
  86. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2989935" 1>NUL
  87. IF "%expl%" == "yes" IF errorlevel 1 echo MS14-070 patch is NOT installed! (Vulns: 2K3/SP2-TCP/IP)
  88. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2778930" 1>NUL
  89. IF "%expl%" == "yes" IF errorlevel 1 echo MS13-005 patch is NOT installed! (Vulns: Vista,7,8,2008,2008R2,2012,RT-hwnd_broadcast)
  90. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2850851" 1>NUL
  91. IF "%expl%" == "yes" IF errorlevel 1 echo MS13-053 patch is NOT installed! (Vulns: 7SP0/SP1_x86-schlamperei)
  92. IF "%expl%" == "yes" wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB2870008" 1>NUL
  93. IF "%expl%" == "yes" IF errorlevel 1 echo MS13-081 patch is NOT installed! (Vulns: 7SP0/SP1_x86-track_popup_menu)
  94. echo.
  95. echo.
  96. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] DATE and TIME ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  97. echo [i] You may need to adjust your local date/time to exploit some vulnerability
  98. date /T
  99. time /T
  100. echo.
  101. echo.
  102. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] Audit Settings ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  103. echo [i] Check what is being logged
  104. REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit
  105. echo.
  106. echo.
  107. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] WEF Settings ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  108. echo [i] Check where are being sent the logs
  109. REG QUERY HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager
  110. echo.
  111. echo.
  112. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] LAPS installed? ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  113. echo [i] Check what is being logged
  114. REG QUERY "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft Services\AdmPwd" /v AdmPwdEnabled
  115. echo.
  116. echo.
  117. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] UAC Settings ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  118. echo [i] If the results read ENABLELUA REG_DWORD 0x1, part or all of the UAC components are on
  119. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#basic-uac-bypass-full-file-system-access
  120. REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v EnableLUA
  121. echo.
  122. echo.
  123. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] Registered Anti-Virus(AV) ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  124. WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List | more 
  125. echo.
  126. echo.
  127. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] PS settings ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  128. echo PowerShell v2 Version:
  129. REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine /v PowerShellVersion
  130. echo PowerShell v5 Version:
  131. REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine /v PowerShellVersion
  132. echo Transcriptions Settings:
  133. REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription
  134. echo Module logging settings:
  135. REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging
  136. echo Scriptblog logging settings:
  137. REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
  138. echo.
  139. echo.
  140. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] MOUNTED DISKS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  141. echo [i] Maybe you find something interesting
  142. (wmic logicaldisk get caption 2>nul | more) || (fsutil fsinfo drives 2>nul)
  143. echo.
  144. echo.
  145. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] ENVIRONMENT ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  146. echo [i] Interesting information?
  147. set
  148. echo.
  149. echo.
  150. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] INSTALLED SOFTWARE ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  151. echo [i] Some weird software? Check for vulnerabilities in unknow software installed
  152. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#software
  153. dir /b "C:\Program Files" "C:\Program Files (x86)" | sort
  154. reg query HKEY_LOCAL_MACHINE\SOFTWARE
  155. IF exist C:\Windows\CCM\SCClient.exe echo SCCM is installed (installers are run with SYSTEM privileges, many are vulnerable to DLL Sideloading)
  156. echo.
  157. echo.
  158. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] Remote Desktop Credentials Manager ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  159. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#remote-desktop-credential-manager
  160. IF exist "%AppLocal%\Local\Microsoft\Remote Desktop Connection Manager\RDCMan.settings" echo Found: RDCMan.settings in %AppLocal%\Local\Microsoft\Remote Desktop Connection Manager\RDCMan.settings, check for credentials in .rdg files
  161. echo.
  162. echo.
  163. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] WSUS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  164. echo [i] You can inject 'fake' updates into non-SSL WSUS traffic (WSUXploit)
  165. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#wsus
  166. reg query HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\ 2>nul | findstr /i "wuserver" | findstr /i "http://"
  167. echo.
  168. echo.
  169. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] RUNNING PROCESSES ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  170. echo [i] Something unexpected is running? Check for vulnerabilities
  171. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#running-processes
  172. tasklist /SVC
  173. echo.
  174. echo [i] Checking file permissions of running processes (File backdooring - maybe the same files start automatically when Administrator logs in)
  175. for /f "tokens=2 delims='='" %%x in ('wmic process list full^|find /i "executablepath"^|find /i /v "system32"^|find ":"') do (
  176. 	for /f eol^=^"^ delims^=^" %%z in ('echo %%x') do (
  177. 		icacls "%%z" 2>nul | findstr /i "(F) (M) (W) :\\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo.
  178. 	)
  179. )
  180. echo.
  181. echo [i] Checking directory permissions of running processes (DLL injection)
  182. for /f "tokens=2 delims='='" %%x in ('wmic process list full^|find /i "executablepath"^|find /i /v "system32"^|find ":"') do for /f eol^=^"^ delims^=^" %%y in ('echo %%x') do (
  183. 	icacls "%%~dpy\" 2>nul | findstr /i "(F) (M) (W) :\\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo.
  184. )
  185. echo.
  186. echo.
  187. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] RUN ^AT STARTUP ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  188. echo [i] Check if you can modify any binary that is going to be executed by admin or if you can impersonate a not found binary
  189. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#run-at-startup
  190. ::(autorunsc.exe -m -nobanner -a * -ct /accepteula 2>nul || wmic startup get caption,command 2>nul | more & ^
  191. reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run 2>nul & ^
  192. reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce 2>nul & ^
  193. reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2>nul & ^
  194. reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce 2>nul & ^
  195. icacls "C:\Documents and Settings\All Users\Start Menu\Programs\Startup" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. & ^
  196. icacls "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\*" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. & ^
  197. icacls "C:\Documents and Settings\%username%\Start Menu\Programs\Startup" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. & ^
  198. icacls "C:\Documents and Settings\%username%\Start Menu\Programs\Startup\*" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. & ^
  199. icacls "%programdata%\Microsoft\Windows\Start Menu\Programs\Startup" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. & ^
  200. icacls "%programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. & ^
  201. icacls "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. & ^
  202. icacls "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\*" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. & ^
  203. schtasks /query /fo TABLE /nh | findstr /v /i "disable deshab informa")
  204. echo.
  205. echo.
  206. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] AlwaysInstallElevated? ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  207. echo [i] If '1' then you can install a .msi file with admin privileges ;)
  208. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#alwaysinstallelevated
  209. reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 2> nul
  210. reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 2> nul
  211. echo.
  212. echo.
  213. echo.
  214. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [*] NETWORK ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  215. echo.
  216. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] CURRENT SHARES ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  217. net share
  218. echo.
  219. echo.
  220. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] INTERFACES ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  221. ipconfig  /all
  222. echo.
  223. echo.
  224. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] USED PORTS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  225. echo [i] Check for services restricted from the outside
  226. netstat -ano | findstr /i listen
  227. echo.
  228. echo.
  229. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] FIREWALL ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  230. netsh firewall show state
  231. netsh firewall show config
  232. echo.
  233. echo.
  234. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] ^ARP ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  235. arp -A
  236. echo.
  237. echo.
  238. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] ROUTES ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  239. route print
  240. echo.
  241. echo.
  242. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] Hosts file ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  243. type C:\WINDOWS\System32\drivers\etc\hosts | findstr /v "^#"
  244. echo.
  245. echo.
  246. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] CACHE DNS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  247. ipconfig /displaydns | findstr "Record" | findstr "Name Host"
  248. echo.
  249. echo.
  250. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] WIFI ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  251. echo [i] To get the clear-text password use: netsh wlan show profile <SSID> key=clear
  252. netsh wlan show profile
  253. echo.
  254. echo.
  255. echo.
  256. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^>[*] BASIC USER INFO ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  257. echo [i] Check if you are inside the Administrators group or if you have enabled any token that can be use to escalate privileges like SeImpersonatePrivilege, SeAssignPrimaryPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeTakeOwnershipPrivilege, SeDebbugPrivilege
  258. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#users-and-groups
  259. echo.
  260. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] CURRENT USER ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  261. net user %username%
  262. net user %USERNAME% /domain 2>nul
  263. whoami /all
  264. echo.
  265. echo.
  266. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] USERS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  267. net user
  268. echo.
  269. echo.
  270. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] GROUPS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  271. net localgroup
  272. echo.
  273. echo.
  274. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] ADMINISTRATORS GROUPS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  275. net localgroup Administrators 2>nul
  276. net localgroup Administradores 2>nul
  277. echo. 
  278. echo.
  279. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] CURRENT LOGGED USERS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  280. quser
  281. echo. 
  282. echo.
  283. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] CURRENT CLIPBOARD ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  284. echo [i] Any password inside the clipboard?
  285. powershell -command "Get-Clipboard" 2>nul
  286. echo.
  287. echo.
  288. echo.
  289. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [*] SERVICES VULNERABILITIES ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  290. ::echo.
  291. ::echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] SERVICE PERMISSIONS WITH accesschk.exe FOR 'Authenticated users', Everyone, BUILTIN\Users, Todos and CURRENT USER ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  292. ::echo [i] If Authenticated Users have SERVICE_ALL_ACCESS or SERVICE_CHANGE_CONFIG or WRITE_DAC or WRITE_OWNER or GENERIC_WRITE or GENERIC_ALL, you can modify the binary that is going to be executed by the service and start/stop the service
  293. ::echo [i] If accesschk.exe is not in PATH, nothing will be found here
  294. ::echo [I] AUTHETICATED USERS
  295. ::accesschk.exe -uwcqv "Authenticated Users" * /accepteula 2>nul
  296. ::echo [I] EVERYONE
  297. ::accesschk.exe -uwcqv "Everyone" * /accepteula 2>nul
  298. ::echo [I] BUILTIN\Users
  299. ::accesschk.exe -uwcqv "BUILTIN\Users" * /accepteula 2>nul
  300. ::echo [I] TODOS
  301. ::accesschk.exe -uwcqv "Todos" * /accepteula 2>nul
  302. ::echo [I] %USERNAME%
  303. ::accesschk.exe -uwcqv %username% * /accepteula 2>nul
  304. ::echo.
  305. ::echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] SERVICE PERMISSIONS WITH accesschk.exe FOR * ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  306. ::echo [i] Check for weird service permissions for unexpected groups"
  307. ::accesschk.exe -uwcqv * /accepteula 2>nul
  308.  
  309. echo.
  310. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] SERVICE BINARY PERMISSIONS WITH WMIC + ICACLS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  311. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#services
  312. for /f "tokens=2 delims='='" %%a in ('cmd.exe /c wmic service list full ^| findstr /i "pathname" ^|findstr /i /v "system32"') do (
  313.     for /f eol^=^"^ delims^=^" %%b in ("%%a") do icacls "%%b" 2>nul | findstr /i "(F) (M) (W) :\\" | findstr /i ":\\ everyone authenticated users todos usuarios %username%" && echo.
  314. )
  315. echo.
  316. echo.
  317. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] CHECK IF YOU CAN MODIFY ANY SERVICE REGISTRY ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  318. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#services
  319. for /f %%a in ('reg query hklm\system\currentcontrolset\services') do del %temp%\reg.hiv >nul 2>&1 & reg save %%a %temp%\reg.hiv >nul 2>&1 && reg restore %%a %temp%\reg.hiv >nul 2>&1 && echo You can modify %%a
  320. echo.
  321. echo.
  322. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] UNQUOTED SERVICE PATHS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  323. echo [i] When the path is not quoted (ex: C:\Program files\soft\new folder\exec.exe) Windows will try to execute first 'C:\Progam.exe', then 'C:\Program Files\soft\new.exe' and finally 'C:\Program Files\soft\new folder\exec.exe'. Try to create 'C:\Program Files\soft\new.exe'
  324. echo [i] The permissions are also checked and filtered using icacls
  325. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#services
  326. for /f "tokens=2" %%n in ('sc query state^= all^| findstr SERVICE_NAME') do (
  327. 	for /f "delims=: tokens=1*" %%r in ('sc qc "%%~n" ^| findstr BINARY_PATH_NAME ^| findstr /i /v /l /c:"c:\windows\system32" ^| findstr /v /c:""""') do (
  328. 		echo %%~s | findstr /r /c:"[a-Z][ ][a-Z]" >nul 2>&1 && (echo %%n && echo %%~s && icacls %%s | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%") && echo.
  329. 	)
  330. )
  331. ::wmic service get name,displayname,pathname,startmode | more | findstr /i /v "C:\\Windows\\system32\\" | findstr /i /v """
  332. echo.
  333. echo.
  334. echo.
  335. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [*] DLL HIJACKING in PATHenv variable ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  336. echo [i] Maybe you can take advantage of modifying/creating some binary in some of the following locations
  337. echo [i] PATH variable entries permissions - place binary or DLL to execute instead of legitimate
  338. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#dll-hijacking
  339. for %%A in ("%path:;=";"%") do ( cmd.exe /c icacls "%%~A" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. )
  340. echo.
  341. echo.
  342. echo.
  343. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [*] CREDENTIALS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  344. echo.
  345. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] WINDOWS VAULT ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  346. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#windows-vault
  347. cmdkey /list
  348. echo.
  349. echo.
  350. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] DPAPI MASTER KEYS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  351. echo [i] Use the Mimikatz 'dpapi::masterkey' module with appropriate arguments (/rpc) to decrypt
  352. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#dpapi
  353. powershell -command "Get-ChildItem %appdata%\Microsoft\Protect" 2>nul
  354. powershell -command "Get-ChildItem %localappdata%\Microsoft\Protect" 2>nul
  355. echo.
  356. echo.
  357. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] DPAPI MASTER KEYS ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  358. echo [i] Use the Mimikatz 'dpapi::cred' module with appropriate /masterkey to decrypt
  359. echo [i] You can also extract many DPAPI masterkeys from memory with the Mimikatz 'sekurlsa::dpapi' module
  360. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#dpapi
  361. echo Looking inside %appdata%\Microsoft\Credentials\
  362. dir /b/a %appdata%\Microsoft\Credentials\ 2>nul 
  363. echo Looking inside %localappdata%\Microsoft\Credentials\
  364. dir /b/a %localappdata%\Microsoft\Credentials\ 2>nul
  365. echo.
  366. echo.
  367. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] AppCmd ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  368. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#appcmd-exe
  369. IF EXIST %systemroot%\system32\inetsrv\appcmd.exe ECHO %systemroot%\system32\inetsrv\appcmd.exe exists. 
  370. echo.
  371. echo.
  372. echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] Files an registry that may contain credentials ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  373. echo [i] Searching specific files that may contains credentias.
  374. echo   [?] https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#credentials-inside-files
  375. reg query HKCU\Software\ORL\WinVNC3\Password 2>nul
  376. reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4 /v password 2>nul
  377. reg query HKLM\SYSTEM\Microsoft\Windows NT\Currentversion\WinLogon 2>nul
  378. reg query HKLM\SYSTEM\CurrentControlSet\Services\SNMP /s 2>nul
  379. reg query HKCU\Software\TightVNC\Server 2>nul
  380. reg query HKCU\Software\SimonTatham\PuTTY\Sessions /s 2>nul
  381. cd %USERPROFILE% 2>nul && dir /s/b *password* == *credential* 2>nul
  382. cd ..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..
  383. dir /s/b /A:-D RDCMan.settings == *.rdg == SCClient.exe == *_history == .sudo_as_admin_successful == .profile == *bashrc == httpd.conf == *.plan == .htpasswd == .git-credentials == *.rhosts == hosts.equiv == Dockerfile == docker-compose.yml == appcmd.exe == TypedURLs == TypedURLsTime == History == Bookmarks == Cookies == "Login Data" == places.sqlite == key3.db == key4.db == credentials == credentials.db == access_tokens.db == accessTokens.json == legacy_credentials == azureProfile.json == unattend.txt == access.log == error.log == *.gpg == *.pgp == *config*.php == elasticsearch.y*ml == kibana.y*ml == *.p12 == *.der == *.csr == *.cer == known_hosts == id_rsa == id_dsa == *.ovpn == anaconda-ks.cfg == hostapd.conf == rsyncd.conf == cesi.conf == supervisord.conf == tomcat-users.xml == *.kdbx == KeePass.config == Ntds.dit == SAM == SYSTEM == FreeSSHDservice.ini == sysprep.inf == sysprep.xml == unattend.xml == unattended.xml == *vnc*.ini == *vnc*.c*nf* == *vnc*.txt == *vnc*.xml == groups.xml == services.xml == scheduledtasks.xml == printers.xml == drives.xml == datasources.xml == php.ini == https.conf == https-xampp.conf == httpd.conf == my.ini == my.cnf == access.log == error.log == server.xml == SiteList.xml == ConsoleHost_history.txt == setupinfo == setupinfo.bak 2>nul | findstr /v ".dll"
  384. cd inetpub 2>nul && (dir /s/b web.config == *.log & cd ..)
  385. echo.
  386. echo.
  387. if "%long%" == "yes" (
  388.     echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] REGISTRY WITH STRING pass OR pwd ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  389. 	reg query HKLM /f passw /t REG_SZ /s
  390. 	reg query HKCU /f passw /t REG_SZ /s
  391. 	reg query HKLM /f pwd /t REG_SZ /s
  392. 	reg query HKCU /f pwd /t REG_SZ /s
  393. 	echo.
  394. 	echo.
  395. 	echo [i] Iterating through the drives
  396. 	echo.
  397. 	for /f %%x in ('wmic logicaldisk get name^| more') do (
  398. 		set tdrive=%%x
  399. 		if "!tdrive:~1,2!" == ":" (
  400. 			%%x
  401.             echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] FILES THAT CONTAINS THE WORD PASSWORD WITH EXTENSION: .xml .ini .txt *.cfg *.config ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  402. 	        findstr /s/n/m/i password *.xml *.ini *.txt *.cfg *.config 2>nul | findstr /v /i "\\AppData\\Local \\WinSxS ApnDatabase.xml \\UEV\\InboxTemplates \\Microsoft.Windows.Cloud \\Notepad\+\+\\ vmware cortana alphabet \\7-zip\\" 2>nul
  403.             echo.
  404.             echo.
  405.             echo _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-^> [+] FILES WHOSE NAME CONTAINS THE WORD PASS CRED or .config not inside \Windows\ ^<_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  406.             dir /s/b *pass* == *cred* == *.config* == *.cfg 2>nul | findstr /v /i "\\windows\\"  
  407.             echo.
  408.             echo.
  409. 		)
  410. 	)
  411. 	echo.
  412. )
Buy Me A Coffee