hacktricks/windows-hardening/checklist-windows-privilege-escalation.md
2023-04-25 20:35:28 +02:00

11 KiB

Checklist - Local Windows Privilege Escalation

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

Best tool to look for Windows local privilege escalation vectors: WinPEAS

System Info

Logging/AV enumeration

Network

Running Processes

Services

Applications

DLL Hijacking

  • Can you write in any folder inside PATH?
  • Is there any known service binary that tries to load any non-existant DLL?
  • Can you write in any binaries folder?

Network

  • Enumerate the network (shares, interfaces, routes, neighbours, ...)
  • Take a special look at network services listening on localhost (127.0.0.1)

Windows Credentials

Files and Registry (Credentials)

Leaked Handlers

  • Have you access to any handler of a process run by administrator?

Pipe Client Impersonation

  • Check if you can abuse it
☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥