Entry 2‐ Windows Local Privilege Escalation - 229300/SEC-335-01 GitHub Wiki

Learning Objectives

After completing this assignment, you will be able to:

  • Run WinPEAS to enumerate a Windows 10 system for misconfigurations
  • Interpret WinPEAS output to identify privilege escalation vectors
  • Analyze common Windows privilege escalation paths
  • Understand remediation strategies for identified vulnerabilities
  • Exploit local privilege escalation vulnerabilities

WinPEAS (Windows Privilege Escalation Awesome Scripts) is an open-source auditing tool that automates the process of identifying privilege escalation paths on Windows systems. It checks for:

  • Kernel vulnerabilities
  • Misconfigured services
  • Unquoted service paths
  • Insecure file/folder permissions
  • Stored credentials
  • AlwaysInstallElevated registry settings
  • Scheduled tasks
  • Insecure GUI applications
  • And more

Lab Environment Setup

Using Windows 10 VM on Proxmox

We'll be working extensively within the command prompt in this class.

Run these commands as Administrator on your Windows 10 VM from the command prompt.

Task 1: WinPEAS Enumeration

Objective: Download, verify, and execute WinPEAS on the target system.

Steps:

  1. Open a non-elevated Powershell prompt which is your “champuser” account
  • Run Powershell
  1. Download the WinPEAS PowerShell script from the official GitHub repository
  • The PowerShell version lives at winPEAS/winPEASps1/winPEAS.ps1.
  • Make a folder (directory), change into said folder, and pull the raw file:
mkdir $HOME\winpeas -Force; cd $HOME\winpeas
  • Looks like:
  • Command to Pull the Raw file:
curl.exe -L -o winPEAS.ps1 https://raw.githubusercontent.com/peass-ng/PEASS-ng/master/winPEAS/winPEASps1/winPEAS.ps1
  • Looks like:
  • Confirm it downloaded and without an error page:
dir winPEAS.ps1
  • Output:
  1. Change to the directory of the WinPeas Powershell script file.
  • At this point I am already in the directory, but let's do the pwd command to verify
  • Output:

I ran into issues here

  • Ensure I'm in the winpeas directory
dir
  • If no output the folder is empty, so redownload the file:
curl.exe -L -o winPEAS.ps1 https://raw.githubusercontent.com/peass-ng/PEASS-ng/master/winPEAS/winPEASps1/winPEAS.ps1

Get-FileHash -LiteralPath "$HOME\winpeas\winPEAS.ps1" -Algorithm SHA256
  1. Verify the file hash before execution
  2. Set the PowerShell execution policy so it bypasses the Current User. Do not enable global “Unrestricted” policies. Using “Bypass” is a technique used by threat actors to run scripts quickly.
  3. Perform the step above before running the script below.
  4. Run WinPEAS and capture the output