Once we have access to a low level user on the system, we want to elevate our privileges. Before we can do so, there is important information we have to obtain.
IMPORTANT: Stomping these commands on a computer can be a loud process, always practice good OPSEC when enumerating!
Automated Enumeration
WinPEAS
cp /usr/share/peass/winpeas/winPEASx64.exe .
Initial Enumeration
There are several key pieces of information we should always initilally obtain:
Username & hostname
Group memberships of the current user
Existing users and groups
Operating system, version and architecture
Network information
Installed applications
Running processes
Display Groups - whoami
C:\Users\dave> whoami /groups
whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID
====================================== ================ ==============================================
Everyone Well-known group S-1-1-0
Get Privileges - whoami
C:\Users\dave> whoami /priv
whoami /priv
Privilege Name Description State
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token Disabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeManageVolumePrivilege Perform volume maintenance tasks Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
NOTE: Always make sure to fully enumerate privileges! And Possible exploits!
Abusing SeImpersonatePrivilege:
We can exploit SeImpersonatePrivilege with PrintSpoofer:
Display Local Users - Get-LocalUser
PS C:\Users\dave> Get-LocalUser
Get-LocalUser
Name Enabled Description
---- ------- -----------
Administrator False Built-in account for administering the computer/domain
BackupAdmin True
dave True dave
daveadmin True
Display Local Groups - Get-LocalGroup
PS C:\Users\dave> Get-LocalGroup
Get-LocalGroup
Name Description
---- -----------
adminteam Members of this group are admins to all workstations on the second floor
BackupUsers
helpdesk
...
Display Group Members - GetLocalGroupMember
PS C:\Users\dave> Get-LocalGroupMember Administrators
Get-LocalGroupMember Administrators
ObjectClass Name PrincipalSource
----------- ---- ---------------
User CLIENTWK220\Administrator Local
User CLIENTWK220\daveadmin Local
User CLIENTWK220\backupadmin Local
Checking Groups - net user
Another way we can check groups a user belongs to is using net user
PS C:\Users\tony> net user tony
User name tony
Full Name Nothing Stops
Comment
User's comment
Country/region code 000 (System Default)
Account active Yes
Account expires Never
Password last set 6/16/2023 1:57:34 PM
Password expires Never
Password changeable 6/16/2023 1:57:34 PM
Password required Yes
User may change password Yes
Workstations allowed All
Logon script
User profile
Home directory
Last logon Never
Logon hours allowed All
Local Group Memberships *Administrators *Users
Global Group memberships *None
Display OS, Version, & Architecture
PS C:\Users\dave> systeminfo
Host Name: Computer
OS Name: Microsoft Windows 11 Pro
OS Version: 10.0.22621 N/A Build 22621
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
OS Build Type: Multiprocessor Free
Registered Owner: dave@gmail.com
Registered Organization:
