CTF-Writeups/Active Directory/Local Privilege Escalation/Local privilege escalation.md

Privilege Escalation - Local

This is the technique that we should follow while looking to escalate our privileges in an AD environment

Recon 
Domain Enum 
Local priv 
Admin Recon 
Lateral Movement (while being persistant) 
Domain 
Admin priv 
Cross Trust Attacks

We should hunt for local admin access on other machine , hunt for high privilege domain account like a domain administrator

Other than that we should look for

• missing patches
• automated deployment and autologon passwords
• alwaysintallelevated (any user can run msi as system user)
• misconfigured services
• dll hijacking

Using the tools below we can quickly identify the above privilege escalation vectors

• https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1 Invoke-AllChecks
• https://github.com/AlessandroZ/BeRoot .\beRoot.exe
• https://github.com/enjoiz/Privesc/blob/master/privesc.ps1 Invoke-PrivEsc

PowerUp

Get services with unquoted path and a space in thier name

Get-ServiceUnquoted -Verbose

Get services where current user can write to it's binary path or change arguments to the binary

Get-ModifiableServiceFile -Verbose

Get services whose configuration urrent user can modify

Get-ModifiableService -Verbose