[ACADEMY] Windows Privilege Escalation Skills Assessment - Part II

the password will give you a hint xD

Actually, going through the WinPEAS detailed report is pretty exhausting! :crazy_face:

Fortunately, I started with a smaller automatic tool which helps enumerating things:
SharpUp.exe audit and I got all it needs to find 2 first answers at once…

The most impactful to me was that these 2 discoveries just rely on one contextual fact about the pentest itself: we are actually auditing a Gold Image, which means there probably are administrative shortcuts in order to do things faster… tehy forgot to get rid of! :upside_down_face:

First one is the ‘Unattend.xml’ file which contains sensitive info (a basic search with the pattern ‘iamtheadministrator’ yields teh same results: it’s teh only readable file with mention of this ppowerful user! :sweat_smile:).

Second, some registry keys useful to install things in some “high privs” way! :stuck_out_tongue_winking_eye:

1 Like

unattend.xml

If anyone is intrested - CVE-2020-0787 can also be used to elevate privileges.

Can someone help me?, i have no idea why i get no output from hashdump

You would find the answer above. for some reason the session times out after a few secs. Plan what you want to do beforehand, and just copy-paste the command in. Saw another smart way above, i didnt do the smart way and just created a new user and added it in administrators group and then logged in with that to do the other things.

hope it helps :slight_smile: