Windows privilege escalation focuses on two primary scenarios: elevating from web server permissions to system-level access, and elevating from a local standard user account to administrative or SYSTEM privileges.

Windows User and Group Permission Model

Windows includes multiple built-in local user groups with predefined permisions:

• Administrators: Full (but not absolute) system control
• Power Users: Limited administrative capabilities, cannot modify core system settings
• Users: Restricted to their own files, cannot modify system-wide settings
• Guests: Limited access comparable to standard users, with additional program execution restrictions
• Backup Operators, Replicator: Specialized maintenance groups rarely used in daily operations
• Authenticated Users: All accounts validated via Windows authentication

Special system accounts include:

• SYSTEM: The only account with full, unrestricted access to the entire system
• TrustedInstaller: Owns core Windows system files
• Everyone: Grants access to all users, including guests
• CREATOR OWNER: Restricts file access to the user who created the item

Administrators and SYSTEM accounts can bypass all NTFS permissions unless files are encrypted with EFS. Permissions can be combined: adding a user to multiple groups grants cumulative access rights.

Web-based escalation occurs after compromising a website, where the current permissions are limited to the web application pool (e.g., apppool user) and cannot perform system-level operations. Local escalation happens when accessing a standard local user account, with the goal of elevating to Administrator or SYSTEM. Local escalasion typically has a higher success rate than web-based escalation, as web permissions are more restricted.

Most demonstrations use Windows Server 2012, as it is a widely deployed server operating system for web hosting.

Required Prerequisites

1. Windows user and group permission fundamentals
2. Basic Windows administration command knowledge

Web Environment Privilege Escalation Demo

Workflow: Information Gathering → Patch Screening → Exploit Execution

After obtaining a web shell (via AntSword, Behinder, or other tools, with proper obfuscation to bypass cloud protections like Alibaba Cloud's security filters), follow these steps:

1. Information Gathering: Collect system details using built-in Windows commands:

   systeminfo > system_info.txt
   whoami
   whoami /priv
   

   Save the output of systeminfo for patch screening, as it includes OS version, architecture, and installed hotfixes.
2. Patch and Vulnerability Screening: Use tools to match installed patches against known Windows vulnerabilities:
   • Vulmap: Relies on PowerShell scripts, which are often unavailable in restricted web shells. Not recommended for web environments.
   • WESng (WES): Processes local systeminfo output against a Microsoft vulnerability database. Works in web environments but requires offline processing of the collected system data. Note that older versions do not support exploits released after 2018.
   • WindowsVulnScan: More flexible than the other tools. While the official version uses PowerShell to generate KB.json, it can be modified to work in web environments by manually formatting the systeminfo output. This tool supports both local and web escalation scenarios.

Local Environment Privilege Escalation Demo

Kernel Exploit-based Escalation

After identifying applicable vulnerabilities via patch screening, use either Metasploit Framework (MSF) or standalone exploits:

1. MSF: A long-standing penetration testing platform. For external deployments, run MSF on a low-cost Linux VPS (e.g., Ubuntu 2-core 2GB) to avoid NAT and firewall issues with reverse shells. Note that MSF's exploit library is updated only periodically, so newer vulnerabilities may not be included.
2. Standalone Exploits: Source from repositories like SecWiki's windows-kernel-exploits. Standalone exploits may have less rigorous testing than MSF modules, but can target vulnerabilities not yet added to MSF.

Example exploit: CVE-2020-0787 (BitsArbitraryFileMoveExploit), a universal Windows kernel exploit that elevates standard users to SYSTEM privileges. Note that some exploits require interactive command prompts, which may not be available in restricted web shells.

AT/SC/PS Command-based Escalation

These legacy or specialized command techniques rely on Windows system design flaws:

1. at Command: Creates scheduled tasks that run with SYSTEM privileges, but only works on Windows 7 and earlier (e.g., Windows Server 2003). Fixed in newer Windows versions.

   at 15:13 /interactive cmd.exe
   

2. sc Command: Creates and manages Windows services to spawn elevated shells. Works on Windows 7/8 but requires adjustments:

   sc create tempcmd binPath= "cmd /k start" type= own type= interact
   sc start tempcmd
   

3. PsExec (PS Command): Part of the PSTools suite from Microsoft Sysinternals. Spawns an interactive SYSTEM shell:

   psexec.exe -accepteula -s -i -d cmd.exe
   

Key Considerations

1. Some escalation methods work across both web and local environments, while others are tied to specific OS versions.
2. Third-party software or database vulnerabilities can also enable escalation, but these depend on the target server's installed software.
3. Always verify exploit compatibility with the target OS version and installed patches.

Resource Links

• Vulmap: https://github.com/vulmon/Vulmap
• WESng: https://github.com/bitsadmin/wesng
• CVE-2018-8120 Exploit: https://github.com/unamer/CVE-2018-8120
• WindowsVulnScan: https://github.com/chroblert/WindowsVulnScan
• SecWiki Windows Kernel Exploits: https://github.com/SecWiki/windows-kernel-exploits
• MSF Deployment Guide: https://www.cnblogs.com/MOrtals/p/11920903.html
• PSTools Download: https://docs.microsoft.com/en-us/sysinternals/downloads/pstools
• CVE-2020-0787 EXP: https://github.com/cbwang505/CVE-2020-0787-EXP-ALL-WINDOWSVERSION/releases/tag/1