Window提权基本步骤

原文地址：
http://www.fuzzysecurity.com/tutorials/16.html
1. 信息收集

引用

systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
hostname
echo %username%
net users
net user username
ipconfig /all
route print
arp -A
netstat -ano
netsh firewall show state
netsh firewall show config
# This will display verbose output for all scheduled tasks, below you can see sample output for a single task.
schtasks /query /fo LIST /v
# The following command links running processes to started services.
C:\Windows\system32> tasklist /SVC
net start
# This can be useful sometimes as some 3rd party drivers, even by reputable companies, contain more holes than Swiss cheese. This is only possible because ring0 exploitation lies outside most peoples expertise.
C:\Windows\system32> DRIVERQUERY

2. WMIC

引用

The first and most obvious thing we need to look at is the patchlevel. There is no need to worry ourself further if we see that the host is badly patched. My WMIC script will already list all the installed patches but you can see the sample command line output below.
C:\Windows\system32> wmic qfe get Caption,Description,HotFixID,InstalledOn
C:\Windows\system32> wmic qfe get Caption,Description,HotFixID,InstalledOn | findstr /C:"KB.." /C:"KB.."

3. configuration file

引用

c:\sysprep.inf
c:\sysprep\sysprep.xml
%WINDIR%\Panther\Unattend\Unattended.xml
%WINDIR%\Panther\Unattended.xml

4. GPP
https://www.rapid7.com/db/modules/post/windows/gather/credentials/gpp
https://github.com/mattifestation/PowerSploit
5. strange registry setting
The next thing we will look for is a strange registry setting "AlwaysInstallElevated", if this setting is enabled it allows users of any privilege level to install *.msi files as NT AUTHORITY\SYSTEM. It seems like a strange idea to me that you would create low privilege users (to restrict their use of the OS) but give them the ability to install programs as SYSTEM. For more background reading on this issue you can have a look here at an article by Parvez from GreyHatHacker who originally reported this as a security concern.
6. service and accesschk.exe
7. files/folder permission