> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/priv-esc/windows-privilege-escalation/powerup.ps1.md). # PowerUp.ps1 PowerUp aims to be a clearinghouse of common Windows privilege escalation vectors that rely on misconfigurations. ## Downloading ```bash wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1 ``` ## Execution ### Run all checks #### Run all checks from PowerShell ```powershell PS > . .\PowerUp.ps1 PS > Invoke-AllChecks ``` On newer versions `Invoke-AllChecks` is an alias for the real function called `Invoke-PrivescAudit`. #### Run all checks from Meterpreter Upload the script ```bash meterpreter > lpwd /mnt/hgfs/Wargames/TryHackMe/Walkthroughs/Easy/Steel_Mountain meterpreter > cd C:\\Users\\bill\\Downloads meterpreter > pwd C:\Users\bill\Downloads meterpreter > upload PowerUp.ps1 [*] Uploading : /mnt/hgfs/Wargames/TryHackMe/Walkthroughs/Easy/Steel_Mountain/PowerUp.ps1 -> PowerUp.ps1 [*] Uploaded 586.50 KiB of 586.50 KiB (100.0%): /mnt/hgfs/Wargames/TryHackMe/Walkthroughs/Easy/Steel_Mountain/PowerUp.ps1 -> PowerUp.ps1 [*] Completed : /mnt/hgfs/Wargames/TryHackMe/Walkthroughs/Easy/Steel_Mountain/PowerUp.ps1 -> PowerUp.ps1 ``` Load the PowerShell module and start a PowerShell shell. Then invoke the script ```powershell meterpreter > load powershell Loading extension powershell...Success. meterpreter > powershell_shell PS > . .\PowerUp.ps1 PS > Invoke-AllChecks ``` ## Included functions #### Token/Privilege Enumeration/Abuse ```powershell Get-ProcessTokenGroup - returns all SIDs that the current token context is a part of, whether they are disabled or not Get-ProcessTokenPrivilege - returns all privileges for the current (or specified) process ID Enable-Privilege - enables a specific privilege for the current process ``` ### Service Enumeration/Abuse ```powershell Test-ServiceDaclPermission - tests one or more passed services or service names against a given permission set Get-UnquotedService - returns services with unquoted paths that also have a space in the name Get-ModifiableServiceFile - returns services where the current user can write to the service binary path or its config Get-ModifiableService - returns services the current user can modify Get-ServiceDetail - returns detailed information about a specified service Set-ServiceBinaryPath - sets the binary path for a service to a specified value Invoke-ServiceAbuse - modifies a vulnerable service to create a local admin or execute a custom command Write-ServiceBinary - writes out a patched C# service binary that adds a local admin or executes a custom command Install-ServiceBinary - replaces a service binary with one that adds a local admin or executes a custom command Restore-ServiceBinary - restores a replaced service binary with the original executable ``` ### DLL Hijacking ```powershell Find-ProcessDLLHijack - finds potential DLL hijacking opportunities for currently running processes Find-PathDLLHijack - finds service %PATH% DLL hijacking opportunities Write-HijackDll - writes out a hijackable DLL ``` ### Registry Checks ```powershell Get-RegistryAlwaysInstallElevated - checks if the AlwaysInstallElevated registry key is set Get-RegistryAutoLogon - checks for Autologon credentials in the registry Get-ModifiableRegistryAutoRun - checks for any modifiable binaries/scripts (or their configs) in HKLM autoruns ``` ### Miscellaneous Checks ```powershell Get-ModifiableScheduledTaskFile - find schtasks with modifiable target files Get-UnattendedInstallFile - finds remaining unattended installation files Get-Webconfig - checks for any encrypted web.config strings Get-ApplicationHost - checks for encrypted application pool and virtual directory passwords Get-SiteListPassword - retrieves the plaintext passwords for any found McAfee's SiteList.xml files Get-CachedGPPPassword - checks for passwords in cached Group Policy Preferences files ``` ### Other Helpers/Meta-Functions ```powershell Get-ModifiablePath - tokenizes an input string and returns the files in it the current user can modify Write-UserAddMSI - write out a MSI installer that prompts for a user to be added Invoke-WScriptUACBypass - performs the bypass UAC attack by abusing the lack of an embedded manifest in wscript.exe Invoke-PrivescAudit - runs all current escalation checks and returns a report (formerly Invoke-AllChecks) ``` ## Resources PowerUp.ps1 - GitHub: