Windows Privilege Escalation

# RoE: authorised testing only on systems you own / have written permission to test.
# Test in a lab VM (Windows 11 / Server 2022 + AD lab). Never on production.

# ===== Why study this =====
# Defenders need to know vectors to detect + prevent them.
# Every offensive technique pairs with: detection rule + hardening control.

# ===== Common vectors (with defenses) =====

# 1. Unquoted service paths
# Service binary path with spaces + no quotes:
#   C:\Program Files\My App\service.exe
# Windows tries C:\Program.exe first, then C:\Program Files\My.exe, etc.
# Attacker plants C:\Program.exe -> runs as SYSTEM.
# Detect: wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "\"\""
# Defense:
#   sc config <svc> binPath= '"C:\Program Files\My App\service.exe"'
# Audit all services on patch.

# 2. Weak service permissions
# Non-admin users can MODIFY a service config (binPath) or RESTART it.
# Detect with accesschk: accesschk.exe -uwcqv "Authenticated Users" *
# Defense: review service ACLs; only SYSTEM + Administrators have full control.

# 3. AlwaysInstallElevated
# Registry key that lets MSI installers run as SYSTEM:
#   HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated = 1
# Attacker drops a malicious MSI -> SYSTEM.
# Defense: never enable this policy; check both HKLM + HKCU.

# 4. UAC bypass (token manipulation)
# Various techniques abuse auto-elevation rules in legitimate binaries
# (fodhelper.exe, eventvwr.exe, etc).
# Defense: set UAC slider to maximum; use Microsoft Defender Application Control
# or AppLocker to whitelist binaries.

# 5. Kerberoasting (AD)
# Request TGS for service accounts with SPNs; crack offline.
# Defense:
# - Long random passwords on service accounts (or use gMSA)
# - Disable RC4 cipher in Kerberos
# - Detection: Event ID 4769 with unusual TGS requests

# 6. ASREP-roasting
# Accounts with 'Do not require Kerberos pre-authentication' can be cracked offline.
# Defense: enable Kerberos pre-auth on every account; alert on changes.

# 7. Credential dumping (LSASS)
# Mimikatz reads cleartext credentials from LSASS memory.
# Defense:
# - Enable Credential Guard
# - PPL (Protected Process Light) on LSASS: RunAsPPL = 1
# - Disable WDigest
# - Defender ATP / EDR for LSASS access detection

# 8. Token impersonation (SeImpersonatePrivilege)
# Services with SeImpersonate (often IIS, MSSQL) can be exploited via 'Potato' attacks.
# Defense:
# - Patch the OS (most Potato variants fixed by year)
# - Remove SeImpersonatePrivilege from service accounts when possible
# - Detect: Event ID 4624 with logon type 9 from unexpected processes

# ===== Hardening checklist =====
# - Apply Windows Updates + monthly cumulative patches
# - Enable BitLocker + TPM
# - Credential Guard + LSA PPL
# - Defender SmartScreen + ASR rules
# - AppLocker / Windows Defender Application Control
# - Restrict PowerShell to Constrained Language Mode where you can
# - PowerShell script block + module logging -> SIEM
# - Audit policies: process creation (4688), Kerberos (4769), logon (4624/4625)

# ===== Detection rules =====
# - Process spawning unusual children (winword.exe -> powershell.exe)
# - LSASS handle opened by non-system process
# - Suspicious sc.exe / wmic service modifications
# - Kerberos TGS requests with RC4 etype from non-typical accounts
# - Scheduled tasks created by non-admin users

# ===== Tools (defensive lab use) =====
# - Sysinternals (Procmon, Process Explorer, AccessChk, Autoruns)
# - PowerSploit / PowerView (defensive understanding only)
# - SharpUp / WinPEAS / PrivescCheck (audit your own boxes)
# - BloodHound (AD attack path analysis -> remove the paths)
# - Sysmon + Splunk / Sentinel / Elastic for log analysis

# ===== Patterns to internalise =====
# - RoE FIRST; lab only
# - Patch + minimise + log
# - Every offensive technique pairs with a detection + hardening note
# - Audit services + permissions quarterly
# - Defender + Credential Guard + LSA PPL on every Windows system

# ===== Pitfalls =====
# - Testing on production
# - Sharing exploits publicly without coordinating with the vendor
# - Skipping the hardening write-up
# - Assuming 'we have Defender' = safe (configure + monitor it)

# Windows post-exploitation enumeration (authorised hosts only):
#   - whoami /priv  whoami /groups
#   - Unquoted service paths, weak ACLs, AutoLogon registry keys
# Helpers: winPEAS, PowerUp.
# Goal in a report: describe the path + how to break it (least privilege, patches).