~/tutorials/037-up-on-windows.md

037: Up, on Windows

The same question with a different map. What on this box runs with more rights than you, and what decides to run next?

The commands are PowerShell and cmd, and they run on the Windows guest, from the seat you hold. Every one of them is a question the box answers about itself:

C:\> whoami /priv
C:\> whoami /groups
C:\> sc.exe query state= all
C:\> powershell "Get-CimInstance Win32_Service | Select Name,PathName,StartMode"
C:\> dir "C:\Program Files"

Windows escalation turns on three ideas.

Tokens. whoami /priv lists what your process is allowed to do, and one privilege in the list regularly ends engagements. SeImpersonatePrivilege means you can pose as anyone who connects to you, and a service will connect to you the moment you ask it to. The potato family is that sentence with tooling attached: JuicyPotato on older builds, PrintSpoofer and RoguePotato on newer ones, each one a different way of making a privileged service knock on your door.

Unquoted paths. A service set to run an executable under Program Files, stored unquoted, can be tricked into running a different executable at the root of the drive instead, because the parser stops at the first space. If you can write to that root, you choose what runs. The bug is a quoting mark that was never typed.

One line of this census died recently, and knowing that is part of reading it. wmic served twenty years of enumeration and Windows 11 removed it, so on a current box the service census speaks PowerShell: Get-CimInstance Win32_Service answers what wmic service get name,pathname,startmode used to. A guide that still prints wmic is telling you when it was written.

Service permissions. Services run as SYSTEM when they run at all, and the registry entries describing them are sometimes writable by ordinary users. Change what the service runs, restart it, and the thing you changed runs as SYSTEM.

Bug or misconfiguration

Same lesson as Linux, worth saying twice. A missing patch is a bug, and it is the vendor's. A service ACL open to Everyone is a misconfiguration, and it is somebody's afternoon in 2019. The overwhelming majority of real escalations are the second kind, and no patch Tuesday closes them.

Try it

Put a Windows VM in your lab. The hypervisor is the one lesson 031 built, and the Windows guest itself, with the download source and the first boot, is on the apparatus page the guest and the domain.
Run the census. Write down every privilege, every service path, every permission that surprises you. The five commands above are the census, and whoami /priv is the one to read first.
Escalate once. Then close the route and verify it closed.

Reveal the answer

Which escalation to fire is decided by what the census said, and the honest first run uses a misconfiguration you planted yourself, the same discipline as the Linux lesson. Two shapes that plant cleanly on a lab guest:

An unquoted service path. Install any service under C:\Program Files\ with a space in the vendor directory and leave the binary path unquoted in the registry. From your ordinary user, verify with sc qc <name> that the path carries no quotes, and confirm your write access to C:\. The escalation is placing your executable at the root as the word the parser stops on, restarting the service, and cleaning up after.

A writable service. accesschk, from Sysinternals, lists what your user can change: accesschk -uwcqv <user> *. A service you can reconfigure takes a new binPath through sc config, and the next start runs it as SYSTEM. sc config <name> binPath= "cmd /c net localgroup administrators <user> /add" is the whole firing: the next service start adds you to the administrators group, and the census that verifies it is net localgroup administrators.

Closing is the same one line per route. Requote the path or delete the planted executable. Restore the service's original binPath. Remove the account from the group with the same net localgroup command and a minus where the plus was. Then re-run the census from the ordinary seat until every answer reads the way it did before you touched anything, because the box that comes back clean is the only receipt a defender ever sees.

The parallel with the Linux lesson is deliberate. The maps differ, the discipline is one discipline: full census, verified understanding, one shot.