[33m [!] If you want to run the file analysis checks (search sensitive information in files), you need to specify the ‘fileanalysis’ or ‘all’ argument. Note that this search might take several minutes. For help, run winpeass.exe —help[0m
ANSI color bit for Windows is not set. If you are executing this from a Windows terminal inside the host you should run ‘REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1’ and then start a new CMD
Long paths are disabled, so the maximum length of a path supported is 260 chars (this may cause false negatives when looking for files). If you are admin, you can enable it with ‘REG ADD HKLM\SYSTEM\CurrentControlSet\Control\FileSystem /v VirtualTerminalLevel /t REG_DWORD /d 1’ and then start a new CMD
[34m
[1;32m((((((((((((((((((((((((((((((((
[1;32m(((((((((((((((((((((((((((((((((((((((((((
[1;32m(((((((((((((([34m**********/[1;32m##########[1;32m(((((((((((((
[1;32m(((((((((((([34m********************/[1;32m#######[1;32m(((((((((((
[1;32m(((((((([34m[0m/@@@@@/[1;32m[34m[1;32m######[1;32m((((((((((
[1;32m(((((([34m[0m@@@@@@@@@@/[1;32m[34m*,[1;32m####[1;32m((((((((((
[1;32m((((([34m[0m/@@@@@%@@@@/[1;32m[34m[1;32m##[1;32m(((((((((
[1;32m((([1;32m############[34m*[0m/%@@@@@@@@@/[1;32m[34m[1;32m((((((((
[1;32m(([1;32m##################(/[34m[0m/@@@@@/[1;32m[34m[1;32m((((((
[1;32m(([1;32m#########################(/[34m*******[1;32m(((((
[1;32m(([1;32m##############################(/[34m[1;32m(((((
[1;32m(([1;32m###################################(/[34m[1;32m(((((
[1;32m(([1;32m#######################################([34m[1;32m(((((
[1;32m(([1;32m#######(,..,(###################(...[34m*****[1;32m(((((
[1;32m(([1;32m#######(#####((##################((######/([34m[1;32m(((((
[1;32m(([1;32m###################(/*****(##############([1;32m)(((((
[1;32m((([1;32m#####################/*******(################[1;32m)((((((
[1;32m(((([1;32m############################################[1;32m)((((((
[1;32m((((([1;32m##########################################[1;32m)(((((((
[1;32m(((((([1;32m########################################[1;32m)(((((((
[1;32m(((((((([1;32m####################################[1;32m)((((((((
[1;32m((((((((([1;32m#################################[1;32m)(((((((((
[1;32m(((((((((([1;32m##########################[1;32m)(((((((((
[1;32m((((((((((((((((((((((((((((((((((((((
[1;32m(((((((((((((((((((((((((((((([0m
[1;33mADVISORY: [34mwinpeas should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own devices and/or with the device owner’s permission.
[33m WinPEAS-ng[0m[33m by @hacktricks_live[0m
[1;32m
/---------------------------------------------------------------------------------
| [34mDo you like PEASS?[1;32m |
|---------------------------------------------------------------------------------|
| [33mLearn Cloud Hacking[1;32m : [1;31mtraining.hacktricks.xyz [1;32m |
| [33mFollow on Twitter[1;32m : [1;31m@hacktricks_live[1;32m |
| [33mRespect on HTB[1;32m : [1;31mSirBroccoli [1;32m |
|---------------------------------------------------------------------------------|
| [34mThank you![1;32m |
---------------------------------------------------------------------------------/
[0m
[33m [+] [1;32mLegend:[0m
[1;31m Red[1;37m Indicates a special privilege over an object or something is misconfigured[0m
[1;32m Green[1;37m Indicates that some protection is enabled or something is well configured[0m
[36m Cyan[1;37m Indicates active users[0m
[34m Blue[1;37m Indicates disabled users[0m
[1;33m LightYellow[1;37m Indicates links[0m
[34m You can find a Windows local PE Checklist here: [33mhttps://book.hacktricks.wiki/en/windows-hardening/checklist-windows-privilege-escalation.html [1;90m Creating Dynamic lists, this could take a while, please wait…[0m [1;90m - Loading sensitive_files yaml definitions file…[0m [1;90m - Loading regexes yaml definitions file…[0m [1;90m - Checking if domain…[0m [1;90m - Getting Win32_UserAccount info…[0m [1;90mError while getting Win32_UserAccount info: System.Management.ManagementException: Access denied at System.Management.ThreadDispatch.Start() at System.Management.ManagementScope.Initialize() at System.Management.ManagementObjectSearcher.Initialize() at System.Management.ManagementObjectSearcher.Get() at winPEAS.Checks.Checks.a(Boolean A_0)[0m [1;90m - Creating current user groups list…[0m [1;90m - Creating active users list (local only)…[0m [1;90m [X] Exception: Object reference not set to an instance of an object.[0m [1;90m - Creating disabled users list…[0m [1;90m [X] Exception: Object reference not set to an instance of an object.[0m [1;90m - Admin users list…[0m [1;90m [X] Exception: Object reference not set to an instance of an object.[0m [1;90m - Creating AppLocker bypass list…[0m [1;90m - Creating files/directories list for search…[0m
[1;36mÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ͹ [1;32mSystem Information[1;36m ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mBasic System Information[0m [1;36mÈ [1;34mCheck if the Windows versions is vulnerable to some known exploit [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#version-exploits[0m [1;90m [X] Exception: Access denied [0m [1;90m [X] Exception: Access denied [0m [1;90m [X] Exception: The given key was not present in the dictionary.[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mShowing All Microsoft Updates[0m [1;90m [X] Exception: Creating an instance of the COM component with CLSID {B699E5E8-67FF-4177-88B0-3684A3388BFB} from the IClassFactory failed due to the following error: 80070005 Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)).[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mSystem Last Shutdown Date/time (from Registry) [0m Last Shutdown Date/time : 10/10/2024 7:50:09 PM
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mUser Environment Variables[0m
[1;36mÈ [1;34mCheck for some passwords or keys in the env variables [1;33m[0m
[1;37m COMPUTER[0m[1;31mNAME[0m: [0mWS26
[1;37m PUBLIC: [0mC:\Users\Public
[1;37m LOCALAPPDATA: [0mC:\Users\r.andrews\AppData\Local
[1;37m PSModulePath: [0mC:\Users\r.andrews\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules
[1;37m PROCESSOR_ARCHITECTURE: [0mAMD64
[1;37m Path: [0mC:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Windows\System32\OpenSSH;C:\Users\r.andrews\AppData\Local\Microsoft\WindowsApps
[1;37m CommonProgramFiles(x86): [0mC:\Program Files (x86)\Common Files
[1;37m ProgramFiles(x86): [0mC:\Program Files (x86)
[1;37m PROCESSOR_LEVEL: [0m6
[1;37m ProgramFiles: [0mC:\Program Files
[1;37m PATHEXT: [0m.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL
[1;37m USERPROFILE: [0mC:\Users\r.andrews
[1;37m SystemRoot: [0mC:\Windows
[1;37m ALLUSERSPROFILE: [0mC:\ProgramData
[1;37m DriverData: [0mC:\Windows\System32\Drivers\DriverData
[1;37m ProgramData: [0mC:\ProgramData
[1;37m PROCESSOR_REVISION: [0m4f01
[1;37m USER[0m[1;31mNAME[0m: [0mr.andrews
[1;37m CommonProgramW6432: [0mC:\Program Files\Common Files
[1;37m CommonProgramFiles: [0mC:\Program Files\Common Files
[1;37m OS: [0mWindows_NT
[1;37m PROCESSOR_IDENTIFIER: [0mIntel64 Family 6 Model 79 Stepping 1, GenuineIntel
[1;37m ComSpec: [0mC:\Windows\system32\cmd.exe
[1;37m SystemDrive: [0mC:
[1;37m TEMP: [0mC:\Users\R8A361.AND\AppData\Local\Temp
[1;37m NUMBER_OF_PROCESSORS: [0m2
[1;37m APPDATA: [0mC:\Users\r.andrews\AppData\Roaming
[1;37m TMP: [0mC:\Users\R8A361.AND\AppData\Local\Temp
[1;37m ProgramW6432: [0mC:\Program Files
[1;37m windir: [0mC:\Windows
[1;37m USERDOMAIN: [0mOSCP
[1;37m USERDNSDOMAIN: [0moscp.exam
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mSystem Environment Variables[0m
[1;36mÈ [1;34mCheck for some passwords or keys in the env variables [1;33m[0m
[1;37m ComSpec: [0mC:\Windows\system32\cmd.exe
[1;37m DriverData: [0mC:\Windows\System32\Drivers\DriverData
[1;37m OS: [0mWindows_NT
[1;37m Path: [0mC:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Windows\System32\OpenSSH
[1;37m PATHEXT: [0m.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
[1;37m PROCESSOR_ARCHITECTURE: [0mAMD64
[1;37m PSModulePath: [0mC:\Program Files\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules
[1;37m TEMP: [0mC:\Windows\TEMP
[1;37m TMP: [0mC:\Windows\TEMP
[1;37m USER[0m[1;31mNAME[0m: [0mSYSTEM
[1;37m windir: [0mC:\Windows
[1;37m NUMBER_OF_PROCESSORS: [0m2
[1;37m PROCESSOR_LEVEL: [0m6
[1;37m PROCESSOR_IDENTIFIER: [0mIntel64 Family 6 Model 79 Stepping 1, GenuineIntel
[1;37m PROCESSOR_REVISION: [0m4f01
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mAudit Settings[0m [1;36mÈ [1;34mCheck what is being logged [1;33m[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mAudit Policy Settings - Classic & Advanced[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mWEF Settings[0m [1;36mÈ [1;34mWindows Event Forwarding, is interesting to know were are sent the logs [1;33m[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLAPS Settings[0m [1;36mÈ [1;34mIf installed, local administrator password is changed frequently and is restricted by ACL [1;33m[0m [1;37m LAPS Enabled: [0m[0m[1;31mLAPS not installed[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mWdigest[0m [1;36mÈ [1;34mIf enabled, plain-text crds could be stored in LSASS [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#wdigest[0m [1;32m Wdigest is not enabled[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLSA Protection[0m [1;36mÈ [1;34mIf enabled, a driver is needed to read LSASS memory (If Secure Boot or UEFI, RunAsPPL cannot be disabled by deleting the registry key) [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#lsa-protection[0m [1;31m LSA Protection is not enabled[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mCredentials Guard[0m [1;36mÈ [1;34mIf enabled, a driver is needed to read LSASS memory [1;33mhttps://book.hacktricks.wiki/windows-hardening/stealing-credentials/credentials-protections#credentials-guard[0m [1;31m CredentialGuard is not enabled[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mCached Creds[0m [1;36mÈ [1;34mIf > 0, credentials will be cached in the registry and accessible by SYSTEM user [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#cached-credentials[0m [1;31m cachedlogonscount is 10[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEnumerating saved credentials in Registry (CurrentPass)[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mAV Information[0m [1;90m [X] Exception: Access denied [0m [1;31m No AV was detected!![0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mWindows Defender configuration[0m [1;34m Local Settings[0m [1;34m Group Policy Settings[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mUAC Status[0m [1;36mÈ [1;34mIf you are in the Administrators group check how to bypass the UAC [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#from-administrator-medium-to-high-integrity-level—uac-bypasss[0m [1;37m ConsentPromptBehaviorAdmin: [0m0 - [0m[1;31mNo prompting[0m [1;37m EnableLUA: [0m0 [1;37m LocalAccountTokenFilterPolicy: [0m1 [1;37m FilterAdministratorToken: [0m1 [1;31m [*] EnableLUA != 1, UAC policies disabled. [+] Any local account can be used for lateral movement.[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mPowerShell Settings[0m [1;37m PowerShell v2 Version: [0m2.0 [1;37m PowerShell v5 Version: [0m5.1.22621.1 [1;37m PowerShell Core Version: [0m [1;37m Transcription Settings: [0m [1;37m Module Logging Settings: [0m [1;37m Scriptblock Logging Settings: [0m [1;37m [0m[1;31mPS history file: [0m[0m [1;37m [0m[1;31mPS history size: [0m[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEnumerating PowerShell Session Settings using the registry[0m You must be an administrator to run this check
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mPS default transcripts history[0m [1;36mÈ [1;34mRead the PS history inside these files (if any)[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mHKCU Internet Settings[0m [1;37m CertificateRevocation: [0m1 [1;37m DisableCachingOfSSLPages: [0m0 [1;37m IE5_UA_Backup_Flag: [0m5.0 [1;37m PrivacyAdvanced: [0m1 [1;37m SecureProtocols: [0m10240 [1;37m User Agent: [0mMozilla/5.0 (compatible; MSIE 9.0; Win32)
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mHKLM Internet Settings[0m [1;37m ActiveXCache: [0mC:\Windows\Downloaded Program Files [1;37m CodeBaseSearchPath: [0mCODEBASE [1;37m EnablePunycode: [0m1 [1;37m MinorVersion: [0m0 [1;37m WarnOnIntranet: [0m1
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mDrives Information[0m [1;36mÈ [1;34mRemember that you should search more info inside the other drives [1;33m[0m C:\ (Type: Fixed)(Filesystem: NTFS)(Available space: 24 GB)([0m[1;31mPermissions: Authenticated Users [Allow: AppendData/CreateDirectories])[0m D:\ (Type: CDRom)
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mChecking WSUS[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#wsus[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mChecking KrbRelayUp[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#krbrelayup[0m [1;31m The system is inside a domain (OSCP) so it could be vulnerable.[0m [1;36mÈ [1;34mYou can try https://github.com/Dec0ne/KrbRelayUp to escalate privileges[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mChecking If Inside Container[0m [1;36mÈ [1;34mIf the binary cexecsvc.exe or associated service exists, you are inside Docker [1;33m[0m [1;32mYou are NOT inside a container[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mChecking AlwaysInstallElevated[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#alwaysinstallelevated[0m [1;32m AlwaysInstallElevated isn’t available[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEnumerate LSA settings - auth packages included [0m auditbasedirectories : 0 auditbaseobjects : 0 Authentication Packages : msv1_0 Bounds : 00-30-00-00-00-20-00-00 crashonauditfail : 0 fullprivilegeauditing : 00 LimitBlankPasswordUse : 1 NoLmHash : 1 Notification Packages : scecli Security Packages : "" LsaPid : 748 LsaCfgFlagsDefault : 0 SecureBoot : 1 ProductType : 4 disabledomaincreds : 0 everyoneincludesanonymous : 0 forceguest : 0 restrictanonymous : 0 restrictanonymoussam : 1 RunAsPPL : 0 IsPplAutoEnabled : 1 SCENoApplyLegacyAuditPolicy : 0 TurnOffAnonymousBlock : 0 LsaConfigFlags : 0 RunAsPPLBoot : 0
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEnumerating NTLM Settings[0m [1;31m LanmanCompatibilityLevel : (Send NTLMv2 response only - Win7+ default) [0m [1;34m NTLM Signing Settings[0m ClientRequireSigning : [0m[1;31mFalse[0m ClientNegotiateSigning : [0m[1;32mTrue[0m ServerRequireSigning : [0m[1;31mFalse[0m ServerNegotiateSigning : [0m[1;31mFalse[0m LdapSigning : [0m[33m[0m[33mNegotiate signing[0m[0m ([0m[33m[0m[33mNegotiate signing[0m[0m) [1;34m Session Security[0m [1;32m NTLMMinClientSec : 536870912 (Require 128-bit encryption)[0m [1;32m NTLMMinServerSec : 536870912 (Require 128-bit encryption) [0m [1;34m NTLM Auditing and Restrictions[0m InboundRestrictions : (Not defined) [1;31m OutboundRestrictions : (Not defined)[0m InboundAuditing : (Not defined) OutboundExceptions :
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mDisplay Local Group Policy settings - local users/machine[0m Type : machine Display Name : Default Domain Policy Name : {31B2F340-016D-11D2-945F-00C04FB984F9} Extensions : [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}][{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}] File Sys Path : C:\Windows\system32\GroupPolicy\DataStore\0\sysvol\oscp.exam\Policies{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine Link : LDAP://DC=oscp,DC=exam GPO Link : Domain Options : All Sections Enabled
[1;90m =================================================================================================[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mPotential GPO abuse vectors (applied domain GPOs writable by current user)[0m [1;90m [-] Controlled exception, info about OSCP\r.andrews not found[0m No obvious GPO abuse via writable SYSVOL paths or GPCO membership detected.
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mChecking AppLocker effective policy[0m AppLockerPolicy version: 1 listing rules:
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEnumerating Printers (WMI)[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEnumerating Named Pipes[0m Name CurrentUserPerms Sddl
eventlog [0m[1;31mEveryone [Allow: WriteData/CreateFiles][0m O:LSG:LSD:P(A;;0x12019b;;;WD)(A;;CC;;;OW)(A;;0x12008f;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)
vgauth-service [0m[1;31mEveryone [Allow: WriteData/CreateFiles][0m O:BAG:SYD:P(A;;0x12019f;;;WD)(A;;FA;;;SY)(A;;FA;;;BA)
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEnumerating AMSI registered providers[0m Provider: {2781761E-28E0-4109-99FE-B9D127C57AFE} Path:
[1;90m =================================================================================================[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEnumerating Sysmon configuration[0m You must be an administrator to run this check
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEnumerating Sysmon process creation logs (1)[0m You must be an administrator to run this check
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mInstalled .NET versions [0m
[1;36mÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ͹ [1;32mInteresting Events information[1;36m ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mPrinting Explicit Credential Events (4648) for last 30 days - A process logged on using plaintext credentials [0m You must be an administrator to run this check
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mPrinting Account Logon Events (4624) for the last 10 days. [0m You must be an administrator to run this check
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mProcess creation events - searching logs (EID 4688) for sensitive data. [0m You must be an administrator to run this check
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mPowerShell events - script block logs (EID 4104) - searching for sensitive data. [0m [1;90m [X] Exception: Attempted to perform an unauthorized operation.[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mDisplaying Power off/on events for last 5 days [0m System.UnauthorizedAccessException: Attempted to perform an unauthorized operation. at System.Diagnostics.Eventing.Reader.EventLogException.Throw(Int32 errorCode) at System.Diagnostics.Eventing.Reader.NativeWrapper.EvtQuery(EventLogHandle session, String path, String query, Int32 flags) at System.Diagnostics.Eventing.Reader.EventLogReader..ctor(EventLogQuery eventQuery, EventBookmark bookmark) at winPEAS.Helpers.MyUtils.GetEventLogReader(String path, String query, String computerName) at hq.a.b() at i4.a()
[1;36mÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ͹ [1;32mUsers Information[1;36m ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mUsers[0m [1;36mÈ [1;34mCheck if you have some admin equivalent privileges [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#users—groups[0m [1;90m [X] Exception: Object reference not set to an instance of an object.[0m Current user: [0m[1;35mr.andrews[0m Current groups: Domain Users, Everyone, Builtin\Remote Desktop Users, Builtin\Remote Management Users, Users, Network, Authenticated Users, This Organization, NTLM Authentication [1;90m =================================================================================================[0m
[1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mCurrent User Idle Time[0m Current User : OSCP\r.andrews Idle Time : 00h:46m:35s:140ms
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mDisplay Tenant information (DsRegCmd.exe /status)[0m Tenant is NOT Azure AD Joined.
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mCurrent Token privileges[0m [1;36mÈ [1;34mCheck if you can escalate privilege using some enabled token [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#token-manipulation[0m [1;37m SeShutdownPrivilege: [0mSE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED [1;37m SeChangeNotifyPrivilege: [0mSE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED [1;37m SeUndockPrivilege: [0mSE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED [1;37m SeIncreaseWorkingSetPrivilege: [0mSE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED [1;37m SeTimeZonePrivilege: [0mSE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mClipboard text[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLogged users[0m [1;90m [X] Exception: Access denied [0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mDisplay information about local users[0m Computer Name : WS26 User Name : [0m[1;31mAdministrator[0m User Id : 500 Is Enabled : [0m[1;31mTrue[0m User Type : [0m[1;31mAdministrator[0m Comment : Built-in account for administering the computer/domain Last Logon : 2/28/2026 8:06:28 AM Logons Count : 27 Password Last Set : 10/9/2024 10:41:39 AM
[1;90m =================================================================================================[0m
Computer Name : WS26 User Name : DefaultAccount User Id : 503 Is Enabled : [0m[1;32mFalse[0m User Type : [0m[33mGuest[0m Comment : A user account managed by the system. Last Logon : 1/1/1970 12:00:00 AM Logons Count : 0 Password Last Set : 1/1/1970 12:00:00 AM
[1;90m =================================================================================================[0m
Computer Name : WS26 User Name : [0m[33mGuest[0m User Id : 501 Is Enabled : [0m[1;32mFalse[0m User Type : [0m[33mGuest[0m Comment : Built-in account for guest access to the computer/domain Last Logon : 1/1/1970 12:00:00 AM Logons Count : 0 Password Last Set : 1/1/1970 12:00:00 AM
[1;90m =================================================================================================[0m
Computer Name : WS26 User Name : WDAGUtilityAccount User Id : 504 Is Enabled : [0m[1;32mFalse[0m User Type : [0m[33mGuest[0m Comment : A user account managed and used by the system for Windows Defender Application Guard scenarios. Last Logon : 1/1/1970 12:00:00 AM Logons Count : 0 Password Last Set : 10/9/2024 1:44:21 PM
[1;90m =================================================================================================[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mRDP Sessions[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEver logged users[0m [1;90m [X] Exception: Access denied [0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mHome folders found[0m [1;32m C:\Users\Administrator[0m [1;32m C:\Users\All Users[0m [1;32m C:\Users\Default[0m [1;32m C:\Users\Default User[0m [1;32m C:\Users\Public[0m [1;31m C:\Users\r.andrews : r.andrews [Allow: AllAccess][0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking for AutoLogon credentials[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mPassword Policies[0m [1;36mÈ [1;34mCheck for a possible brute-force [1;33m[0m [1;37m Domain: [0mBuiltin [1;37m SID: [0mS-1-5-32 [1;37m MaxPasswordAge: [0m42.22:47:31.7437440 [1;37m MinPasswordAge: [0m00:00:00 [1;37m MinPasswordLength: [0m0 [1;37m PasswordHistoryLength: [0m0 [1;37m PasswordProperties: [0mDOMAIN_LOCKOUT_ADMINS [1;90m =================================================================================================[0m
[1;37m Domain: [0mWS26 [1;37m SID: [0mS-1-5-21-2756297892-2186407355-380279769 [1;37m MaxPasswordAge: [0m42.00:00:00 [1;37m MinPasswordAge: [0m1.00:00:00 [1;37m MinPasswordLength: [0m7 [1;37m PasswordHistoryLength: [0m24 [1;37m PasswordProperties: [0mDOMAIN_LOCKOUT_ADMINS [1;90m =================================================================================================[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mPrint Logon Sessions[0m
[1;36mÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ͹ [1;32mProcesses Information[1;36m ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mInteresting Processes -non Microsoft-[0m [1;36mÈ [1;34mCheck if any interesting processes for memory dump or if you could overwrite some binary running [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#running-processes[0m [1;90m [X] Exception: Access denied [0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mVulnerable Leaked Handlers[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#leaked-handlers[0m [1;36mÈ [1;34mGetting Leaked Handlers, it might take some time…[0m [1;37m Handle: [0m1820(key) [1;37m Handle Owner: [0mPid is 7108(winpeas) with owner: [0m[1;31mr.andrews[0m [1;37m Reason: [0m[0m[1;31mAllAccess[0m [1;37m Registry: [0mHKLM\software\microsoft\windowsruntime [1;90m =================================================================================================[0m
[1;37m Handle: [0m1840(key) [1;37m Handle Owner: [0mPid is 7108(winpeas) with owner: [0m[1;31mr.andrews[0m [1;37m Reason: [0m[0m[1;31mTakeOwnership[0m [1;37m Registry: [0mHKLM\software\microsoft\fusion\publisherpolicy\default [1;90m =================================================================================================[0m
[1;36mÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ͹ [1;32mServices Information[1;36m ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ[0m [1;90m [X] Exception: Cannot open Service Control Manager on computer ’.‘. This operation might require other privileges.[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mInteresting Services -non Microsoft-[0m [1;36mÈ [1;34mCheck if you can overwrite some service binary or perform a DLL hijacking, also check for unquoted paths [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#services[0m [1;90m [X] Exception: Access denied [0m @amdgpio2.inf,%GPIO.SvcDesc%;AMD GPIO Client Driver(Advanced Micro Devices, Inc - @amdgpio2.inf,%GPIO.SvcDesc%;AMD GPIO Client Driver)[[0m[1;32mC:\Windows\System32\drivers\amdgpio2.sys[0m] - System [1;90m =================================================================================================[0m
@amdi2c.inf,%amdi2c.SVCDESC%;AMD I2C Controller Service(Advanced Micro Devices, Inc - @amdi2c.inf,%amdi2c.SVCDESC%;AMD I2C Controller Service)[[0m[1;32mC:\Windows\System32\drivers\amdi2c.sys[0m] - System
[1;90m =================================================================================================[0m
@AppleSSD.inf,%DevDesc1%;Apple Solid State Drive Device(Apple Inc. - @AppleSSD.inf,%DevDesc1%;Apple Solid State Drive Device)[[0m[1;32mSystem32\drivers\AppleSSD.sys[0m] - Boot
[1;90m =================================================================================================[0m
@arcsas.inf,%arcsas_ServiceName%;Adaptec SAS/SATA-II RAID Storport's Miniport Driver(PMC-Sierra, Inc. - @arcsas.inf,%arcsas_ServiceName%;Adaptec SAS/SATA-II RAID Storport's Miniport Driver)[[0m[1;32mSystem32\drivers\arcsas.sys[0m] - Boot
[1;90m =================================================================================================[0m
@netbvbda.inf,%vbd_srv_desc%;QLogic Network Adapter VBD(QLogic Corporation - @netbvbda.inf,%vbd_srv_desc%;QLogic Network Adapter VBD)[[0m[1;32mSystem32\drivers\bxvbda.sys[0m] - Boot
[1;90m =================================================================================================[0m
@bcmfn2.inf,%bcmfn2.SVCDESC%;bcmfn2 Service(Windows (R) Win 7 DDK provider - @bcmfn2.inf,%bcmfn2.SVCDESC%;bcmfn2 Service)[[0m[1;32mC:\Windows\System32\drivers\bcmfn2.sys[0m] - System
[1;90m =================================================================================================[0m
@cht4vx64.inf,%cht4vbd.generic%;Chelsio Virtual Bus Driver(Chelsio Communications - @cht4vx64.inf,%cht4vbd.generic%;Chelsio Virtual Bus Driver)[[0m[1;32mC:\Windows\System32\drivers\cht4vx64.sys[0m] - System
[1;90m =================================================================================================[0m
@net1ic64.inf,%e1iExpress.Service.DispName%;Intel(R) PRO/1000 PCI Express Network Connection Driver I(Intel Corporation - @net1ic64.inf,%e1iExpress.Service.DispName%;Intel(R) PRO/1000 PCI Express Network Connection Driver I)[[0m[1;32mC:\Windows\System32\drivers\e1i68x64.sys[0m] - System
[1;90m =================================================================================================[0m
@netevbda.inf,%vbd_srv_desc%;QLogic 10 Gigabit Ethernet Adapter VBD(Marvell Semiconductor Inc. - @netevbda.inf,%vbd_srv_desc%;QLogic 10 Gigabit Ethernet Adapter VBD)[[0m[1;32mSystem32\drivers\evbda.sys[0m] - Boot
[1;90m =================================================================================================[0m
@netevbd0a.inf,%vbd_srv_desc%;QLogic Legacy Ethernet Adapter VBD(QLogic Corporation - @netevbd0a.inf,%vbd_srv_desc%;QLogic Legacy Ethernet Adapter VBD)[[0m[1;32mSystem32\drivers\evbd0a.sys[0m] - Boot
[1;90m =================================================================================================[0m
@iagpio.inf,%iagpio.SVCDESC%;Intel Serial IO GPIO Controller Driver(Intel(R) Corporation - @iagpio.inf,%iagpio.SVCDESC%;Intel Serial IO GPIO Controller Driver)[[0m[1;32mC:\Windows\System32\drivers\iagpio.sys[0m] - System
[1;90m =================================================================================================[0m
@iai2c.inf,%iai2c.SVCDESC%;Intel(R) Serial IO I2C Host Controller(Intel(R) Corporation - @iai2c.inf,%iai2c.SVCDESC%;Intel(R) Serial IO I2C Host Controller)[[0m[1;32mC:\Windows\System32\drivers\iai2c.sys[0m] - System
[1;90m =================================================================================================[0m
@iaLPSS2i_GPIO2_SKL.inf,%iaLPSS2i_GPIO2.SVCDESC%;Intel(R) Serial IO GPIO Driver v2(Intel Corporation - @iaLPSS2i_GPIO2_SKL.inf,%iaLPSS2i_GPIO2.SVCDESC%;Intel(R) Serial IO GPIO Driver v2)[[0m[1;32mC:\Windows\System32\drivers\iaLPSS2i_GPIO2.sys[0m] - System
[1;90m =================================================================================================[0m
@iaLPSS2i_GPIO2_BXT_P.inf,%iaLPSS2i_GPIO2_BXT_P.SVCDESC%;Intel(R) Serial IO GPIO Driver v2(Intel Corporation - @iaLPSS2i_GPIO2_BXT_P.inf,%iaLPSS2i_GPIO2_BXT_P.SVCDESC%;Intel(R) Serial IO GPIO Driver v2)[[0m[1;32mC:\Windows\System32\drivers\iaLPSS2i_GPIO2_BXT_P.sys[0m] - System
[1;90m =================================================================================================[0m
@iaLPSS2i_GPIO2_CNL.inf,%iaLPSS2i_GPIO2_CNL.SVCDESC%;Intel(R) Serial IO GPIO Driver v2(Intel Corporation - @iaLPSS2i_GPIO2_CNL.inf,%iaLPSS2i_GPIO2_CNL.SVCDESC%;Intel(R) Serial IO GPIO Driver v2)[[0m[1;32mC:\Windows\System32\drivers\iaLPSS2i_GPIO2_CNL.sys[0m] - System
[1;90m =================================================================================================[0m
@iaLPSS2i_GPIO2_GLK.inf,%iaLPSS2i_GPIO2_GLK.SVCDESC%;Intel(R) Serial IO GPIO Driver v2(Intel Corporation - @iaLPSS2i_GPIO2_GLK.inf,%iaLPSS2i_GPIO2_GLK.SVCDESC%;Intel(R) Serial IO GPIO Driver v2)[[0m[1;32mC:\Windows\System32\drivers\iaLPSS2i_GPIO2_GLK.sys[0m] - System
[1;90m =================================================================================================[0m
@iaLPSS2i_I2C_SKL.inf,%iaLPSS2i_I2C.SVCDESC%;Intel(R) Serial IO I2C Driver v2(Intel Corporation - @iaLPSS2i_I2C_SKL.inf,%iaLPSS2i_I2C.SVCDESC%;Intel(R) Serial IO I2C Driver v2)[[0m[1;32mC:\Windows\System32\drivers\iaLPSS2i_I2C.sys[0m] - System
[1;90m =================================================================================================[0m
@iaLPSS2i_I2C_BXT_P.inf,%iaLPSS2i_I2C_BXT_P.SVCDESC%;Intel(R) Serial IO I2C Driver v2(Intel Corporation - @iaLPSS2i_I2C_BXT_P.inf,%iaLPSS2i_I2C_BXT_P.SVCDESC%;Intel(R) Serial IO I2C Driver v2)[[0m[1;32mC:\Windows\System32\drivers\iaLPSS2i_I2C_BXT_P.sys[0m] - System
[1;90m =================================================================================================[0m
@iaLPSS2i_I2C_CNL.inf,%iaLPSS2i_I2C_CNL.SVCDESC%;Intel(R) Serial IO I2C Driver v2(Intel Corporation - @iaLPSS2i_I2C_CNL.inf,%iaLPSS2i_I2C_CNL.SVCDESC%;Intel(R) Serial IO I2C Driver v2)[[0m[1;32mC:\Windows\System32\drivers\iaLPSS2i_I2C_CNL.sys[0m] - System
[1;90m =================================================================================================[0m
@iaLPSS2i_I2C_GLK.inf,%iaLPSS2i_I2C_GLK.SVCDESC%;Intel(R) Serial IO I2C Driver v2(Intel Corporation - @iaLPSS2i_I2C_GLK.inf,%iaLPSS2i_I2C_GLK.SVCDESC%;Intel(R) Serial IO I2C Driver v2)[[0m[1;32mC:\Windows\System32\drivers\iaLPSS2i_I2C_GLK.sys[0m] - System
[1;90m =================================================================================================[0m
@ialpssi_gpio.inf,%iaLPSSi_GPIO.SVCDESC%;Intel(R) Serial IO GPIO Controller Driver(Intel Corporation - @ialpssi_gpio.inf,%iaLPSSi_GPIO.SVCDESC%;Intel(R) Serial IO GPIO Controller Driver)[[0m[1;32mC:\Windows\System32\drivers\iaLPSSi_GPIO.sys[0m] - System
[1;90m =================================================================================================[0m
@ialpssi_i2c.inf,%iaLPSSi_I2C.SVCDESC%;Intel(R) Serial IO I2C Controller Driver(Intel Corporation - @ialpssi_i2c.inf,%iaLPSSi_I2C.SVCDESC%;Intel(R) Serial IO I2C Controller Driver)[[0m[1;32mC:\Windows\System32\drivers\iaLPSSi_I2C.sys[0m] - System
[1;90m =================================================================================================[0m
@iastorav.inf,%iaStorAVC.DeviceDesc%;Intel Chipset SATA RAID Controller(Intel Corporation - @iastorav.inf,%iaStorAVC.DeviceDesc%;Intel Chipset SATA RAID Controller)[[0m[1;32mSystem32\drivers\iaStorAVC.sys[0m] - Boot
[1;90m =================================================================================================[0m
@iastorv.inf,%*PNP0600.DeviceDesc%;Intel RAID Controller Windows 7(Intel Corporation - @iastorv.inf,%*PNP0600.DeviceDesc%;Intel RAID Controller Windows 7)[[0m[1;32mSystem32\drivers\iaStorV.sys[0m] - Boot
[1;90m =================================================================================================[0m
@mlx4_bus.inf,%Ibbus.ServiceDesc%;Mellanox InfiniBand Bus/AL (Filter Driver)(Mellanox - @mlx4_bus.inf,%Ibbus.ServiceDesc%;Mellanox InfiniBand Bus/AL (Filter Driver))[[0m[1;32mC:\Windows\System32\drivers\ibbus.sys[0m] - System
[1;90m =================================================================================================[0m
@mlx4_bus.inf,%MLX4BUS.ServiceDesc%;Mellanox ConnectX Bus Enumerator(Mellanox - @mlx4_bus.inf,%MLX4BUS.ServiceDesc%;Mellanox ConnectX Bus Enumerator)[[0m[1;32mC:\Windows\System32\drivers\mlx4_bus.sys[0m] - System
[1;90m =================================================================================================[0m
@mlx4_bus.inf,%ndfltr.ServiceDesc%;NetworkDirect Service(Mellanox - @mlx4_bus.inf,%ndfltr.ServiceDesc%;NetworkDirect Service)[[0m[1;32mC:\Windows\System32\drivers\ndfltr.sys[0m] - System
[1;90m =================================================================================================[0m
NDKPerf Driver(NDKPerf Driver)[[0m[1;32msystem32\drivers\NDKPerf.sys[0m] - System
[1;90m =================================================================================================[0m
@pvscsii.inf,%pvscsi.DiskName%;pvscsi Storage Controller Driver(VMware, Inc. - @pvscsii.inf,%pvscsi.DiskName%;pvscsi Storage Controller Driver)[[0m[1;32mSystem32\drivers\pvscsii.sys[0m] - Boot
[1;90m =================================================================================================[0m
@routepolicy.inf,%RoutePolicy.SvcDesc%;Microsoft Route Policy Service(@routepolicy.inf,%RoutePolicy.SvcDesc%;Microsoft Route Policy Service)[[0m[1;32mC:\Windows\System32\drivers\RoutePolicy.sys[0m] - System
[1;90m =================================================================================================[0m
OpenSSH Authentication Agent(OpenSSH Authentication Agent)[[0m[1;32mC:\Windows\System32\OpenSSH\ssh-agent.exe[0m] - Manual
[1;37mAgent to hold private keys used for public key authentication.
[1;90m =================================================================================================[0m
@usbstor.inf,%USBSTOR.SvcDesc%;USB Mass Storage Driver(@usbstor.inf,%USBSTOR.SvcDesc%;USB Mass Storage Driver)[[0m[1;32mC:\Windows\System32\drivers\USBSTOR.SYS[0m] - System
[1;90m =================================================================================================[0m
@usbxhci.inf,%PCI\CC_0C0330.DeviceDesc%;USB xHCI Compliant Host Controller(@usbxhci.inf,%PCI\CC_0C0330.DeviceDesc%;USB xHCI Compliant Host Controller)[[0m[1;32mC:\Windows\System32\drivers\USBXHCI.SYS[0m] - System
[1;90m =================================================================================================[0m
VMware Alias Manager and Ticket Service(VMware, Inc. - VMware Alias Manager and Ticket Service)[[0m[1;32m"C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe"[0m] - Autoload
[1;37mAlias Manager and Ticket Service
[1;90m =================================================================================================[0m
@oem7.inf,%VM3DSERVICE_DISPLAYNAME%;VMware SVGA Helper Service(VMware, Inc. - @oem7.inf,%VM3DSERVICE_DISPLAYNAME%;VMware SVGA Helper Service)[[0m[1;32mC:\Windows\system32\vm3dservice.exe[0m] - Autoload
[1;37m@oem7.inf,%VM3DSERVICE_DESCRIPTION%;Helps VMware SVGA driver by collecting and conveying user mode information
[1;90m =================================================================================================[0m
@oem1.inf,%loc.vmciServiceDisplayName%;VMware VMCI Bus Driver(VMware, Inc. - @oem1.inf,%loc.vmciServiceDisplayName%;VMware VMCI Bus Driver)[[0m[1;32mSystem32\drivers\vmci.sys[0m] - Boot
[1;90m =================================================================================================[0m
VMware Host Guest Client Redirector(VMware, Inc. - VMware Host Guest Client Redirector)[[0m[1;32msystem32\DRIVERS\vmhgfs.sys[0m] - System
[1;37mImplements the VMware HGFS protocol. This protocol provides connectivity to host files provided by the HGFS server.
[1;90m =================================================================================================[0m
Memory Control Driver(VMware, Inc. - Memory Control Driver)[[0m[1;32mC:\Windows\system32\DRIVERS\vmmemctl.sys[0m] - Autoload
[1;37mDriver to provide enhanced memory management of this virtual machine.
[1;90m =================================================================================================[0m
@oem6.inf,%VMMouse.SvcDesc%;VMware Pointing Device(VMware, Inc. - @oem6.inf,%VMMouse.SvcDesc%;VMware Pointing Device)[[0m[1;32mC:\Windows\System32\drivers\vmmouse.sys[0m] - System
[1;90m =================================================================================================[0m
VMware Physical Disk Helper(VMware, Inc. - VMware Physical Disk Helper)[[0m[1;32mC:\Windows\system32\DRIVERS\vmrawdsk.sys[0m] - System
[1;37mVMware Physical Disk Helper
[1;90m =================================================================================================[0m
VMware Tools(VMware, Inc. - VMware Tools)[[0m[1;32m"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"[0m] - Autoload
[1;37mProvides support for synchronizing objects between the host and guest operating systems.
[1;90m =================================================================================================[0m
@oem8.inf,%loc.vmxnet3.ndis6.DispName%;vmxnet3 NDIS 6 Ethernet Adapter Driver(Broadcom Inc. - @oem8.inf,%loc.vmxnet3.ndis6.DispName%;vmxnet3 NDIS 6 Ethernet Adapter Driver)[[0m[1;32mC:\Windows\System32\drivers\vmxnet3.sys[0m] - System
[1;90m =================================================================================================[0m
vnetWFP(VMware, Inc. - vnetWFP)[[0m[1;32mC:\Windows\system32\DRIVERS\vnetWFP.sys[0m] - System
[1;37mGuest Introspection Network Filter Driver
[1;90m =================================================================================================[0m
vsepflt(VMware, Inc. - vsepflt)[[0m[1;32msystem32\DRIVERS\vsepflt.sys[0m] - Boot
[1;37mGuest Introspection Driver
[1;90m =================================================================================================[0m
vSockets Virtual Machine Communication Interface Sockets driver(VMware, Inc. - vSockets Virtual Machine Communication Interface Sockets driver)[[0m[1;32msystem32\DRIVERS\vsock.sys[0m] - Boot
[1;37mvSockets Driver
[1;90m =================================================================================================[0m
@vstxraid.inf,%Driver.DeviceDesc%;VIA StorX Storage RAID Controller Windows Driver(VIA Corporation - @vstxraid.inf,%Driver.DeviceDesc%;VIA StorX Storage RAID Controller Windows Driver)[[0m[1;32mSystem32\drivers\vstxraid.sys[0m] - Boot
[1;90m =================================================================================================[0m
@mlx4_bus.inf,%WinMad.ServiceDesc%;WinMad Service(Mellanox - @mlx4_bus.inf,%WinMad.ServiceDesc%;WinMad Service)[[0m[1;32mC:\Windows\System32\drivers\winmad.sys[0m] - System
[1;90m =================================================================================================[0m
@winusb.inf,%WINUSB_SvcName%;WinUsb Driver(@winusb.inf,%WINUSB_SvcName%;WinUsb Driver)[[0m[1;32mC:\Windows\System32\drivers\WinUSB.SYS[0m] - System
[1;37m@winusb.inf,%WINUSB_SvcDesc%;Generic driver for USB devices
[1;90m =================================================================================================[0m
@mlx4_bus.inf,%WinVerbs.ServiceDesc%;WinVerbs Service(Mellanox - @mlx4_bus.inf,%WinVerbs.ServiceDesc%;WinVerbs Service)[[0m[1;32mC:\Windows\System32\drivers\winverbs.sys[0m] - System
[1;90m =================================================================================================[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mModifiable Services[0m [1;36mÈ [1;34mCheck if you can modify any service [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#services[0m [1;32m You cannot modify any service[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking if you can modify any service registry[0m [1;36mÈ [1;34mCheck if you can modify the registry of a service [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#services-registry-modify-permissions[0m [1;32m [-] Looks like you cannot change the registry of any service…[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mChecking write permissions in PATH folders (DLL Hijacking)[0m [1;36mÈ [1;34mCheck for DLL Hijacking in PATH folders [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dll-hijacking[0m [1;32m C:\Windows\system32[0m [1;32m C:\Windows[0m [1;32m C:\Windows\System32\Wbem[0m [1;32m C:\Windows\System32\WindowsPowerShell\v1.0\[0m [1;32m C:\Windows\System32\OpenSSH\[0m
[1;36mÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ͹ [1;32mApplications Information[1;36m ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mCurrent Active Window Application[0m [1;90m [X] Exception: Object reference not set to an instance of an object.[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mInstalled Applications —Via Program Files/Uninstall registry—[0m [1;36mÈ [1;34mCheck if you can modify installed software [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#applications[0m [1;32m C:\Program Files\Common Files[0m [1;32m C:\Program Files\desktop.ini[0m [1;32m C:\Program Files\Internet Explorer[0m [1;32m C:\Program Files\Microsoft[0m [1;32m C:\Program Files\Microsoft Update Health Tools[0m [1;32m C:\Program Files\ModifiableWindowsApps[0m [1;32m C:\Program Files\Uninstall Information[0m [1;32m C:\Program Files\VMware[0m [1;32m C:\Program Files\Windows Defender[0m [1;32m C:\Program Files\Windows Defender Advanced Threat Protection[0m [1;32m C:\Program Files\Windows Mail[0m [1;32m C:\Program Files\Windows Media Player[0m [1;32m C:\Program Files\Windows NT[0m [1;32m C:\Program Files\Windows Photo Viewer[0m [1;32m C:\Program Files\Windows Sidebar[0m [1;32m C:\Program Files\WindowsApps[0m [1;32m C:\Program Files\WindowsPowerShell[0m [1;32m C:\Windows\System32[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mAutorun Applications[0m [1;36mÈ [1;34mCheck if you can modify other users AutoRuns binaries (Note that is normal that you can modify HKCU registry and binaries indicated there) [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html[0m [1;90mError getting autoruns from WMIC: System.Management.ManagementException: Access denied at System.Management.ThreadDispatch.Start() at System.Management.ManagementScope.Initialize() at System.Management.ManagementObjectSearcher.Initialize() at System.Management.ManagementObjectSearcher.Get() at h9.b()[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows\CurrentVersion\Run[0m
Key: VMware User Process
Folder: [0m[1;32mC:\Program Files\VMware\VMware Tools[0m
File: [0m[1;32mC:\Program Files\VMware\VMware Tools[0m\vmtoolsd.exe -n vmusr ([0m[1;31mUnquoted and Space detected[0m) - C:\
[1;90m =================================================================================================[0m
RegPath: [0m[1;31mHKCU\Software\Microsoft\Windows\CurrentVersion\Run[0m
[0m[1;31mRegPerms: r.andrews [Allow: FullControl][0m
Key: OneDriveSetup
Folder: [0m[1;32mC:\Windows\System32[0m
File: [0m[1;32mC:\Windows\System32[0m\OneDriveSetup.exe /thfirstsetup
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders[0m
Key: Common Startup
Folder: [0m[1;32mC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders[0m
Key: Common Startup
Folder: [0m[1;32mC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon[0m
Key: Userinit
Folder: [0m[1;32mC:\Windows\system32[0m
File: [0m[1;32mC:\Windows\system32[0m\userinit.exe,
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon[0m
Key: Shell
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mexplorer.exe[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\SYSTEM\CurrentControlSet\Control\SafeBoot[0m
Key: AlternateShell
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mcmd.exe[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Font Drivers[0m
Key: Adobe Type Manager
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32matmfd.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Font Drivers[0m
Key: Adobe Type Manager
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32matmfd.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: aux
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mwdmaud.drv[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: midi
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mwdmaud.drv[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: midimapper
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmidimap.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: mixer
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mwdmaud.drv[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: msacm.imaadpcm
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mimaadp32.acm[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: msacm.msadpcm
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsadp32.acm[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: msacm.msg711
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsg711.acm[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: msacm.msgsm610
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsgsm32.acm[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.i420
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32miyuv_32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.iyuv
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32miyuv_32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.mrle
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsrle32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.msvc
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsvidc32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.uyvy
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsyuv.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.yuy2
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsyuv.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.yvu9
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mtsbyuv.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.yvyu
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsyuv.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: wave
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mwdmaud.drv[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: wavemapper
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsacm32.drv[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: msacm.l3acm
Folder: [0m[1;32mC:\Windows\System32[0m
File: [0m[1;32mC:\Windows\System32[0m\l3codeca.acm
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: aux
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mwdmaud.drv[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: midi
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mwdmaud.drv[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: midimapper
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmidimap.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: mixer
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mwdmaud.drv[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: msacm.imaadpcm
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mimaadp32.acm[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: msacm.msadpcm
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsadp32.acm[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: msacm.msg711
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsg711.acm[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: msacm.msgsm610
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsgsm32.acm[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.cvid
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32miccvid.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.i420
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32miyuv_32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.iyuv
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32miyuv_32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.mrle
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsrle32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.msvc
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsvidc32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.uyvy
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsyuv.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.yuy2
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsyuv.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.yvu9
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mtsbyuv.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: vidc.yvyu
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsyuv.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: wave
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mwdmaud.drv[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: wavemapper
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mmsacm32.drv[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32[0m
Key: msacm.l3acm
Folder: [0m[1;32mC:\Windows\SysWOW64[0m
File: [0m[1;32mC:\Windows\SysWOW64[0m\l3codeca.acm
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Classes\htmlfile\shell\open\command[0m
Folder: [0m[1;32mC:\Program Files\Internet Explorer[0m
File: [0m[1;32mC:\Program Files\Internet Explorer[0m\iexplore.exe %1 ([0m[1;31mUnquoted and Space detected[0m) - C:\
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: *kernel32
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mkernel32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: _wow64cpu
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mwow64cpu.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: _wowarmhw
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mwowarmhw.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: _xtajit
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mxtajit.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: advapi32
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32madvapi32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: clbcatq
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mclbcatq.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: combase
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mcombase.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: COMDLG32
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mCOMDLG32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: coml2
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mcoml2.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: DifxApi
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mdifxapi.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: gdi32
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mgdi32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: gdiplus
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mgdiplus.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: IMAGEHLP
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mIMAGEHLP.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: IMM32
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mIMM32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: MSCTF
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mMSCTF.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: MSVCRT
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mMSVCRT.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: NORMALIZ
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mNORMALIZ.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: NSI
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mNSI.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: ole32
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mole32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: OLEAUT32
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mOLEAUT32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: PSAPI
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mPSAPI.DLL[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: rpcrt4
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mrpcrt4.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: sechost
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32msechost.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: Setupapi
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mSetupapi.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: SHCORE
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mSHCORE.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: SHELL32
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mSHELL32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: SHLWAPI
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mSHLWAPI.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: user32
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32muser32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: WLDAP32
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mWLDAP32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: wow64
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mwow64.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: wow64base
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mwow64base.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: wow64con
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mwow64con.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: wow64win
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mwow64win.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: WS2_32
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mWS2_32.dll[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls[0m
Key: xtajit64
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mxtajit64.dll[0m
[1;90m =================================================================================================[0m
RegPath: HKLM[0m[1;31m[0m[1;31m[0m[1;31m[0m[1;31m[0m[1;31m\[0m[0m[0m[0m[0mSoftware[0m[1;31m[0m[1;31m[0m[1;31m[0m[1;31m[0m[1;31m\[0m[0m[0m[0m[0mMicrosoft[0m[1;31m[0m[1;31m[0m[1;31m[0m[1;31m[0m[1;31m\[0m[0m[0m[0m[0mActive Setup[0m[1;31m[0m[1;31m[0m[1;31m[0m[1;31m[0m[1;31m\[0m[0m[0m[0m[0mInstalled Components[0m[1;31m[0m[1;31m[0m[1;31m[0m[1;31m[0m[1;31m\[0m[0m[0m[0m[0m{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
Key: StubPath
Folder: [0m[1;31m\[0m
[0m[1;31mFolderPerms: Authenticated Users [Allow: AppendData/CreateDirectories][0m
File: [0m[1;32m/UserInstall[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}[0m
Key: StubPath
Folder: [0m[1;32mC:\Windows\system32[0m
File: [0m[1;32mC:\Windows\system32[0m\unregmp2.exe /FirstLogon
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}[0m
Key: StubPath
Folder: None ([0m[1;31mPATH Injection[0m)
File: [0m[1;32mU[0m
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}[0m
Key: StubPath
Folder: [0m[1;32mC:\Windows\System32[0m
File: [0m[1;32mC:\Windows\System32[0m\ie4uinit.exe -UserConfig
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}[0m
Key: StubPath
Folder: [0m[1;32mC:\Windows\System32[0m
File: [0m[1;32m[0m[1;32mC:\Windows\System32[0m[0m\Rundll32.exe [0m[1;32m[0m[1;32mC:\Windows\System32[0m[0m\mscories.dll,Install
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}[0m
Key: StubPath
Folder: [0m[1;32mC:\Program Files (x86)\Microsoft\Edge\Application\100.0.1185.36\Installer[0m
File: [0m[1;32mC:\Program Files (x86)\Microsoft\Edge\Application\100.0.1185.36\Installer[0m\setup.exe --configure-user-settings --verbose-logging --system-level --msedge ([0m[1;31mUnquoted and Space detected[0m) - C:\
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}[0m
Key: StubPath
Folder: [0m[1;32mC:\Windows\system32[0m
File: [0m[1;32mC:\Windows\system32[0m\unregmp2.exe /FirstLogon
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}[0m
Key: StubPath
Folder: [0m[1;32mC:\Windows\SysWOW64[0m
File: [0m[1;32m[0m[1;32mC:\Windows\SysWOW64[0m[0m\Rundll32.exe [0m[1;32m[0m[1;32mC:\Windows\SysWOW64[0m[0m\mscories.dll,Install
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}[0m
Folder: [0m[1;32mC:\Program Files (x86)\Microsoft\Edge\Application\100.0.1185.36\BHO[0m
File: [0m[1;32mC:\Program Files (x86)\Microsoft\Edge\Application\100.0.1185.36\BHO[0m\ie_to_edge_bho_64.dll ([0m[1;31mUnquoted and Space detected[0m) - C:\
[1;90m =================================================================================================[0m
RegPath: [0m[1;32mHKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}[0m
Folder: [0m[1;32mC:\Program Files (x86)\Microsoft\Edge\Application\100.0.1185.36\BHO[0m
File: [0m[1;32mC:\Program Files (x86)\Microsoft\Edge\Application\100.0.1185.36\BHO[0m\ie_to_edge_bho_64.dll ([0m[1;31mUnquoted and Space detected[0m) - C:\
[1;90m =================================================================================================[0m
Folder: [0m[1;32mC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup[0m
File: [0m[1;32mC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup[0m\desktop.ini
[0m[1;31mPotentially sensitive file content:[0m LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787
[1;90m =================================================================================================[0m
Folder: [0m[1;31mC:\windows\tasks[0m
[0m[1;31mFolderPerms: Authenticated Users [Allow: WriteData/CreateFiles][0m
[1;90m =================================================================================================[0m
Folder: [0m[1;31mC:\windows\system32\tasks[0m
[0m[1;31mFolderPerms: Authenticated Users [Allow: WriteData/CreateFiles][0m
[1;90m =================================================================================================[0m
Folder: [0m[1;32mC:\windows[0m
File: [0m[1;32mC:\windows[0m\system.ini
[1;90m =================================================================================================[0m
Folder: [0m[1;32mC:\windows[0m
File: [0m[1;32mC:\windows[0m\win.ini
[1;90m =================================================================================================[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mScheduled Applications —Non Microsoft—[0m [1;36mÈ [1;34mCheck if you can modify other users scheduled binaries [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mDevice Drivers —Non Microsoft—[0m [1;36mÈ [1;34mCheck 3rd party drivers for known vulnerabilities/rootkits. [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#drivers[0m NVIDIA nForce(TM) RAID Driver - 10.6.0.23 [NVIDIA Corporation]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\nvraid.sys[0m QLogic 10 GigE - 7.13.65.105 [QLogic Corporation]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\evbd0a.sys[0m QLogic 10 GigE - 7.13.171.102 [Marvell Semiconductor Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\evbda.sys[0m QLogic Gigabit Ethernet - 7.12.31.105 [QLogic Corporation]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\bxvbda.sys[0m VMware vSockets Service - 9.8.19.0 build-18956547 [VMware, Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\system32\DRIVERS\vsock.sys[0m VMware PCI VMCI Bus Device - 9.8.18.0 build-18956547 [VMware, Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\vmci.sys[0m Intel Matrix Storage Manager driver - 8.6.2.1019 [Intel Corporation]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\iaStorV.sys[0m Promiser SuperTrak EX Series - 5.1.0000.10 [Promise Technology, Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\stexstor.sys[0m Boot Camp - 6.1.0.0 [Apple Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\AppleSSD.sys[0m LSI 3ware RAID Controller - WindowsBlue [LSI]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\3ware.sys[0m AHCI 1.3 Device Driver - 1.1.3.277 [Advanced Micro Devices]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\amdsata.sys[0m Storage Filter Driver - 1.1.3.277 [Advanced Micro Devices]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\amdxata.sys[0m AMD Technology AHCI Compatible Controller - 3.7.1540.43 [AMD Technologies Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\amdsbs.sys[0m Adaptec RAID Controller - 7.5.0.32048 [PMC-Sierra, Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\arcsas.sys[0m Windows (R) Win 7 DDK driver - 10.0.10011.16384 [Avago Technologies]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\ItSas35i.sys[0m LSI Fusion-MPT SAS Driver (StorPort) - 1.34.03.83 [LSI Corporation]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\lsi_sas.sys[0m Windows (R) Win 7 DDK driver - 10.0.10011.16384 [LSI Corporation]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\lsi_sas2i.sys[0m Windows (R) Win 7 DDK driver - 10.0.10011.16384 [Avago Technologies]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\lsi_sas3i.sys[0m MEGASAS2i RAID Controller Driver for Windows - 6.714.22.00 [Avago Technologies]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\MegaSas2i.sys[0m MEGASAS RAID Controller Driver for Windows - 7.717.02.00 [Broadcom Inc]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\megasas35i.sys[0m MegaRAID Software RAID - 15.02.2013.0129 [LSI Corporation, Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\megasr.sys[0m Windows (R) Win 7 DDK driver - 10.0.10011.16384 [Broadcom Limited]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\mpi3drvi.sys[0m Marvell Flash Controller - 1.0.5.1016 [Marvell Semiconductor, Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\mvumis.sys[0m NVIDIA nForce(TM) SATA Driver - 10.6.0.23 [NVIDIA Corporation]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\nvstor.sys[0m MEGASAS RAID Controller Driver for Windows - 6.805.03.00 [Avago Technologies]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\percsas2i.sys[0m MEGASAS RAID Controller Driver for Windows - 6.604.06.00 [Avago Technologies]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\percsas3i.sys[0m VMware PVSCSI StorPort driver (64-bit) - 1.3.15.0 build-18052479 [VMware, Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\pvscsii.sys[0m Microsoftr Windowsr Operating System - 2.60.01 [Silicon Integrated Systems Corp.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\SiSRaid2.sys[0m Microsoftr Windowsr Operating System - 6.1.6918.0 [Silicon Integrated Systems]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\sisraid4.sys[0m VIA RAID driver - 7.0.9600,6352 [VIA Technologies Inc.,Ltd]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\vsmraid.sys[0m VIA StorX RAID Controller Driver - 8.0.9200.8110 [VIA Corporation]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\vstxraid.sys[0m Chelsio Communications iSCSI Controller - 10.0.10011.16384 [Chelsio Communications]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\cht4sx64.sys[0m Intel(R) Rapid Storage Technology driver (inbox) - 15.44.0.1015 [Intel Corporation]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\iaStorAVC.sys[0m PMC-Sierra HBA Controller - 1.3.0.10769 [PMC-Sierra]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\ADP80XX.SYS[0m Smart Array SAS/SATA Controller Media Driver - 8.0.4.0 Build 1 Media Driver (x86-64) [Hewlett-Packard Company]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\HpSAMD.sys[0m SmartRAID, SmartHBA PQI Storport Driver - 1.50.1.0 [Microsemi Corportation]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\SmartSAMD.sys[0m VMware Guest Introspection Driver - 12.1.0.0 build-19947491 [VMware, Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\system32\DRIVERS\vsepflt.sys[0m VMware Raw Disk Helper Driver - 1.1.7.0 build-18933738 [VMware, Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\system32\DRIVERS\vmrawdsk.sys[0m VMware Guest Introspection WFP Network Filter Driver - 12.1.0.0 build-19947491 [VMware, Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\system32\DRIVERS\vnetWFP.sys[0m VMware Pointing PS/2 Device Driver - 12.5.12.0 build-18967789 [VMware, Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\vmmouse.sys[0m VMware SVGA 3D - 9.17.04.0001 - build-20112898 [VMware, Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\system32\DRIVERS\vm3dmp_loader.sys[0m VMware SVGA 3D - 9.17.04.0001 - build-20112898 [VMware, Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\system32\DRIVERS\vm3dmp.sys[0m VMware server memory controller - 7.5.7.0 build-18933738 [VMware, Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\system32\DRIVERS\vmmemctl.sys[0m VMware PCIe Ethernet Adapter NDIS 6.85 (64-bit) - 1.9.19.0 build-24153797 [Broadcom Inc.]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\vmxnet3.sys[0m Intel(R) Gigabit Adapter - 12.19.1.32 [Intel Corporation]: [0m[1;32m\.\GLOBALROOT\SystemRoot\System32\drivers\e1i68x64.sys[0m
[1;36mÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ͹ [1;32mNetwork Information[1;36m ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mNetwork Shares[0m [1;90m [X] Exception: Access denied [0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEnumerate Network Mapped Drives (WMI)[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mHost File[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mNetwork Ifaces and known hosts[0m [1;36mÈ [1;34mThe masks are only for the IPv4 addresses [1;33m[0m Ethernet0[00:50:56:8A:FF:9E]: 192.168.107.206 / 255.255.255.0 [1;37mGateways: [0m192.168.107.254 [1;37mKnown hosts:[0m 192.168.107.111 00-50-56-8A-69-BF Dynamic 192.168.107.254 00-50-56-8A-C5-9B Dynamic 192.168.107.255 FF-FF-FF-FF-FF-FF Static 224.0.0.22 01-00-5E-00-00-16 Static 224.0.0.251 01-00-5E-00-00-FB Static 239.255.255.250 01-00-5E-7F-FF-FA Static
Ethernet1[00:50:56:8A:9D:FF]: 172.16.107.206 / 255.255.255.0
[1;37mDNSs: [0m172.16.107.200
[1;37mKnown hosts:[0m
172.16.107.200 00-50-56-8A-59-3E Dynamic
172.16.107.255 FF-FF-FF-FF-FF-FF Static
224.0.0.22 01-00-5E-00-00-16 Static
224.0.0.251 01-00-5E-00-00-FB Static
224.0.0.252 01-00-5E-00-00-FC Static
239.255.255.250 01-00-5E-7F-FF-FA Static
Loopback Pseudo-Interface 1[]: 127.0.0.1, ::1 / 255.0.0.0
[1;37mDNSs: [0mfec0:0:0:ffff::1%1, fec0:0:0:ffff::2%1, fec0:0:0:ffff::3%1
[1;37mKnown hosts:[0m
224.0.0.22 00-00-00-00-00-00 Static
239.255.255.250 00-00-00-00-00-00 Static
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mCurrent TCP Listening Ports[0m [1;36mÈ [1;34mCheck for services restricted from the outside [1;33m[0m [1;34m Enumerating IPv4 connections [0m Protocol Local Address Local Port Remote Address Remote Port State Process ID Process Name
TCP 0.0.0.0 135 0.0.0.0 0 Listening 1004 svchost TCP 0.0.0.0 445 0.0.0.0 0 Listening 4 System TCP 0.0.0.0 3389 0.0.0.0 0 Listening 1060 svchost TCP 0.0.0.0 5040 0.0.0.0 0 Listening 5560 svchost TCP 0.0.0.0 5985 0.0.0.0 0 Listening 4 System TCP 0.0.0.0 47001 0.0.0.0 0 Listening 4 System TCP 0.0.0.0 49664 0.0.0.0 0 Listening 748 lsass TCP 0.0.0.0 49665 0.0.0.0 0 Listening 608 wininit TCP 0.0.0.0 49666 0.0.0.0 0 Listening 1448 svchost TCP 0.0.0.0 49667 0.0.0.0 0 Listening 2032 svchost TCP 0.0.0.0 49668 0.0.0.0 0 Listening 2276 svchost TCP 0.0.0.0 49669 0.0.0.0 0 Listening 748 lsass TCP 0.0.0.0 49670 0.0.0.0 0 Listening 716 services TCP 172.16.107.206 139 0.0.0.0 0 Listening 4 System [0m[0m [1;34m Enumerating IPv6 connections [0m Protocol Local Address Local Port Remote Address Remote Port State Process ID Process Name
TCP [0m[1;31m[0m[1;31m[::][0m[0m 135 [0m[1;31m[0m[1;31m[::][0m[0m 0 Listening 1004 svchost TCP [0m[1;31m[0m[1;31m[::][0m[0m 445 [0m[1;31m[0m[1;31m[::][0m[0m 0 Listening 4 System TCP [0m[1;31m[0m[1;31m[::][0m[0m 3389 [0m[1;31m[0m[1;31m[::][0m[0m 0 Listening 1060 svchost TCP [0m[1;31m[0m[1;31m[::][0m[0m 5985 [0m[1;31m[0m[1;31m[::][0m[0m 0 Listening 4 System TCP [0m[1;31m[0m[1;31m[::][0m[0m 47001 [0m[1;31m[0m[1;31m[::][0m[0m 0 Listening 4 System TCP [0m[1;31m[0m[1;31m[::][0m[0m 49664 [0m[1;31m[0m[1;31m[::][0m[0m 0 Listening 748 lsass TCP [0m[1;31m[0m[1;31m[::][0m[0m 49665 [0m[1;31m[0m[1;31m[::][0m[0m 0 Listening 608 wininit TCP [0m[1;31m[0m[1;31m[::][0m[0m 49666 [0m[1;31m[0m[1;31m[::][0m[0m 0 Listening 1448 svchost TCP [0m[1;31m[0m[1;31m[::][0m[0m 49667 [0m[1;31m[0m[1;31m[::][0m[0m 0 Listening 2032 svchost TCP [0m[1;31m[0m[1;31m[::][0m[0m 49668 [0m[1;31m[0m[1;31m[::][0m[0m 0 Listening 2276 svchost TCP [0m[1;31m[0m[1;31m[::][0m[0m 49669 [0m[1;31m[0m[1;31m[::][0m[0m 0 Listening 748 lsass TCP [0m[1;31m[0m[1;31m[::][0m[0m 49670 [0m[1;31m[0m[1;31m[::][0m[0m 0 Listening 716 services
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mCurrent UDP Listening Ports[0m [1;36mÈ [1;34mCheck for services restricted from the outside [1;33m[0m [1;34m Enumerating IPv4 connections [0m Protocol Local Address Local Port Remote Address:Remote Port Process ID Process Name
UDP 0.0.0.0 123 : 1324 svchost UDP 0.0.0.0 500 : 3100 svchost UDP 0.0.0.0 3389 : 1060 svchost UDP 0.0.0.0 4500 : 3100 svchost UDP 0.0.0.0 5050 : 5560 svchost UDP 0.0.0.0 5353 : 1816 svchost UDP 0.0.0.0 5355 : 1816 svchost UDP [0m[1;31m127.0.0.1[0m 1900 : 3204 svchost UDP [0m[1;31m127.0.0.1[0m 51461 : 3204 svchost UDP [0m[1;31m127.0.0.1[0m 52780 : 748 lsass UDP [0m[1;31m127.0.0.1[0m 61144 : 1600 svchost UDP [0m[1;31m127.0.0.1[0m 61692 : 7108 C:\Users\r.andrews\Documents\winpeas.exe UDP [0m[1;31m127.0.0.1[0m 62196 : 2940 svchost UDP 172.16.107.206 137 : 4 System UDP 172.16.107.206 138 : 4 System UDP 172.16.107.206 1900 : 3204 svchost UDP 172.16.107.206 51460 : 3204 svchost UDP 192.168.107.206 137 : 4 System UDP 192.168.107.206 138 : 4 System UDP 192.168.107.206 1900 : 3204 svchost UDP 192.168.107.206 51459 : 3204 svchost [0m[0m [1;34m Enumerating IPv6 connections [0m Protocol Local Address Local Port Remote Address:Remote Port Process ID Process Name
UDP [0m[1;31m[::][0m 123 : 1324 svchost UDP [0m[1;31m[::][0m 500 : 3100 svchost UDP [0m[1;31m[::][0m 3389 : 1060 svchost UDP [0m[1;31m[::][0m 4500 : 3100 svchost UDP [0m[1;31m[::1][0m 1900 : 3204 svchost UDP [0m[1;31m[::1][0m 51458 : 3204 svchost
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mFirewall Rules[0m [1;36mÈ [1;34mShowing only DENY rules (too many ALLOW rules always) [1;33m[0m Current Profiles: DOMAIN, PUBLIC FirewallEnabled (Domain): [0m[1;32mTrue[0m FirewallEnabled (Private): [0m[1;32mTrue[0m FirewallEnabled (Public): [0m[1;32mTrue[0m [1;90m DENY rules:[0m [1;90m [X] Exception: Object reference not set to an instance of an object.[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mDNS cached —limit 70—[0m [1;90m Entry Name Data[0m [1;90m [X] Exception: Access denied [0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEnumerating Internet settings, zone and proxy configuration[0m [1;34m General Settings[0m Hive Key Value HKCU CertificateRevocation 1 HKCU DisableCachingOfSSLPages 0 HKCU IE5_UA_Backup_Flag 5.0 HKCU PrivacyAdvanced 1 HKCU SecureProtocols 10240 HKCU User Agent Mozilla/5.0 (compatible; MSIE 9.0; Win32) HKLM ActiveXCache C:\Windows\Downloaded Program Files HKLM CodeBaseSearchPath CODEBASE HKLM EnablePunycode 1 HKLM MinorVersion 0 HKLM WarnOnIntranet 1 [1;34m Zone Maps[0m No URLs configured [1;34m Zone Auth Settings[0m No Zone Auth Settings
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mInternet Connectivity[0m [1;36mÈ [1;34mChecking if internet access is possible via different methods [1;33m[0m HTTP (80) Access: Not [0m[1;32mAccessible[0m [1;90m [X] Exception: Error: A task was canceled.[0m HTTPS (443) Access: Not [0m[1;32mAccessible[0m [1;90m [X] Exception: Error: TCP connect timed out[0m HTTPS (443) Access by Domain Name: Not [0m[1;32mAccessible[0m [1;90m [X] Exception: Error: A task was canceled.[0m DNS (53) Access: Not [0m[1;32mAccessible[0m [1;90m [X] Exception: Error: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond[0m ICMP (ping) Access: Not [0m[1;32mAccessible[0m [1;90m [X] Exception: Error: Ping failed: TimedOut[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mHostname Resolution[0m [1;36mÈ [1;34mChecking if the hostname can be resolved externally [1;33m[0m [1;90m [X] Exception: Error during hostname check: An error occurred while sending the request.[0m
[1;36mÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ͹ [1;32mActive Directory Quick Checks[1;36m ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mgMSA readable managed passwords[0m [1;36mÈ [1;34mLook for Group Managed Service Accounts you can read (msDS-ManagedPassword) [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/gmsa.html[0m [1;90m [X] Exception: An operations error occurred. [0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mAD CS misconfigurations for ESC[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/ad-certificates.html[0m [1;36mÈ [1;34mCheck for ADCS misconfigurations in the local DC registry[0m [1;90m [-] Host is not a domain controller. Skipping ADCS Registry check[0m [1;36mÈ [1;34m If you can modify a template (WriteDacl/WriteOwner/GenericAll), you can abuse ESC4[0m [1;90m [X] Exception: An operations error occurred. [0m
[1;36mÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ͹ [1;32mCloud Information[1;36m ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ[0m
Learn and practice cloud hacking in [0m[1;32mtraining.hacktricks.xyz[0m
AWS EC2? No
Azure VM? No
Azure Tokens? No
Google Cloud Platform? No
Google Workspace Joined? No
Google Cloud Directory Sync? No
Google Password Sync? No
[1;36mÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ͹ [1;32mWindows Credentials[1;36m ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mChecking Windows Vault[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#credentials-manager—windows-vault[0m [ERROR] Unable to enumerate vaults. Error (0x-2146892987) [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mChecking Credential manager[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#credentials-manager—windows-vault[0m [!] [0m[33mWarning:[0m if password contains non-printable characters, it will be printed as unicode base64 encoded string
[!] Unable to enumerate credentials automatically, error: ‘Win32Exception: System.ComponentModel.Win32Exception (0x80004005): A specified logon session does not exist. It may already have been terminated’ Please run: [33mcmdkey /list[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mSaved RDP connections[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mRemote Desktop Server/Client Settings[0m
[1;34m RDP Server Settings[0m
Network Level Authentication :
Block Clipboard Redirection :
Block COM Port Redirection :
Block Drive Redirection :
Block LPT Port Redirection :
Block PnP Device Redirection :
Block Printer Redirection :
Allow Smart Card Redirection :
[1;34m
RDP Client Settings[0m
Disable Password Saving : True
Restricted Remote Administration : False
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mRecently run commands[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mChecking for DPAPI Master Keys[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dpapi[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mChecking for DPAPI Credential Files[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dpapi[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mChecking for RDCMan Settings Files[0m [1;36mÈ [1;34mDump credentials from Remote Desktop Connection Manager [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#remote-desktop-credential-manager[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking for Kerberos tickets[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/network-services-pentesting/pentesting-kerberos-88/index.html[0m [1;37m serverName: [0mws26$ [1;37m RealmName: [0m [1;37m StartTime: [0m2/28/2026 8:29:41 AM [1;37m EndTime: [0m2/28/2026 8:44:41 AM [1;37m RenewTime: [0m3/7/2026 8:06:38 AM [1;37m EncryptionType: [0maes256_cts_hmac_sha1_96 [1;37m TicketFlags: [0mname_canonicalize, pre_authent, renewable, forwardable [1;90m =================================================================================================[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking for saved Wifi credentials[0m [1;90m [X] Exception: The service has not been started[0m Enumerating WLAN using wlanapi.dll failed, trying to enumerate using ‘netsh’ No saved Wifi credentials found
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking AppCmd.exe[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#appcmdexe[0m [1;90m Not Found[0m You must be an administrator to run this check
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking SSClient.exe[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#scclient—sccm[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEnumerating SSCM - System Center Configuration Manager settings[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEnumerating Security Packages Credentials[0m [1;90m [X] Exception: Couldn’t parse nt_resp. Len: 0 Message bytes: 4e544c4d5353500003000000010001006000000000000000610000000000000058000000000000005800000008000800580000000000000061000000058a80a20a005d580000000fe613729a2eb09a10c8b9975c6cfe7d7d570053003200360000[0m
[1;36mÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ͹ [1;32mBrowsers Information[1;36m ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mShowing saved credentials for Firefox[0m [33m Info: if no credentials were listed, you might need to close the browser and try again.[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking for Firefox DBs[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking for GET credentials in Firefox history[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mShowing saved credentials for Chrome[0m [33m Info: if no credentials were listed, you might need to close the browser and try again.[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking for Chrome DBs[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking for GET credentials in Chrome history[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mChrome bookmarks[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mShowing saved credentials for Opera[0m [33m Info: if no credentials were listed, you might need to close the browser and try again.[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mShowing saved credentials for Brave Browser[0m [33m Info: if no credentials were listed, you might need to close the browser and try again.[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mShowing saved credentials for Internet Explorer (unsupported)[0m [33m Info: if no credentials were listed, you might need to close the browser and try again.[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mCurrent IE tabs[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history[0m [1;90m [X] Exception: System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. -⇒ System.Runtime.InteropServices.COMException: The server process could not be started because the configured identity is incorrect. Check the username and password.
--- End of inner exception stack trace --- at System.RuntimeType.InvokeDispMethod(String name, BindingFlags invokeAttr, Object target, Object[] args, Boolean[] byrefModifiers, Int32 culture, String[] namedParameters) at System.RuntimeType.InvokeMember(String name, BindingFlags bindingFlags, Binder binder, Object target, Object[] providedArgs, ParameterModifier[] modifiers, CultureInfo culture, String[] namedParams) at fm.l()[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking for GET credentials in IE history[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mIE history — limit 50 [0m http://go.microsoft.com/fwlink/p/?LinkId=255141
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mIE favorites[0m [1;90m Not Found[0m
[1;36mÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ͹ [1;32mInteresting files and registry[1;36m ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mPutty Sessions[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mPutty SSH Host keys[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mSSH keys in registry[0m [1;36mÈ [1;34mIf you find anything here, follow the link to learn how to decrypt the SSH keys [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#ssh-keys-in-registry[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mSuperPutty configuration files[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEnumerating Office 365 endpoints synced by OneDrive. [0m SID: S-1-5-19 [1;90m =================================================================================================[0m
SID: S-1-5-20
[1;90m =================================================================================================[0m
SID: S-1-5-21-2481101513-2954867870-2660283483-1106
[1;90m =================================================================================================[0m
SID: S-1-5-18
[1;90m =================================================================================================[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mCloud Credentials[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mUnattend Files[0m
[1;31m C:\Windows\Panther\Unattend.xml[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking for common SAM & SYSTEM backups[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking for McAfee Sitelist.xml Files[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mCached GPP Passwords[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking for possible regs with creds[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#inside-the-registry[0m [1;90m Not Found[0m [1;90m Not Found[0m [1;90m Not Found[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking for possible password files in users homes[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials[0m C:\Users\All Users\Microsoft\UEV\InboxTemplates\Roaming[0m[1;31mCredential[0mSettings.xml
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mSearching for Oracle SQL Developer config files [0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mSlack files & directories[0m [33m note: check manually if something is found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking for LOL Binaries and Scripts (can be slow)[0m [1;36mÈ [1;34m [1;33mhttps://lolbas-project.github.io/[0m [33m [!] Check skipped, if you want to run it, please specify ‘-lolbas’ argument[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEnumerating Outlook download files [0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mEnumerating machine and user certificate files [0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mSearching known files that can contain creds in home[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking for documents —limit 100—[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mOffice Most Recent Files — limit 50 [0m [1;34m Last Access Date User Application Document[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mRecent files —limit 70—[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking inside the Recycle Bin for creds files[0m [1;36mÈ [1;34m [1;33mhttps://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials[0m [1;90m Not Found[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mSearching hidden files or folders in C:\Users home (can be slow) [0m [1;31m C:\Users\Default[0m [1;31m C:\Users\Default User[0m [1;31m C:\Users\Default[0m [1;31m C:\Users\All Users[0m [1;31m C:\Users\All Users[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mSearching interesting files in other users home directories (can be slow) [0m [1;90m [X] Exception: Object reference not set to an instance of an object.[0m
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mSearching executable files in non-default folders with write (equivalent) permissions (can be slow)[0m File Permissions “C:\Users\r.andrews\Documents\winpeas.exe”: r.andrews [Allow: AllAccess]
[1;36mÉÍÍÍÍÍÍÍÍÍ͹ [1;32mLooking for Linux shells/distributions - wsl.exe, bash.exe[0m
[1;31m C:\Windows\System32\wsl.exe[0m
[1;31m[0m
[1;32m WSL - no installed Linux distributions found.[0m
[1;32m
/---------------------------------------------------------------------------------
| [34mDo you like PEASS?[1;32m |
|---------------------------------------------------------------------------------|
| [33mLearn Cloud Hacking[1;32m : [1;31mtraining.hacktricks.xyz [1;32m |
| [33mFollow on Twitter[1;32m : [1;31m@hacktricks_live[1;32m |
| [33mRespect on HTB[1;32m : [1;31mSirBroccoli [1;32m |
|---------------------------------------------------------------------------------|
| [34mThank you![1;32m |
---------------------------------------------------------------------------------/
[0m