You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This script aims to identify __Local Privilege Escalation__ (LPE) vulnerabilities that are usually due to Windows configuration issues, or bad practices. It can also gather useful information for some exploitation and post-exploitation tasks.
3
+
Quickly identify common Windows **vulnerabilities** and **configuration issues**that are not necessarily covered by public security standards, and collect useful information for exploitation and post-exploitation tasks.
4
4
5
-
## Getting started
5
+
:information_source: Although this tool is primarily intended for pentesters, it can (and should) also be used by defenders to identify weaknesses on Windows endpoints.
6
6
7
-
After downloading the [script](https://raw.githubusercontent.com/itm4n/PrivescCheck/master/PrivescCheck.ps1) and copying it onto the target Windows machine, run it using one of the commands below.
7
+
## :rocket: Quick Start
8
8
9
-
> [!NOTE]
10
-
> You __don't__ need to clone the entire repository. The file `PrivescCheck.ps1` is a standalone PowerShell script that contains all the code required by `PrivescCheck` to run.
9
+
> :warning: The script **IS NO LONGER** available in the repository, check out the [latest release](https://github.com/itm4n/PrivescCheck/releases/latest/) instead.
11
10
12
-
> [!IMPORTANT]
13
-
> In the commands below, the first `.` (dot) is used for "dot sourcing" the script, so that the functions and cmdlets can be used in the __current scope__ (see PowerShell [dot sourcing feature](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_scripts#script-scope-and-dot-sourcing)).
11
+
Download the script here: [PrivescCheck.ps1](https://github.com/itm4n/PrivescCheck/releases/latest/download/PrivescCheck.ps1)
14
12
15
-
### Basic checks only
13
+
> :information_source: The link above can also be used directly in a PowerShell terminal with `(New-Object Net.WebClient).DownloadString(...)`.
16
14
17
-
Quickly identify important issues, such as local privilege escalation vulnerabilities.
15
+
Below are 3 typical use cases for the tool, but of course you can "mix and match" the options as you wish.
16
+
17
+
### Use Case 1 (Pentest): Run Basic Checks Only
18
+
19
+
:dart:**Objective:** I want to know if there is any obvious way I can escalate my privileges.
### Use Case 2 (Research): Run Extended Checks + Write Human-Readable Reports
24
26
25
-
Identify important issues, but also gather additional information, and save the results to report files that are easy to read.
27
+
:dart:**Objective**: There is no obvious vulnerability, but I want to dig a little further (and potentially find an 0-day in some third-party software for instance).
### Use Case 3 (Audit): Run All Checks + Write All Reports
32
34
33
-
Perform extended and audit checks, and save the results to human-readable reports, but also machine-readable files, which can later be parsed for automated report generation.
35
+
:dart:**Objective**: I want to further scan the machine in case there are configuration issues that are not covered by common security standards, and optionally feed the results into an automated reporting tool.
Include all "extended" checks in the scan (see README).
49
+
50
+
-Audit
51
+
Include all "audit" checks in the scan.
52
+
53
+
-Experimental
54
+
Include all "experimental" checks in the scan. Use only if you know
55
+
what you are doing.
56
+
57
+
-Report <PREFIX>
58
+
Generate at least one report file. The output filename will be
59
+
"PREFIX.txt" by default. The extension is automatically appended
60
+
based on the report format (see "-Format <FORMAT>[,...]").
61
+
62
+
-Format <FORMAT>[,...]
63
+
Specify the format of the output report file(s). If not set, the
64
+
default value is "TXT". Supported formats are: "TXT", "HTML", "CSV",
65
+
and "XML".
66
+
67
+
-Risky
68
+
Include checks marked as "risky", i.e. checks that are likely to
69
+
trigger a blocking action by an endpoint protection solution. Use with
70
+
caution.
71
+
72
+
-Silent
73
+
Suppress terminal output. This can be useful if you want to run the
74
+
script as part of a batch file, in a scheduled task for instance.
75
+
76
+
-Force
77
+
Force execution and ignore warnings. Typically, the script stops if
78
+
it is executed with administrator privileges. Use this option to
79
+
execute it anyway.
80
+
```
81
+
82
+
### Report Format > TXT (`-Format TXT`)
40
83
41
-
All the checks implemented in PrivescCheck have a __Type__. This value, and the flags specified on the command line, will determine if they are run, or not.
84
+
Use the option `-Report <PREFIX>` (with `-Format TXT`) to specify that you want to generate a **raw text report**. The output is similar to what you would see in the terminal, except that it contains only ASCII characters for better (retro-)compatibility will all text editors.
42
85
43
-
### Base
86
+
87
+
88
+
### Report Format > HTML (`-Format HTML`)
89
+
90
+
Use the option `-Report <PREFIX>` with `-Format HTML` to specify that you want to generate an **HTML report**. The output file can be opened in a web browser. It is more convenient for visualizing the data than the raw text report. Additionally, it offers **sorting** and **filtering** capabilities!
91
+
92
+
93
+
94
+
### Report Format > CSV (`-Format CSV`) & XML (`-Format XML`)
95
+
96
+
Use the option `-Report <PREFIX>` with `-Format CSV` or `-Format XML` to specify that you want to generate a **CSV or XML report**. The output file is intended to facilitate the parsing of the results by automated reporting tools.
97
+
98
+
:information_source: Although the output format is not documented (yet), you can easily figure it out by analyzing the structure of an already generated file. You can use the `Id` value of each check to uniquely identify them.
99
+
100
+
### Check Type > Base
44
101
45
102
Checks of type `Base` will always be executed, unless the script is run as an administrator. They are mainly intended for identifying privilege escalation vulnerabilities, or other important issues.
46
103
47
-
### Extended
104
+
### Check Type > Extended (`-Extended`)
48
105
49
106
Checks of type `Extended` can only be executed if the option `-Extended` is specified on the command line. They are mainly intended for providing additional information that could be useful for exploit development, or post-exploitation.
50
107
51
-
### Audit
108
+
### Check Type > Audit (`-Audit`)
52
109
53
110
Checks of type `Audit` can only be executed if the option `-Audit` is specified on the command line. They are mainly intended for providing information that is relevant in the context of a configuration audit.
54
111
55
-
### Experimental
56
-
57
-
Checks of type `Experimental` can only be executed if the option `-Experimental` is specified on the command line. These are unstable checks that need further work. Use them with caution.
58
-
59
-
## Tips and tricks
112
+
## :bulb: Tips & Tricks
60
113
61
-
### PowerShell execution policy
114
+
### PowerShell Execution Policy
62
115
63
-
By default, the PowerShell [execution policy](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies) is set to `Restricted` on clients, and `RemoteSigned` on servers, when a new `powershell.exe` process is started. These policies block the execution of (unsigned) scripts, but they can be overriden within the current scope as follows.
116
+
By default, the PowerShell [execution policy](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies) is set to `Restricted` on clients, and `RemoteSigned` on servers, when a new `powershell.exe` process is started. These policies block the execution of (unsigned) scripts, but they can be overridden within the current scope as follows.
64
117
65
118
```powershell
66
119
Set-ExecutionPolicy Bypass -Scope Process -Force
@@ -73,18 +126,21 @@ However, this trick does not work when the execution policy is enforced through
A common way to bypass [Constrained Language Mode](https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/) consists in starting PowerShell __version 2__ as it does not implement this protection. Therefore, a significant part of the development effort goes into maintaining this compatibility.
131
+
If you see this at the beginning of the script, it just means that the **minimum** PowerShell version required for it to run is PSv2.
132
+
133
+
```powershell
134
+
#Requires -Version 2
135
+
```
79
136
80
-
> [!NOTE]
81
-
> Although PowerShell version 2 is still enabled by default on recent versions of Windows, it cannot run without the .Net framework version 2.0, which requires a manual install.
137
+
A common way to bypass [Constrained Language Mode](https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/) consists in using PSv2 as it does not implement this protection. Therefore, a significant part of the development effort goes into maintaining this retro-compatibility.
82
138
83
-
## Known issues
139
+
> :information_source: Although PowerShell version 2 ~~is still enabled by default on recent versions of Windows~~ ([PowerShell 2.0 removal from Windows](https://support.microsoft.com/en-us/topic/powershell-2-0-removal-from-windows-fe6d1edc-2ed2-4c33-b297-afe82a64200a)), it cannot run without the .Net framework version 2.0, which requires a manual install.
84
140
85
141
### Metasploit timeout
86
142
87
-
If you run this script within a Meterpreter session, you will likely get a "timeout" error. Metasploit has a "response timeout" value, which is set to 15 seconds by default, but this script takes a lot more time to run in most environments.
143
+
If you run this script within a Meterpreter session, you will likely get a "timeout" error. This is because Metasploit uses a default timeout value of 15 seconds, which is not enough for a typical execution of the script to complete.
It is possible to set a different value thanks to the `-t` option of the `sessions` command ([documentation](https://www.offensive-security.com/metasploit-unleashed/msfconsole-commands/)). In the following example, a timeout of 2 minutes is set for the session with ID `1`.
154
+
It is possible to set a different timeout thanks to the `-t` option of the `sessions` command ([documentation](https://www.offensive-security.com/metasploit-unleashed/msfconsole-commands/)). In the following example, a timeout of 2 minutes is set for the session with ID `1`, but you might want to set an even higher value.
0 commit comments