Overview
Syllabus
Intro
Encyclopedia of Windows Privilege Escalation
Old Skewl Local Exploits
Look For Creds On The Box
Unattended Installs - Client
Unattended Installs - Server
User Permissions
AlwaysInstallElevated
Missing Autoruns
Service Quoting - CVE-2000-1128
Service Quoting (Manual)
DLL Loading or Bad permissions
Pentest Monkey Script to Check
MSF getsystem
Binary Replacement
Debugging CMD.exe
Passwords - best persistence method
Passwords through process dumping
Rename on next reboot
Exporting Wireless Configs
BITSADMIN Downloader/Exec
Password Filters (requires reboot)
Password Filters hooking, no reboot
Command Line PPTP Tunnel
Just uninstall a patch
LNK (Shortcuts) with UNC icons
Auth and Persistence
Stealing SSL Cookies
DEP Exclusions