> For the complete documentation index, see [llms.txt](https://hacktricks.xsx.tw/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacktricks.xsx.tw/windows-hardening/checklist-windows-privilege-escalation.md).

# Checklist - Local Windows Privilege Escalation

<details>

<summary><strong>从零开始学习AWS黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS Red Team Expert）</strong></a><strong>！</strong></summary>

支持HackTricks的其他方式：

* 如果您想看到您的**公司在HackTricks中做广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[NFTs](https://opensea.io/collection/the-peass-family)收藏品
* **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或在**Twitter**上关注我们 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。

</details>

**Try Hard Security Group**

<figure><img src="/files/Kw46fTSYxPIOMyKySfL5" alt=""><figcaption></figcaption></figure>

{% embed url="<https://discord.gg/tryhardsecurity>" %}

***

### **查找Windows本地权限提升向量的最佳工具：** [**WinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS)

### [系统信息](/windows-hardening/windows-local-privilege-escalation.md#system-info)

* [ ] 获取[**系统信息**](/windows-hardening/windows-local-privilege-escalation.md#system-info)
* [ ] 使用脚本搜索**内核**[**漏洞**](/windows-hardening/windows-local-privilege-escalation.md#version-exploits)
* [ ] 使用**Google搜索**内核**漏洞**
* [ ] 使用**searchsploit搜索**内核**漏洞**
* [ ] [**环境变量**](/windows-hardening/windows-local-privilege-escalation.md#environment)中有趣的信息？
* [ ] [**PowerShell历史记录**](/windows-hardening/windows-local-privilege-escalation.md#powershell-history)中的密码？
* [ ] [**Internet设置**](/windows-hardening/windows-local-privilege-escalation.md#internet-settings)中有趣的信息？
* [ ] [**驱动器**](/windows-hardening/windows-local-privilege-escalation.md#drives)？
* [ ] [**WSUS漏洞**](/windows-hardening/windows-local-privilege-escalation.md#wsus)？
* [ ] [**AlwaysInstallElevated**](/windows-hardening/windows-local-privilege-escalation.md#alwaysinstallelevated)？

### [日志/AV枚举](/windows-hardening/windows-local-privilege-escalation.md#enumeration)

* [ ] 检查[**审计**](/windows-hardening/windows-local-privilege-escalation.md#audit-settings)和[**WEF**](/windows-hardening/windows-local-privilege-escalation.md#wef)设置
* [ ] 检查[**LAPS**](/windows-hardening/windows-local-privilege-escalation.md#laps)
* [ ] 检查是否激活了[**WDigest**](/windows-hardening/windows-local-privilege-escalation.md#wdigest)
* [ ] [**LSA保护**](/windows-hardening/windows-local-privilege-escalation.md#lsa-protection)？
* [ ] [**凭据保护**](/windows-hardening/windows-local-privilege-escalation.md#credentials-guard)[?](/windows-hardening/windows-local-privilege-escalation.md#cached-credentials)
* [ ] [**缓存凭据**](/windows-hardening/windows-local-privilege-escalation.md#cached-credentials)？
* [ ] 检查是否有任何[**AV**](https://github.com/carlospolop/hacktricks/blob/cn/windows-hardening/windows-av-bypass/README.md)
* [ ] [**AppLocker策略**](https://github.com/carlospolop/hacktricks/blob/cn/windows-hardening/authentication-credentials-uac-and-efs/README.md#applocker-policy)？
* [ ] [**UAC**](https://github.com/carlospolop/hacktricks/blob/cn/windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control/README.md)
* [ ] [**用户权限**](/windows-hardening/windows-local-privilege-escalation.md#users-and-groups)
* [ ] 检查[**当前**用户**权限**](/windows-hardening/windows-local-privilege-escalation.md#users-and-groups)
* [ ] 您是否是任何特权组的[**成员**](/windows-hardening/windows-local-privilege-escalation.md#privileged-groups)？
* [ ] 检查是否启用了以下任何令牌]\(windows-local-privilege-escalation/#token-manipulation)：**SeImpersonatePrivilege, SeAssignPrimaryPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege** ?
* [ ] [**用户会话**](/windows-hardening/windows-local-privilege-escalation.md#logged-users-sessions)？
* [ ] 检查[**用户主目录**](/windows-hardening/windows-local-privilege-escalation.md#home-folders)（访问？）
* [ ] 检查[**密码策略**](/windows-hardening/windows-local-privilege-escalation.md#password-policy)
* [ ] [**剪贴板**](/windows-hardening/windows-local-privilege-escalation.md#get-the-content-of-the-clipboard)中有什么？

### [网络](/windows-hardening/windows-local-privilege-escalation.md#network)

* 检查**当前**[**网络** **信息**](/windows-hardening/windows-local-privilege-escalation.md#network)
* 检查**隐藏的本地服务**是否受限于外部

### [运行进程](/windows-hardening/windows-local-privilege-escalation.md#running-processes)

* 进程二进制文件和文件夹权限[**文件和文件夹权限**](/windows-hardening/windows-local-privilege-escalation.md#file-and-folder-permissions)
* [**内存密码挖掘**](/windows-hardening/windows-local-privilege-escalation.md#memory-password-mining)
* [**不安全的GUI应用程序**](/windows-hardening/windows-local-privilege-escalation.md#insecure-gui-apps)
* 通过`ProcDump.exe`窃取**有趣进程**的凭据？（firefox，chrome等...）

### [服务](/windows-hardening/windows-local-privilege-escalation.md#services)

* [您能否**修改任何服务**？](/windows-hardening/windows-local-privilege-escalation.md#permissions)
* [您能否**修改**任何**服务**执行的**二进制文件**？](/windows-hardening/windows-local-privilege-escalation.md#modify-service-binary-path)
* [您能否**修改**任何**服务**的**注册表**？](/windows-hardening/windows-local-privilege-escalation.md#services-registry-modify-permissions)
* 您能否利用任何**未加引号的服务**二进制**路径**？]\(windows-local-privilege-escalation/#unquoted-service-paths)

### [**应用程序**](/windows-hardening/windows-local-privilege-escalation.md#applications)

* **写入**[**已安装应用程序**](/windows-hardening/windows-local-privilege-escalation.md#write-permissions)的权限
* [**启动应用程序**](/windows-hardening/windows-local-privilege-escalation.md#run-at-startup)
* **易受攻击的**[**驱动程序**](/windows-hardening/windows-local-privilege-escalation.md#drivers)

### [DLL劫持](/windows-hardening/windows-local-privilege-escalation.md#path-dll-hijacking)

* [ ] 你可以**在PATH中的任何文件夹中写入**吗？
* [ ] 是否有任何已知的服务二进制文件**尝试加载任何不存在的DLL**？
* [ ] 你可以**写入**任何**二进制文件夹**吗？

### [网络](/windows-hardening/windows-local-privilege-escalation.md#network)

* [ ] 枚举网络（共享、接口、路由、邻居，...）
* [ ] 特别关注监听在本地主机（127.0.0.1）上的网络服务

### [Windows凭证](/windows-hardening/windows-local-privilege-escalation.md#windows-credentials)

* [ ] [**Winlogon**](/windows-hardening/windows-local-privilege-escalation.md#winlogon-credentials)凭证
* [ ] 你可以使用的[**Windows Vault**](/windows-hardening/windows-local-privilege-escalation.md#credentials-manager-windows-vault)凭证？
* [ ] 有趣的[**DPAPI凭证**](/windows-hardening/windows-local-privilege-escalation.md#dpapi)？
* [ ] 已保存的[**Wifi网络**](/windows-hardening/windows-local-privilege-escalation.md#wifi)密码？
* [ ] 已保存的[**RDP连接**](/windows-hardening/windows-local-privilege-escalation.md#saved-rdp-connections)中的有趣信息？
* [ ] [**最近运行的命令**](/windows-hardening/windows-local-privilege-escalation.md#recently-run-commands)中的密码？
* [ ] [**远程桌面凭证管理器**](/windows-hardening/windows-local-privilege-escalation.md#remote-desktop-credential-manager)密码？
* [ ] [**AppCmd.exe**是否存在](/windows-hardening/windows-local-privilege-escalation.md#appcmd-exe)？凭证？
* [ ] [**SCClient.exe**](/windows-hardening/windows-local-privilege-escalation.md#scclient-sccm)？DLL侧加载？

### [文件和注册表（凭证）](/windows-hardening/windows-local-privilege-escalation.md#files-and-registry-credentials)

* [ ] **Putty:** [**凭证**](/windows-hardening/windows-local-privilege-escalation.md#putty-creds) **和** [**SSH主机密钥**](/windows-hardening/windows-local-privilege-escalation.md#putty-ssh-host-keys)
* [ ] 注册表中的[**SSH密钥**](/windows-hardening/windows-local-privilege-escalation.md#ssh-keys-in-registry)？
* [ ] [**无人值守文件**](/windows-hardening/windows-local-privilege-escalation.md#unattended-files)中的密码？
* [ ] 任何[**SAM和SYSTEM**](/windows-hardening/windows-local-privilege-escalation.md#sam-and-system-backups)备份？
* [ ] [**云凭证**](/windows-hardening/windows-local-privilege-escalation.md#cloud-credentials)？
* [ ] [**McAfee SiteList.xml**](https://hacktricks.xsx.tw/windows-hardening/pages/flWGSMTybKsUJLqsox9H#mcafee-sitelist.xml)文件？
* [ ] [**缓存的GPP密码**](/windows-hardening/windows-local-privilege-escalation.md#cached-gpp-pasword)？
* [ ] [**IIS Web配置文件**](/windows-hardening/windows-local-privilege-escalation.md#iis-web-config)中的密码？
* [ ] [**Web日志**](/windows-hardening/windows-local-privilege-escalation.md#logs)中的有趣信息？
* [ ] 你想要向用户[**请求凭证**](/windows-hardening/windows-local-privilege-escalation.md#ask-for-credentials)吗？
* [ ] 回收站中的[**有凭证的文件**](/windows-hardening/windows-local-privilege-escalation.md#credentials-in-the-recyclebin)？
* [ ] 其他包含凭证的[**注册表**](/windows-hardening/windows-local-privilege-escalation.md#inside-the-registry)？
* [ ] 浏览器数据中（数据库、历史记录、书签，...）的[**通用密码搜索**](/windows-hardening/windows-local-privilege-escalation.md#browsers-history)？
* [ ] 在文件和注册表中进行[**通用密码搜索**](/windows-hardening/windows-local-privilege-escalation.md#generic-password-search-in-files-and-registry)？
* [ ] 自动搜索密码的[**工具**](/windows-hardening/windows-local-privilege-escalation.md#tools-that-search-for-passwords)？

### [泄漏的处理程序](/windows-hardening/windows-local-privilege-escalation.md#leaked-handlers)

* [ ] 你可以访问任何由管理员运行的进程的处理程序吗？

### [管道客户端冒充](/windows-hardening/windows-local-privilege-escalation.md#named-pipe-client-impersonation)

* [ ] 检查是否可以滥用它

**Try Hard Security Group**

<figure><img src="/files/Kw46fTSYxPIOMyKySfL5" alt=""><figcaption></figcaption></figure>

{% embed url="<https://discord.gg/tryhardsecurity>" %}

<details>

<summary><strong>从零开始学习AWS黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS Red Team Expert）</strong></a><strong>！</strong></summary>

支持HackTricks的其他方式：

* 如果您想在HackTricks中看到您的**公司广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[NFT](https://opensea.io/collection/the-peass-family)收藏品
* **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或在**Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live) 上**关注**我们。
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。

</details>