Help, Windows server privilege escalation

[ChinaOldBoy]

I have launched a website server in CobaltStrike using shell.php. Now I am in trouble. How can I elevate its permissions, add users, and perform remote desktop access? Is there any other way to obtain the password?

 

[basileusapoleiaoff]

Check this: https://book.hacktricks.xyz/windows-hardening/checklist-windows-privilege-escalation

If this don't work PM me, if you want some help

 

[ChinaOldBoy]

shell winPEASx64.exe cmd fast ?

 

[ChinaOldBoy]

looks bad

 

[MOYAGOLUBUSHKA]

I have launched a website server in CobaltStrike using shell.php. Now I am in trouble. How can I elevate its permissions, add users, and perform remote desktop access? Is there any other way to obtain the password?

what version of windows server is this ?
any KBs installed ?

Pretty good documentation regarding "Potatos" for windows :

RoguePotato, PrintSpoofer, SharpEfsPotato, GodPotato - HackTricks

book.hacktricks.xyz

I bet its vulnerable to "roguepotato" here is some documentation :

RoguePotato on Remote

JuicyPotato was a go-to exploit whenever I found myself with a Windows shell with SeImpersonatePrivilege, which typically was whenever there was some kind of webserver exploit. But Microsoft changed things in Server 2019 to brake JuicyPotato, so I was really excited when splinter_code and...

0xdf.gitlab.io

And here is a POC :

GitHub - antonioCoco/RoguePotato: Another Windows Local Privilege Escalation from Service Account to System

Another Windows Local Privilege Escalation from Service Account to System - GitHub - antonioCoco/RoguePotato: Another Windows Local Privilege Escalation from Service Account to System

github.com

Some time ago Exploited something similar to this worked like a champ