post-exploit-windows

Windows Post-Exploitation Methodology

⛔ In-Depth Reference (Required Reading)

• Need detailed commands for Potato/service/UAC/kernel privilege escalation → references/windows-privesc.md
• Need SAM/LSASS/browser credential extraction, domain reconnaissance, sensitive data search → references/windows-credential.md
• Need KrbRelayUp/AMSI bypass/Potato compatibility matrix/permission mapping table → references/ad-privesc-techniques.md
• → references/printnightmare-attack.md — CVE-2021-34527 PrintNightmare Remote Code Execution

---

Phase 1: Basic Information Gathering

whoami /all                 # 用户、组、权限（关键！看有没有 SeImpersonate）
systeminfo                  # 系统版本、补丁、域信息
ipconfig /all               # 网络配置（DNS 服务器 = 域控 IP）
net localgroup Administrators

Key Privileges → Privilege Escalation Paths

Privilege	Privilege Escalation Method
SeImpersonatePrivilege	Potato family (GodPotato has the best compatibility)
SeBackupPrivilege	Read SAM/SYSTEM registry
SeDebugPrivilege	dump LSASS
In Administrators group but restricted by UAC	fodhelper.exe bypass

30-Second Quick Privilege Escalation Check

#	Check Item	Command	Privilege Escalation Method
1	Token Privileges	whoami /priv	SeImpersonate → Potato
2	User Groups	whoami /groups	Administrators → UAC bypass
3	Service Privileges	sc qc [service]	Writable service binary → replace
4	Unquoted Path	wmic service get name,pathname	Unquoted path containing spaces
5	AlwaysInstall	reg query HKLM\...\Installer	MSI SYSTEM installation
6	Autologon	reg query "HKLM\...\Winlogon"	DefaultPassword leak
7	Missing patches	systeminfo	Kernel privilege escalation CVE

Quick Assessment: Web shell usually has SeImpersonate → prioritize Potato for privilege escalation.

Phase 2: Privilege Escalation Decision Tree

当前权限？
├─ 有 SeImpersonate → Potato 提权（最常见）→ [references/windows-privesc.md](references/windows-privesc.md)
├─ 管理员组 + UAC 限制 → UAC 绕过 → [references/windows-privesc.md](references/windows-privesc.md)
├─ 低权限 → 检查服务/AlwaysInstallElevated/内核漏洞 → [references/windows-privesc.md](references/windows-privesc.md)
└─ 已是 SYSTEM/Admin → 直接进入凭据提取

Phase 3: Credential Extraction Decision Tree

需要什么凭据？
├─ 本地账户哈希 → SAM 数据库（reg save）
├─ 域凭据/明文密码 → LSASS 内存（Mimikatz / comsvcs.dll）
├─ 浏览器密码 → Chrome Login Data / Firefox logins.json
└─ 其他 → 凭据管理器 cmdkey、PowerShell 历史、config 文件搜索
详细命令 → [references/windows-credential.md](references/windows-credential.md)

Phase 4: Domain Environment Assessment

If systeminfo shows Domain is not WORKGROUP → domain environment, domain penetration required.

Notes

• Gather first, then escalate: the output of whoami /all determines the entire privilege escalation route
• Potato family selection: unsure of version → GodPotato (most broadly compatible)
• LSASS dump alternative: comsvcs.dll MiniDump does not require uploading Mimikatz

UAC bypass

• Whitelisted programs with auto-elevate, such as fodhelper.exe, can bypass UAC

LSASS dump

• comsvcs.dll method: AV bypass, no file written to disk, LOLBins (built-in system tools)