New: WPE notes

syselement · syselement · commit 77087814ff18 · 2025-07-24T00:31:16.000+02:00
diff --git a/wpe/.gitbook/assets/wpe.png b/wpe/.gitbook/assets/wpe.png
diff --git a/wpe/1-intro/README.md b/wpe/1-intro/README.md
@@ -0,0 +1,11 @@
+# 1. Introduction to Windows Privesc
+
+## Gaining a foothold
+
+
+
+## Initial enumeration
+
+
+
+## Exploring automated tools
diff --git a/wpe/2-win-privesc-paths/1-wpe-kernelexploits.md b/wpe/2-win-privesc-paths/1-wpe-kernelexploits.md
@@ -0,0 +1 @@
+# Escalation Path: Kernel Exploits
diff --git a/wpe/2-win-privesc-paths/10-wpe-cve-2019-1388.md b/wpe/2-win-privesc-paths/10-wpe-cve-2019-1388.md
@@ -0,0 +1 @@
+# Escalation Path: CVE-2019-1388
diff --git a/wpe/2-win-privesc-paths/11-wpe-capstone.md b/wpe/2-win-privesc-paths/11-wpe-capstone.md
@@ -0,0 +1 @@
+# WPE Capstone Challenge
diff --git a/wpe/2-win-privesc-paths/2-wpe-pws-portfwd.md b/wpe/2-win-privesc-paths/2-wpe-pws-portfwd.md
@@ -0,0 +1,2 @@
+# Escalation Path: Passwords and Port Forwarding
+
diff --git a/wpe/2-win-privesc-paths/3-wpe-wsl.md b/wpe/2-win-privesc-paths/3-wpe-wsl.md
@@ -0,0 +1 @@
+# Escalation Path: Windows Subsystem for Linux
diff --git a/wpe/2-win-privesc-paths/4-wpe-system-runas.md b/wpe/2-win-privesc-paths/4-wpe-system-runas.md
@@ -0,0 +1 @@
+# Escalation Path: getsystem, RunAs
diff --git a/wpe/2-win-privesc-paths/5-wpe-registry.md b/wpe/2-win-privesc-paths/5-wpe-registry.md
@@ -0,0 +1 @@
+# Escalation Path: Registry
diff --git a/wpe/2-win-privesc-paths/6-wpe-exes.md b/wpe/2-win-privesc-paths/6-wpe-exes.md
@@ -0,0 +1 @@
+# Escalation Path: Executable Files
diff --git a/wpe/2-win-privesc-paths/7-wpe-startupapps.md b/wpe/2-win-privesc-paths/7-wpe-startupapps.md
@@ -0,0 +1 @@
+# Escalation Path: Startup Applications
diff --git a/wpe/2-win-privesc-paths/8-wpe-dll-hijacking.md b/wpe/2-win-privesc-paths/8-wpe-dll-hijacking.md
@@ -0,0 +1 @@
+# Escalation Path: DLL Hijacking
diff --git a/wpe/2-win-privesc-paths/9-wpe-permissions.md b/wpe/2-win-privesc-paths/9-wpe-permissions.md
@@ -0,0 +1 @@
+# Escalation Path: Service Permissions (Paths)
diff --git a/wpe/2-win-privesc-paths/README.md b/wpe/2-win-privesc-paths/README.md
@@ -0,0 +1,20 @@
+# 2. Windows Privilege Escalation Paths
+
+---
+
+## Sections
+
+1. [Escalation Path: Kernel Exploits](1-wpe-kernelexploits.md)
+2. [Escalation Path: Passwords and Port Forwarding](2-wpe-pws-portfwd.md)
+3. [Escalation Path: Windows Subsystem for Linux](3-wpe-wsl.md)
+4. [Escalation Path: getsystem, RunAs](4-wpe-system-runas.md)
+5. [Escalation Path: Registry](5-wpe-registry.md)
+6. [Escalation Path: Executable Files](6-wpe-exes.md)
+7. [Escalation Path: Startup Applications](7-wpe-startupapps.md)
+8. [Escalation Path: DLL Hijacking](8-wpe-dll-hijacking.md)
+9. [Escalation Path: Service Permissions (Paths)](9-wpe-permissions.md)
+10. [Escalation Path: CVE-2019-1388](10-wpe-cve-2019-1388.md)
+11. [Capstone Challenge](11-wpe-capstone.md)
+
+---
+
diff --git a/wpe/README.md b/wpe/README.md
@@ -0,0 +1,35 @@
+---
+description: Windows Privesc for Beginners by Heath Adams
+---
+
+# TCM - Windows Privilege Escalation for Beginners
+
+![Windows Privilege Escalation for Beginners - academy.tcm-sec.com - © TCM Security](.gitbook/assets/wpe.png)
+
+## [WPE](https://academy.tcm-sec.com/p/windows-privilege-escalation-for-beginners) Course Goals and Objectives
+
+* Learn Windows Privilege escalation techniques
+
+## Course duration & Topics
+
+~	7 hours
+
+1. [Introduction to Windows Privesc](1-intro/README.md)
+1. [Windows Privilege Escalation Paths](2-win-privesc-paths/README.md)
+
+Instructor: [Heath Adams - The Cyber Mentor](https://www.thecybermentor.com/)
+
+## Useful links and resources
+
+* 🚩 ***RETIRED COURSE*** - Where to find the [Windows Privilege Escalation for Beginners | TCM Security, Inc.](https://academy.tcm-sec.com/p/windows-privilege-escalation-for-beginners) course? - [TCM Academy Courses](https://academy.tcm-sec.com/courses)
+* TCM discord channel - [TCM Security Discord](https://discord.gg/tcm)
+* **Practical Network Penetration Tester** Certification - [PNPT](https://certifications.tcm-sec.com/pnpt/)
+* 🔬 For the **training** part I will use my home lab environment, TryHackMe and HackTheBox environments
+* [My WPE references](wpe-references.md)
+
+> ### ❗ Disclaimer
+>
+> * **Do not use the covered attacks and techniques on real IP addresses, hosts or networks without proper authorization!**
+
+---
+
diff --git a/wpe/wpe-references.md b/wpe/wpe-references.md
@@ -0,0 +1,145 @@
+# 🌐 WPE References
+
+* [Windows Privilege Escalation for Beginners | TCM Security, Inc.](https://academy.tcm-sec.com/p/windows-privilege-escalation-for-beginners)
+* [TCM Course Resources - Github](https://github.com/TCM-Course-Resources)
+  * [Windows-Privilege-Escalation-Resources](https://github.com/TCM-Course-Resources/Windows-Privilege-Escalation-Resources)
+* [PNPT Certification](https://certifications.tcm-sec.com/pnpt/)
+* [Course and FAQs - Discord](https://discord.gg/tcm)
+* [HackTheBox](https://app.hackthebox.com/home)
+* [TryHackMe](https://tryhackme.com/)
+
+## Introduction
+
+- [Windows - Privilege Escalation - Internal All The Things](https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/windows-privilege-escalation/)
+- [Windows Privilege Escalation Guide - absolomb](https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/)
+- [Windows Privilege Escalation Fundamentals - FuzzySecurity](https://fuzzysecurity.com/tutorials/16.html)
+- [Privilege Escalation - Windows - Total OSCP Guide](https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html)
+- [Windows PrivEsc Arena - TryHackMe Escalation Lab](https://tryhackme.com/room/windowsprivescarena)
+
+## Foothold, Enumeration
+
+- [MSFvenom](https://www.offsec.com/metasploit-unleashed/msfvenom/)
+
+## Automated tools
+
+- [PEASS-ng/winPEAS](https://github.com/peass-ng/PEASS-ng/tree/master/winPEAS)
+
+- Windows Priv Esc Checklist: https://book.hacktricks.xyz/windows/checklist-windows-privilege-escalation
+
+  Sherlock: https://github.com/rasta-mouse/Sherlock
+
+  Watson: https://github.com/rasta-mouse/Watson
+
+  PowerUp: https://github.com/PowerShellMafia/PowerSploit/tree/master/Privesc
+
+  JAWS: https://github.com/411Hall/JAWS
+
+  Windows Exploit Suggester: https://github.com/AonCyberLabs/Windows-Exploit-Suggester
+
+  Metasploit Local Exploit Suggester: https://blog.rapid7.com/2015/08/11/metasploit-local-exploit-suggester-do-less-get-more/
+
+  Seatbelt: https://github.com/GhostPack/Seatbelt
+
+  SharpUp: https://github.com/GhostPack/SharpUp
+
+
+
+
+
+
+
+
+
+------
+
+# TEMP
+
+
+
+### Escalation Path: Kernel Exploits
+
+Windows Kernel Exploits: https://github.com/SecWiki/windows-kernel-exploits
+
+Kitrap0d Info: https://seclists.org/fulldisclosure/2010/Jan/341
+
+MS10-059: https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS10-059
+
+
+
+### Escalation Path: Passwords and Port Forwarding
+
+Achat Exploit: https://www.exploit-db.com/exploits/36025
+
+Achat Exploit (Metasploit): https://www.rapid7.com/db/modules/exploit/windows/misc/achat_bof
+
+Plink Download: https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html
+
+
+
+### Escalation Path: Windows Subsystem for Linux
+
+Spawning TTY Shell: https://netsec.ws/?p=337
+
+Impacket Toolkit: https://github.com/SecureAuthCorp/impacket
+
+
+
+### Impersonation and Potato Attacks
+
+Rotten Potato: https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
+
+Juicy Potato: https://github.com/ohpe/juicy-potato
+
+Groovy Reverse Shell: https://gist.github.com/frohoff/fed1ffaab9b9beeb1c76
+
+Alternative Data Streams: https://blog.malwarebytes.com/101/2015/07/introduction-to-alternate-data-streams/
+
+
+
+### Escalation Path: getsystem, RunAs
+
+getsystem Explained: https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/
+
+
+
+### Escalation Path: Registry
+
+- 
+- 
+
+### Escalation Path: Executable Files
+
+- 
+- 
+
+### Escalation Path: Startup Applications
+
+icacls Docs: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/icacls
+
+
+
+### Escalation Path: DLL Hijacking
+
+- 
+
+### Escalation Path: Service Permissions (Paths)
+
+- 
+
+
+
+### Escalation Path: CVE-2019-1388
+
+ZeroDayInitiative CVE-2019-1388: https://www.youtube.com/watch?v=3BQKpPNlTSo
+
+Rapid7 CVE-2019-1388: https://www.rapid7.com/db/vulnerabilities/msft-cve-2019-1388
+
+
+
+### Capstone Challenge
+
+Basic Powershell for Pentesters: https://book.hacktricks.xyz/windows/basic-powershell-for-pentesters
+
+Mounting VHD Files: https://medium.com/@klockw3rk/mounting-vhd-file-on-kali-linux-through-remote-share-f2f9542c1f25
+
+Capturing MSSQL Creds: https://medium.com/@markmotig/how-to-capture-mssql-credentials-with-xp-dirtree-smbserver-py-5c29d852f478

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+# Escalation Path: Passwords and Port Forwarding`
	`2`	`+`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+# Escalation Path: Windows Subsystem for Linux`