Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
The win is almost always in the first ten minutes of enumeration. Here is the order that finds it.
A Repeatable Windows Privesc Method
The win is almost always in the first ten minutes of enumeration. Here is the order that finds it.
Service Misconfigurations
Most Windows wins are a service running as SYSTEM that a normal user is allowed to reconfigure or replace.
Token Impersonation
SeImpersonatePrivilege on a service account is a near-free SYSTEM. The potato attacks turn it into one.
Dangerous Privileges and Installers
SeBackup reads any file, AlwaysInstallElevated runs your MSI as SYSTEM. Both are gifts admins leave behind.
Hunting for Credentials
Admins leave passwords everywhere. Config files, the registry, saved sessions, and memory all leak them.