# 权限提升
English: Privilege Escalation
- Entry Count: 15
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## 令牌窃取与模拟
- ID: privilege-token
- Difficulty: advanced
- Subcategory: 令牌操作
- Tags: token, privilege, impersonation, windows
- Original Extracted Source: original extracted intranet-security-wiki source/privilege-token.md
Description:
窃取和模拟Windows访问令牌
Prerequisites:
- 已获得目标机器权限
- SeImpersonatePrivilege权限
- Windows系统
Execution Outline:
1. 列出令牌
2. 窃取令牌
3. JuicyPotato攻击
4. PrintSpoofer
Analysis:
令牌窃取成功后可以模拟高权限用户身份执行操作。
OPSEC:
- Potato系列工具利用DCOM机制
- 需要SeImpersonatePrivilege权限
- 不同Windows版本需要不同的CLSID
## Windows权限提升
- ID: windows-privesc
- Difficulty: intermediate
- Subcategory: Windows
- Tags: privesc, windows, privilege
- Original Extracted Source: original extracted intranet-security-wiki source/windows-privesc.md
Description:
Windows系统提权技术
Prerequisites:
- 普通用户权限
- 系统漏洞
Execution Outline:
1. 检查提权向量
2. 使用WinPEAS
3. 检查服务权限
4. 检查未引用服务路径
## Linux权限提升
- ID: linux-privesc
- Difficulty: intermediate
- Subcategory: Linux
- Tags: privesc, linux, privilege
- Original Extracted Source: original extracted intranet-security-wiki source/linux-privesc.md
Description:
Linux系统提权技术
Prerequisites:
- 普通用户权限
- 系统漏洞
Execution Outline:
1. 检查SUID
2. 检查Sudo
3. 检查Cron
4. 使用LinPEAS
## UAC绕过
- ID: uac-bypass
- Difficulty: intermediate
- Subcategory: UAC
- Tags: uac, bypass, windows
- Original Extracted Source: original extracted intranet-security-wiki source/uac-bypass.md
Description:
绕过Windows用户账户控制
Prerequisites:
- 管理员组成员
- UAC启用
Execution Outline:
1. Fodhelper
2. Eventvwr
3. 使用UACME
## DLL劫持
- ID: dll-hijack
- Difficulty: intermediate
- Subcategory: DLL
- Tags: dll, hijack, privesc
- Original Extracted Source: original extracted intranet-security-wiki source/dll-hijack.md
Description:
通过DLL劫持提权
Prerequisites:
- 可写目录
- DLL搜索顺序
Execution Outline:
1. 查找DLL劫持
2. 创建恶意DLL
3. 放置DLL
## 服务提权
- ID: service-exploit
- Difficulty: intermediate
- Subcategory: 服务
- Tags: service, privesc, windows
- Original Extracted Source: original extracted intranet-security-wiki source/service-exploit.md
Description:
通过服务漏洞提权
Prerequisites:
- 服务修改权限
- 可写服务路径
Execution Outline:
1. 检查服务权限
2. 修改服务路径
3. 重启服务
## AlwaysInstallElevated提权
- ID: always-install
- Difficulty: intermediate
- Subcategory: MSI
- Tags: msi, alwaysinstall, privesc
- Original Extracted Source: original extracted intranet-security-wiki source/always-install.md
Description:
利用AlwaysInstallElevated提权
Prerequisites:
- AlwaysInstallElevated启用
Execution Outline:
1. 检查设置
2. 创建MSI
3. 安装MSI
## Juicy Potato提权
- ID: juicy-potato
- Difficulty: advanced
- Subcategory: Potato
- Tags: juicy-potato, com, privesc
- Original Extracted Source: original extracted intranet-security-wiki source/juicy-potato.md
Description:
利用COM对象和SeImpersonatePrivilege提权
Prerequisites:
- SeImpersonatePrivilege
- Windows < 2019
Execution Outline:
1. 检查权限
2. 执行JuicyPotato
## PrintSpoofer提权
- ID: printspoofer
- Difficulty: advanced
- Subcategory: PrintSpoofer
- Tags: printspoofer, privesc, windows
- Original Extracted Source: original extracted intranet-security-wiki source/printspoofer.md
Description:
利用打印机服务提权
Prerequisites:
- SeImpersonatePrivilege
Execution Outline:
1. 执行PrintSpoofer
2. 指定命令
## GodPotato提权
- ID: godpotato
- Difficulty: advanced
- Subcategory: GodPotato
- Tags: godpotato, privesc, windows
- Original Extracted Source: original extracted intranet-security-wiki source/godpotato.md
Description:
GodPotato提权工具
Prerequisites:
- SeImpersonatePrivilege
Execution Outline:
1. 执行GodPotato
2. 反向Shell
## SUID提权
- ID: suid-exploit
- Difficulty: intermediate
- Subcategory: SUID
- Tags: suid, privesc, linux
- Original Extracted Source: original extracted intranet-security-wiki source/suid-exploit.md
Description:
利用SUID文件提权
Prerequisites:
- 存在SUID文件
- 可利用程序
Execution Outline:
1. 查找SUID
2. 常见可利用程序
3. GTFOBins
## Sudo提权
- ID: sudo-exploit
- Difficulty: intermediate
- Subcategory: Sudo
- Tags: sudo, privesc, linux
- Original Extracted Source: original extracted intranet-security-wiki source/sudo-exploit.md
Description:
利用Sudo配置提权
Prerequisites:
- Sudo权限配置不当
Execution Outline:
1. 检查Sudo权限
2. 常见利用
3. CVE-2021-3156
## Cron提权
- ID: cron-exploit
- Difficulty: intermediate
- Subcategory: Cron
- Tags: cron, privesc, linux
- Original Extracted Source: original extracted intranet-security-wiki source/cron-exploit.md
Description:
利用Cron任务提权
Prerequisites:
- 可写Cron脚本
- 通配符注入
Execution Outline:
1. 检查Cron任务
2. 检查脚本权限
3. 通配符注入
## 内核漏洞提权
- ID: kernel-exploit
- Difficulty: advanced
- Subcategory: 内核
- Tags: kernel, privesc, exploit
- Original Extracted Source: original extracted intranet-security-wiki source/kernel-exploit.md
Description:
利用内核漏洞提权
Prerequisites:
- 存在内核漏洞
- 可编译/执行exploit
Execution Outline:
1. 检查内核版本
2. 搜索exploit
3. 常见内核漏洞
## Potato系列提权攻击
- ID: potato-attack
- Difficulty: intermediate
- Subcategory: Potato提权
- Tags: privilege-escalation, potato, token-impersonation, ntlm-relay, windows
- Original Extracted Source: original extracted intranet-security-wiki source/potato-attack.md
Description:
利用Windows令牌模拟和NTLM中继机制从服务账户(SeImpersonatePrivilege/SeAssignPrimaryTokenPrivilege)提权到SYSTEM
Prerequisites:
- 拥有SeImpersonatePrivilege或SeAssignPrimaryTokenPrivilege权限
- 常见于IIS AppPool、SQL Server、各类服务账户
Execution Outline:
1. 检查当前权限
2. JuicyPotato (Windows Server 2016/2019)
3. PrintSpoofer (Windows 10/Server 2019+)
4. Sweet Potato (多技术集成)
Analysis:
Potato系列攻击利用Windows的令牌模拟机制——拥有SeImpersonatePrivilege的服务账户可以模拟向其认证的任何用户令牌。攻击者通过欺骗SYSTEM账户向本地COM服务器/命名管道认证，获取SYSTEM令牌后创建高权限进程。这是Web服务器(IIS)和数据库(SQL Server)提权最常见的方式之一。
OPSEC:
- 1) Potato工具的二进制文件特征明显，建议内存加载 2) 创建的命名管道名称可能被监控 3) 成功后立即清理工具和临时文件 4) 避免使用net user等敏感命令，改用更隐蔽的后渗透方式
External References:
- https://attack.mitre.org/techniques/T1134/001/
- https://github.com/BeichenDream/GodPotato

