Windows Privilege Escalation

Walkthrough summary

Windows Privilege Escalation TryHackMe walkthrough with 12 answered prompts and lab methodology notes.

Sample prompts covered

• Users that can change system configurations are part of which group?
  Open the walkthrough page to inspect the full answer and command flow.
• The SYSTEM account has more privileges than the Administrator user (aye/nay)
  Open the walkthrough page to inspect the full answer and command flow.
• A password for the julia.jones user has been left on the Powershell history. What is the password?
  Open the walkthrough page to inspect the full answer and command flow.
• A web server is running on the remote host. Find any interesting password on web.config files associated with IIS. What is the password of the db_admin user?
  Open the walkthrough page to inspect the full answer and command flow.
• There is a saved password on your Windows credentials. Using cmdkey and runas, spawn a shell for mike.katz and retrieve the flag from his desktop.
  Open the walkthrough page to inspect the full answer and command flow.