Privilege escalation on Windows

In this recipe, you will learn a few ways to get the administrator account on the Windows Server. There are multiple ways to get administrator rights on a Windows system. Let's look at a few ways in which this can be done.

How to do it...

Once we have meterpreter on the system, Metasploit has an inbuilt module to try three different methods to get admin access. First, we will see the infamous getsystem of Metasploit. To view the help, we type this:

getsystem –h

To try and get admin, we type the following command:

getsystem

We can see we are now NT AUTHORITY\SYSTEM. Sometimes, this technique may not work, so we try another way to get the system on the machine. We will look at some ways to reconfigure Windows services. 

We will use sc ( known as service configuration) to configure Windows services. Let's look at the upnphost service:

sc qc upnphost

First, we upload our netcat binary on the system. Once that's done, we can change the binary path of a running service with...