> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/local-privilege-escalation-and-credentials.md). # 本地提权与凭证这些说明涵盖在获得本地访问后有用的 Windows 检查：UAC 配置、提升权限的 MSI 安装、内存中的凭据材料、注册表配置单元，以及包含可重复使用机密的部署文件。 ## 本地检查 1. 确认当前令牌、组成员身份、完整性级别和 UAC 状态。 2. 检查两个 AlwaysInstallElevated 注册表项是否都已启用。 3. 查找本地凭据来源：LSASS、SAM、LSA 机密、注册表值、部署文件和应用程序配置。 4. 在尝试提权之前，请先在实验室或经授权的评估中验证每一项发现。 ## 快速凭据分流先使用快速、低影响的检查。复用的本地管理员密码或部署机密，通常比内核漏洞利用更快也更安全。 ```cmd whoami /all cmdkey /list net use dir C:\Users\ /a ``` ```powershell Get-ChildItem -Path C:\Users -Force -ErrorAction SilentlyContinue Get-Content "$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt" -ErrorAction SilentlyContinue ``` 值得检查的地方： * Windows 部署文件： `unattend.xml`, `Autounattend.xml`，以及 Sysprep 残留文件。 * Shell 历史：PowerShell PSReadLine、控制台转录记录和管理员辅助脚本。 * 应用程序配置：IIS `web.config`、数据库客户端、备份工具、VPN 客户端和内部代理程序。 * 注册表值：自动登录、PuTTY 会话、WinSCP 会话、RDP 历史记录，以及旧的第三方软件项。 * 本地配置单元： `SAM`, `SYSTEM`，以及 `SECURITY` 在当前权限允许安全导出时。 ## 注册表快速检查注册表发现通常分为三类：安装策略滥用、已存储的凭据，或普通用户可修改的自动运行路径。 ```cmd reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run ``` 对于自动运行项，不要只停留在注册表值上。也要检查文件路径和父目录权限： ```cmd icacls "C:\Path\To\Autorun.exe" icacls "C:\Path\To" ``` ## 技术


AlwaysInstallElevated	检测并利用 AlwaysInstallElevated MSI 配置错误，实现 Windows 本地提权。	/pages/3ded831b4cb42dcd849c4235e28ee810d68060ac
UAC 绕过	检查 Windows UAC 级别，并在经授权的实验室中验证 UAC 绕过行为。	/pages/1da001e656f7a3ed2630583d5f036fe27d4d6f3c
使用 Mimikatz 转储哈希	在经授权的实验室中，使用 Mimikatz 或 Meterpreter Kiwi 提取 Windows 哈希和机密。	/pages/93c2c658a83da07628a6312261f41a775039629b
Windows 文件中的凭据	搜索存储在部署、应答和配置文件中的 Windows 凭据。	/pages/c10dc2e11bea63a554be1bcc292ce1e89a264aad

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/local-privilege-escalation-and-credentials.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.

:box-open:

AlwaysInstallElevated

:user-shield:

UAC 绕过

:key:

使用 Mimikatz 转储哈希

:file-lines:

Windows 文件中的凭据