27.提权

提权

windows提权

1.手工查找poc 

https://github.com/SecWiki/windows-kernel-exploits


使用 Windows 内置的 systeminfo 命令
C:\Users\Administrator>systeminfo

主机名:           DESKTOP-7PFSTJ1
OS 名称:          Microsoft Windows 10 IoT 企业版 LTSC
OS 版本:          10.0.19044 暂缺 Build 19044
OS 制造商:        Microsoft Corporation
OS 配置:          独立工作站
OS 构件类型:      Multiprocessor Free
注册的所有人:     Windows 用户
注册的组织:
产品 ID:          00436-50000-00000-AAOEM
初始安装日期:     2026/9/3, 21:28:43
系统启动时间:     2026/9/4, 14:11:01
系统制造商:       XIAOMI
系统型号:         Redmi Book Pro 16 2024
系统类型:         x64-based PC
处理器:           安装了 1 个处理器。
                  [01]: Intel64 Family 6 Model 170 Stepping 4 GenuineIntel ~1400 Mhz
BIOS 版本:        XIAOMI RMAMT6B0P0B0B, 2025/6/10
Windows 目录:     C:\Windows
系统目录:         C:\Windows\system32
启动设备:         \Device\HarddiskVolume1
系统区域设置:     zh-cn;中文(中国)
输入法区域设置:   zh-cn;中文(中国)
时区:             (UTC+08:00) 北京，重庆，香港特别行政区，乌鲁木齐
物理内存总量:     32,221 MB
可用的物理内存:   23,817 MB
虚拟内存: 最大值: 37,341 MB
虚拟内存: 可用:   28,773 MB
虚拟内存: 使用中: 8,568 MB
页面文件位置:     C:\pagefile.sys
域:               WORKGROUP
登录服务器:       \\DESKTOP-7PFSTJ1
修补程序:         安装了 7 个修补程序。
                  [01]: KB5004331
                  [02]: KB5003791
                  [03]: KB5007401
                  [04]: KB5034232
                  [05]: KB5039211
                  [06]: KB5037995
                  [07]: KB5005699
网卡:             安装了 2 个 NIC。
                  [01]: Intel(R) Wi-Fi 6E AX211 160MHz
                      连接名:      WLAN
                      启用 DHCP:   是
                      DHCP 服务器: 10.153.192.116
                      IP 地址
                        [01]: 10.153.192.200
                        [02]: fe80::3851:724d:a4b:8a12
                        [03]: 240a:42c3:8402:152a:b14f:ec28:eb85:c91b
                        [04]: 240a:42c3:8402:152a:9e1f:ae8:9533:cb76
                  [02]: Bluetooth Device (Personal Area Network)
                      连接名:      蓝牙网络连接
                      状态:        媒体连接已中断
Hyper-V 要求:     虚拟机监视器模式扩展: 是
                  固件中已启用虚拟化: 是
                  二级地址转换: 是
                  数据执行保护可用: 是

此命令可以快速查看系统关键信息，包括已安装的补丁列表。

操作：
按 Win + R，输入 cmd 或 powershell，打开命令行。
输入命令：systeminfo
查看：在输出信息中找到 “修补程序” 部分。这里列出了所有已安装的补丁（包括非安全更新）。您可以对照微软公告，检查特定KB是否存在。

(2). 使用 PowerShell 获取更详细的补丁信息

功能更强大，可以筛选和导出信息。

操作：以管理员身份打开 Windows PowerShell。
输入命令：
Get-Hotfix：列出所有已安装的更新。
Get-Hotfix | Sort-Object InstalledOn -Descending：按安装日期倒序排列，最新的在最前面。
Get-Hotfix -Id KB5034441：检查特定的KB补丁是否已安装。

PS C:\Users\Administrator> Get-Hotfix | Sort-Object InstalledOn -Descending

Source        Description      HotFixID      InstalledBy          InstalledOn
------        -----------      --------      -----------          -----------
DESKTOP-7P... Update           KB5037995                          2024/6/13 0:00:00
DESKTOP-7P... Security Update  KB5039211                          2024/6/13 0:00:00
DESKTOP-7P... Update           KB5007401                          2024/6/13 0:00:00
DESKTOP-7P... Update           KB5034232                          2024/6/13 0:00:00
DESKTOP-7P... Security Update  KB5005699                          2021/10/6 0:00:00
DESKTOP-7P... Update           KB5003791                          2021/10/6 0:00:00
DESKTOP-7P... Update           KB5004331                          2021/10/6 0:00:00


2.msf后渗透模块
(1)先尝试自动getsystem命令提权
(2）
输入命令shell进入目标机CMD命令行，再利用systeminfo命令或者通过查询 c:\windows\ 里留下的补丁号.log来看看目标机大概打了哪些补丁

使用 wesng工具查看缺失补丁或者使用以下两个网站
https://github.com/bitsadmin/wesng

systeminfo > systeminfo.txt  #把信息文件放到目录下 
python wes.py --update  #更新
python wes.py systeminfo.txt #检测缺少补丁

[-] Missing patches: 22
    - KB: patches 2586 vulnerabilities
    - KB5099539: patches 314 vulnerabilities
    - KB5101006: patches 17 vulnerabilities
    - KB5101000: patches 17 vulnerabilities
    - KB5027537: patches 12 vulnerabilities
    - KB5030179: patches 10 vulnerabilities
    - KB5034274: patches 9 vulnerabilities
    - KB5082419: patches 8 vulnerabilities
    - KBUpdate Information: patches 6 vulnerabilities
    - KB5012170: patches 6 vulnerabilities
    - KB5032338: patches 4 vulnerabilities
    - KB5044090: patches 4 vulnerabilities
    - KB5082426: patches 4 vulnerabilities
    - KB5037035: patches 2 vulnerabilities
    - KB5041018: patches 2 vulnerabilities
    - KB5050416: patches 2 vulnerabilities
    - KB5066746: patches 2 vulnerabilities
    - KB5087064: patches 2 vulnerabilities
    - KB5012117: patches 1 vulnerability
    - KBRelease Notes: patches 1 vulnerability
    - KB5046400: patches 1 vulnerability
    - KB5087053: patches 1 vulnerability
[I] KB with the most recent release date
    - ID: KB5099539
    - Release date: 20260902
[+] Done. Displaying 3011 of the 3011 vulnerabilities found.


python wes.py systeminfo.txt --impact "Remote Code Execution" 
#仅显示一定影响的脆弱性

Date: 20260721
CVE: CVE-2026-58640
KB: KB
Title: Windows NTFS Remote Code Execution Vulnerability
Affected product: Windows 10 Version 21H2 for x64-based Systems
Affected component: Windows NTFS
Severity: Important
Impact: Remote Code Execution
Exploit: n/a

[-] Missing patches: 10
    - KB: patches 591 vulnerabilities
    - KB5099539: patches 61 vulnerabilities
    - KB5030179: patches 10 vulnerabilities
    - KBUpdate Information: patches 6 vulnerabilities
    - KB5027537: patches 6 vulnerabilities
    - KB5037035: patches 2 vulnerabilities
    - KB5050416: patches 2 vulnerabilities
    - KB5101006: patches 2 vulnerabilities
    - KB5101000: patches 2 vulnerabilities
    - KBRelease Notes: patches 1 vulnerability
[I] KB with the most recent release date
    - ID: KB
    - Release date: 20260820
[+] Done. Displaying 683 of the 3011 vulnerabilities found.

#结果输出到文件中
python wes.py systeminfo.txt --impact "Remote Code Execution" -e -o rce.txt

"DatePosted","CVE","BulletinKB","Title","AffectedProduct","AffectedComponent","Severity","Impact","Exploits"
"20230613","CVE-2021-34527","","Windows Print Spooler Remote Code Execution Vulnerability","Windows 10 Version 21H2 for x64-based Systems","Windows Print Spooler Components","Critical","Remote Code Execution"," http://packetstormsecurity.com/files/167261/Print-Spooler-Remote-DLL-Injection.html ,  https://www.vicarius.io/vsociety/posts/cve-2021-34527-printnightmare-detection-script , https://www.vicarius.io/vsociety/posts/cve-2021-34527-printnightmare-mitigation-script"
"20220112","CVE-2022-21907","","HTTP Protocol Stack Remote Code Execution Vulnerability","Windows 10 Version 21H2 for x64-based Systems","Windows HTTP Protocol Stack","Critical","Remote Code Execution","https://exploit-db.com/exploits/51575"
"20220614","CVE-2022-30190","","Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability","Windows 10 Version 21H2 for x64-based Systems","Microsoft Windows Support Diagnostic Tool (MSDT)","Important","Remote Code Execution","http://packetstormsecurity.com/files/167438/Microsoft-Office-Word-MSDTJS-Code-Execution.html"
"20250311","CVE-2025-24985","","Windows Fast FAT File System Driver Remote Code Execution Vulnerability","Windows 10 Version 21H2 for x64-based Systems","Windows Fast FAT Driver","Important","Remote Code Execution","https://www.vicarius.io/vsociety/posts/cve-2025-24985-integer-overflow-vulnerability-in-microsoft-windows-fast-fat-driver-detection-script"
"20250513","CVE-2025-30397","","Scripting Engine Memory Corruption Vulnerability","Windows 10 Version 21H2 for x64-based Systems","Microsoft Scripting Engine","Important","Remote Code Execution"," https://www.vicarius.io/vsociety/posts/cve-2025-30397-type-confusion-vulnerability-in-microsoft-scripting-engine-detection-script , https://exploit-db.com/exploits/52315"
"20250619","CVE-2025-33053","","Internet Shortcut Files Remote Code Execution Vulnerability","Windows 10 Version 21H2 for x64-based Systems","Internet Shortcut Files","Important","Remote Code Execution"," https://research.checkpoint.com/2025/stealth-falcon-zero-day/ ,  https://www.vicarius.io/vsociety/posts/cve-2025-33053-detection-script-remote-code-execution-vulnerability-in-microsoft-webdav , https://www.vicarius.io/vsociety/posts/cve-2025-33053-mitigation-script-remote-code-execution-vulnerability-in-microsoft-webdav"
"20250708","CVE-2025-47981","","SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability","Windows 10 Version 21H2 for x64-based Systems","Windows SPNEGO Extended Negotiation","Critical","Remote Code Execution"," https://www.vicarius.io/vsociety/posts/cve-2025-47981-detection-script-heap-based-buffer-overflow-in-windows-spnego-extended-negotiation , https://www.vicarius.io/vsociety/posts/cve-2025-47981-mitigation-script-heap-based-buffer-overflow-in-windows-spnego-extended-negotiation"
"20260210","CVE-2026-21248","","Windows Hyper-V Remote Code Execution Vulnerability","Windows 10 Version 21H2 for x64-based Systems","Role: Windows Hyper-V","Important","Remote Code Execution","https://exploit-db.com/exploits/52537"
"20260210","CVE-2026-21244","","Windows Hyper-V Remote Code Execution Vulnerability","Windows 10 Version 21H2 for x64-based Systems","Role: Windows Hyper-V","Important","Remote Code Execution","https://exploit-db.com/exploits/52537"




安全焦点，其BugTraq是一个出色的漏洞和exploit数据源，可以通过CVE编号，或者产品信息漏洞直接搜索。网址： http://www.securityfocus.com/bid 。
Exploit-DB,取代了老牌安全网站milw0rm。不断更新大量的Exploit程序和报告，它的搜索功能可以搜索整个网站内容。网址： http://www.exploit-db.com 。

linux提权

https://github.com/Getshell/LinuxTQ

mysql udf提权

https://github.com/DeepFK-ai/Databasetools

MySQL UDF (User Defined Function，用户自定义函数) 提权，是攻击者在获取到高权限MySQL账号（如root）后，利用MySQL的“自定义函数”功能，将普通的数据库用户权限提升为操作系统系统级权限的一种常见攻击手段。

它的核心就像让数据库去执行一个它本不该执行的操作系统命令。

🔍 提权原理与核心条件
核心原理：MySQL允许用户通过.dll（Windows）或.so（Linux）文件创建自定义函数来扩展功能。攻击者会编译一个包含恶意代码（如执行系统命令）的UDF库文件，将其放入MySQL的指定插件目录，并通过CREATE FUNCTION语句创建一个指向该恶意库中特定函数的映射。此后，在SQL中调用这个自定义函数（如sys_eval('whoami')），就等于在目标操作系统上以SYSTEM或root权限执行了该命令。

关键前提条件：

拥有一个高权限的MySQL账号：通常是root，且拥有INSERT和DELETE权限，以便能操作mysql.func系统表。

MySQL服务未降权：MySQL服务进程本身需要以高权限（如SYSTEM或root）运行，否则即使提权成功，获得的权限也有限。

能向插件目录写入文件：主要依赖MySQL的SELECT ... INTO DUMPFILE语句。这要求全局变量secure_file_priv的值为空（即不限制导入导出路径）

mysql mof提权

MySQL MOF提权是一种利用Windows系统特性，将数据库控制权转化为操作系统SYSTEM权限的攻击技术。它的核心思路是，利用已获取的MySQL高权限，向Windows系统的MOF（托管对象格式）目录写入一个精心构造的文件，该文件会被系统自身定期以最高权限执行，从而完成提权。

不过，需要先说明的是：这是一种非常古老的提权手段，在目前绝大多数现代Windows系统（如Windows 7/10/11/Server 2008+）上已基本失效，仅针对Windows 2003及更早的特定版本才有效

mysql启动项提权

MySQL启动项提权的核心逻辑是：利用高权限的MySQL账户，将一个能执行恶意命令的脚本文件，写入到Windows系统开机时会自动执行的目录中。

当服务器重启或用户下一次登录时，这个恶意脚本就会以系统权限运行，从而实现提权。它和UDF、MOF提权并列为MySQL的几种经典提权方式。

🔍 原理与关键条件
核心原理：在Windows系统中，启动文件夹里的程序会在用户登录时自动运行。攻击者通过MySQL的SELECT ... INTO DUMPFILE等语句，将一段VBS或BAT脚本写入启动目录。待系统重启或用户下次登录，脚本便会执行，比如创建一个新的管理员用户。

苛刻的先决条件：这个方法的成功依赖于以下几个条件，使其在现代高版本Windows系统中非常难以实现：

MySQL高权限：拥有root或具备FILE权限的数据库账户。

MySQL配置允许：全局变量secure_file_priv必须为空，否则无法向启动目录写入文件。

操作系统版本：目标系统通常是Windows 2000、XP或2003等旧版本。在现代Windows系统（如Win7/10/11/Server 2008+）上，由于权限控制严格，此方法成功率极低。

文件夹权限：运行MySQL的账户对启动目录（如C:\Documents and Settings\All Users\「开始」菜单\程序\启动）有写入权限