# PrivKit | Simple Beacon Object File That Detects Privilege Escalation Vulnerabilities Caused By Misconfigurations On Windows OS

**URL:** <https://onehack.st/t/privkit-simple-beacon-object-file-that-detects-privilege-escalation-vulnerabilities-caused-by-misconfigurations-on-windows-os/252563>\
**Category:** Tools & Scripts\
**Tags:** programming, hacking, windows, hosting\
**Created:** [August 3, 2023, 9:15pm UTC](https://onehack.st/t/privkit-simple-beacon-object-file-that-detects-privilege-escalation-vulnerabilities-caused-by-misconfigurations-on-windows-os/252563 "2023-08-03T21:15:56Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![NoBody](https://onehack.st/user_avatar/onehack.st/nobody/32/163880_2.png) [@NoBody](https://onehack.st/u/NoBody)\
**Post date:** [August 3, 2023, 9:15pm UTC](https://onehack.st/t/privkit-simple-beacon-object-file-that-detects-privilege-escalation-vulnerabilities-caused-by-misconfigurations-on-windows-os/252563/1 "2023-08-03T21:15:57Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/7/3/73b85cafb7c77d07b369b898ba8f7e8f8608318b.png)

# PrivKit

PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.

## PrivKit detects following misconfigurations

```auto
 Checks for Unquoted Service Paths
 Checks for Autologon Registry Keys
 Checks for Always Install Elevated Registry Keys
 Checks for Modifiable Autoruns
 Checks for Hijackable Paths
 Enumerates Credentials From Credential Manager
 Looks for current Token Privileges

```

## Usage

```auto
[03/20 00:51:06] beacon> privcheck
[03/20 00:51:06] [*] Priv Esc Check Bof by @merterpreter
[03/20 00:51:06] [*] Checking For Unquoted Service Paths..
[03/20 00:51:06] [*] Checking For Autologon Registry Keys..
[03/20 00:51:06] [*] Checking For Always Install Elevated Registry Keys..
[03/20 00:51:06] [*] Checking For Modifiable Autoruns..
[03/20 00:51:06] [*] Checking For Hijackable Paths..
[03/20 00:51:06] [*] Enumerating Credentials From Credential Manager..
[03/20 00:51:06] [*] Checking For Token Privileges..
[03/20 00:51:06] [+] host called home, sent: 10485 bytes
[03/20 00:51:06] [+] received output:
Unquoted Service Path Check Result: Vulnerable service path found: c:\program files (x86)\grasssoft\macro expert\MacroService.exe

```

Simply load the cna file and type “privcheck”  
If you want to compile by yourself you can use:  
`make all`  
or  
`x86_64-w64-mingw32-gcc -c cfile.c -o ofile.o`

If you want to look for just one misconf you can use object file with “inline-execute” for example  
` inline-execute /path/tokenprivileges.o`

[![privcheck1](https://user-images.githubusercontent.com/48562581/226249192-84da03d5-435a-4da0-a6e6-4c451d2403e4.PNG)](https://user-images.githubusercontent.com/48562581/226249192-84da03d5-435a-4da0-a6e6-4c451d2403e4.PNG)

[![privcheck2](https://user-images.githubusercontent.com/48562581/226249135-a2444998-8c4f-4783-9b60-726c887032e4.PNG)](https://user-images.githubusercontent.com/48562581/226249135-a2444998-8c4f-4783-9b60-726c887032e4.PNG)

## Acknowledgement

Mr.Un1K0d3r - Offensive Coding Portal

> **[Mr.Un1k0d3r Offensive Coding Class](https://mr.un1k0d3r.world/portal/)**
>
> Red Team Offensive Coding Class

Outflank - C2-Tool-Collection

> **[GitHub - outflanknl/C2-Tool-Collection: A collection of tools which integrate with Cobalt...](https://github.com/outflanknl/C2-Tool-Collection)**
>
> A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.

dtmsecurity - Beacon Object File (BOF) Creation Helper

> **[GitHub - dtmsecurity/bof\_helper: Beacon Object File (BOF) Creation Helper](https://github.com/dtmsecurity/bof_helper)**
>
> Beacon Object File (BOF) Creation Helper

Microsoft 🙂

> **[Programming reference for the Win32 API - Win32 apps](https://learn.microsoft.com/en-us/windows/win32/api/)**
>
> This section provides the Win32 API reference documentation organized by technology areas and header.

HsTechDocs by HelpSystems(Fortra)

> **[How do I develop a BOF?](https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/beacon-object-files_how-to-develop.htm)**

## GitHub:

[https://github.com/mertdas/PrivKit](https://github.com/mertdas/PrivKit)