PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.
PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.
A collection of Beacon Object Files (BOFs) for Windows Local Privilege Escalation Checks.
PrivKit is an open-source tool that empowers red teamers and penetration testers to quickly identify common Windows local privilege escalation vectors using Cobalt Strike Beacon Object Files (BOFs).
For command-line usage and examples, please refer to the Usage section.
If you find any bugs, don't hesitate to report them. Your feedback is valuable in improving the quality of this project!
The authors and contributors of this project are not liable for any illegal use of the tool. It is intended for educational and authorized security testing purposes only. Users are responsible for ensuring lawful usage.
Speacial thanks to my friend @nickvourd for all his contributions.
Special thanks to the TrustedSec team for their excellent CS-Situational-Awareness-BOF project, which served as an inspiration for this tool.
Grateful acknowledgment to the Cobalt Strike team for their comprehensive BOF documentation and examples.
PrivKit was created with :heart: by @merterpreter.
PrivKit offers a comprehensive suite of privilege escalation checks, including:
| Check | Description |
|---|---|
| AlwaysInstallElevatedCheck | Checks for AlwaysInstallElevated misconfiguration in HKCU and HKLM |
| AutologonCheck | Enumerates stored Autologon credentials in Winlogon registry |
| CredentialManagerCheck | Dumps credentials from Windows Credential Manager |
| HijackablePathCheck | Identifies writable directories in system PATH |
| ModifiableAutorunCheck | Finds writable autorun executables in Run/RunOnce keys |
| ModifiableSVCCheck | Finds services with modifiable permissions (DACL) |
| TokenPrivilegesCheck | Enumerates current process token privileges |
| UnquotedSVCPathCheck | Detects unquoted service paths with spaces |
| PowerShellHistoryCheck | Checks for PowerShell PSReadLine history file |
| UACStatusCheck | Checks UAC status, integrity level, and admin group membership |
PrivKit is written in C and compiled as Beacon Object Files, making it compatible with Cobalt Strike 4.x on Windows targets.
⚠️ Please ensure that MinGW-w64 is installed on your system.
ℹ️ For Linux platforms (Ubuntu/Debian) install the following package:
sudo apt update && sudo apt install mingw-w64 -yℹ️ For MacOS platforms install the following package:
brew install mingw-w64git clone https://github.com/mertdas/PrivKit.gitcd PrivKitmake_all.sh script compiles all BOFs for both x64 and x86 architectures:./make_all.shCobalt Strike -> Script Manager -> Load -> PrivCheck.cnabeacon> helpExecute all privilege escalation checks at once:
beacon> PrivCheckRun specific checks as needed:
beacon> AlwaysInstallElevatedCheck
beacon> AutologonCheck
beacon> CredentialManagerCheck
beacon> HijackablePathCheck
beacon> ModifiableAutorunCheck
beacon> ModifiableSVCCheck
beacon> TokenPrivilegesCheck
beacon> UnquotedSVCPathCheck
beacon> PowerShellHistoryCheck
beacon> UACStatusCheckbeacon> AlwaysInstallElevatedCheck
[*] BOF by @merterpreter && @nickvourd
[*] Checking AlwaysInstallElevated privilege escalation vulnerability...
=== AlwaysInstallElevated Check ===
[*] HKCU\...\Installer\AlwaysInstallElevated = 1
[*] HKLM\...\Installer\AlwaysInstallElevated = 1
[+] VULNERABLE: AlwaysInstallElevated is set in both HKCU and HKLM…No open issues yet, or sync has not completed.