https://souljian.cn/tags/windows%E6%8F%90%E6%9D%83/Recent content in Windows提权 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088174/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088174/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>Windows 提权只在授权测试环境进行。</p> <h2 id="一windows-提权决策树">一、Windows 提权决策树 </h2><img src="https://souljian.cn/img/windows-privilege-escalation.svg" alt="Windows 提权决策树" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">普通用户 → SYSTEM 的 5 条路径： </span></span><span class="line"><span class="cl">① 内核漏洞 → ② 服务配置错误 → ③ 计划任务 → ④ AlwaysInstallElevated → ⑤ Token 操纵 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二常用工具">二、常用工具 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># winPEAS</span> </span></span><span class="line"><span class="cl">winPEAS.bat → 自动检测所有提权路径 </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># PowerUp</span> </span></span><span class="line"><span class="cl">Get-ServiceUnquoted · Get-ModifiableServiceFile </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御加固">三、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">及时打补丁 · 最小权限原则 </span></span><span class="line"><span class="cl">禁止 AlwaysInstallElevated </span></span><span class="line"><span class="cl">审计服务配置 · 监控异常操作 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>Windows 提权的核心是<strong>发现配置错误</strong>。winPEAS + PowerUp 自动检测可覆盖 90% 的提权路径。</p>