A collection of Beacon Object Files (BOFs) for Windows Local Privilege Escalation Checks.
PrivKit is an open-source tool that empowers red teamers and penetration testers to quickly identify common Windows local privilege escalation vectors using Cobalt Strike Beacon Object Files (BOFs).
For command-line usage and examples, please refer to the Usage section.
If you find any bugs, don't hesitate to report them. Your feedback is valuable in improving the quality of this project!
The authors and contributors of this project are not liable for any illegal use of the tool. It is intended for educational and authorized security testing purposes only. Users are responsible for ensuring lawful usage.
Speacial thanks to my friend @nickvourd for all his contributions.
Special thanks to the TrustedSec team for their excellent CS-Situational-Awareness-BOF project, which served as an inspiration for this tool.
Grateful acknowledgment to the Cobalt Strike team for their comprehensive BOF documentation and examples.
PrivKit was created with ❤️ by @merterpreter.
PrivKit offers a comprehensive suite of privilege escalation checks, including:
| Check | Description |
|---|---|
| AlwaysInstallElevatedCheck | Checks for AlwaysInstallElevated misconfiguration in HKCU and HKLM |
| AutologonCheck | Enumerates stored Autologon credentials in Winlogon registry |
| CredentialManagerCheck | Dumps credentials from Windows Credential Manager |
| HijackablePathCheck | Identifies writable directories in system PATH |
| ModifiableAutorunCheck | Finds writable autorun executables in Run/RunOnce keys |
| ModifiableSVCCheck | Finds services with modifiable permissions (DACL) |
| TokenPrivilegesCheck | Enumerates current process token privileges |
| UnquotedSVCPathCheck | Detects unquoted service paths with spaces |
| PowerShellHistoryCheck | Checks for PowerShell PSReadLine history file |
| UACStatusCheck | Checks UAC status, integrity level, and admin group membership |
- ✅ In-memory execution - No files dropped to disk
- ✅ Lightweight - Minimal beacon footprint
- ✅ Fast - Native execution speed
- ✅ Stealthy - Runs within beacon's process context
- ✅ Cross-architecture - Supports both x64 and x86
PrivKit is written in C and compiled as Beacon Object Files, making it compatible with Cobalt Strike 4.x on Windows targets.
ℹ️ For Linux platforms (Ubuntu/Debian) install the following package:
sudo apt update && sudo apt install mingw-w64 -y
ℹ️ For MacOS platforms install the following package:
brew install mingw-w64
- Clone the repository by executing the following command:
git clone https://github.com/mertdas/PrivKit.git
- Once the repository is cloned, navigate into the PrivKit directory:
cd PrivKit
- Use the
make_all.shscript compiles all BOFs for both x64 and x86 architectures:
./make_all.sh
- Load the aggressor script in Cobalt Strike:
Cobalt Strike -> Script Manager -> Load -> PrivCheck.cna
- Verify installation in beacon:
beacon> help
Execute all privilege escalation checks at once:
beacon> PrivCheck
Run specific checks as needed:
beacon> AlwaysInstallElevatedCheck
beacon> AutologonCheck
beacon> CredentialManagerCheck
beacon> HijackablePathCheck
beacon> ModifiableAutorunCheck
beacon> ModifiableSVCCheck
beacon> TokenPrivilegesCheck
beacon> UnquotedSVCPathCheck
beacon> PowerShellHistoryCheck
beacon> UACStatusCheck
beacon> AlwaysInstallElevatedCheck
[*] BOF by @merterpreter && @nickvourd
[*] Checking AlwaysInstallElevated privilege escalation vulnerability...
=== AlwaysInstallElevated Check ===
[*] HKCU\...\Installer\AlwaysInstallElevated = 1
[*] HKLM\...\Installer\AlwaysInstallElevated = 1
[+] VULNERABLE: AlwaysInstallElevated is set in both HKCU and HKLM
beacon> UACStatusCheck
[*] BOF by @merterpreter && @nickvourd
[*] Checking UAC status, integrity level, and admin membership...
=== UAC Status Check ===
[11/27 15:08:08] [+] received output:
[*] UAC Enabled (EnableLUA): Yes
[11/27 15:08:08] [+] received output:
[*] ConsentPromptBehaviorAdmin: 5
[11/27 15:08:08] [+] received output:
(Prompt for consent for non-Windows binaries)
[11/27 15:08:08] [+] received output:
[*] PromptOnSecureDesktop: Yes
[11/27 15:08:08] [+] received output:
[11/27 15:08:08] [+] received output:
[*] Integrity Level:
[11/27 15:08:08] [+] received output:
Medium
[11/27 15:08:08] [+] received output:
[*] Local Admin Group Member: Yes
[11/27 15:08:08] [+] received output:
[*] Summary:
[11/27 15:08:08] [+] received output:
[+] User is local admin but NOT elevated (UAC filtered token)
[11/27 15:08:08] [+] received output:
[+] UAC bypass may be possible
- Cobalt Strike BOF Documentation
- TrustedSec CS-Situational-Awareness-BOF
- TrustedSec CS-Remote-OPs-BOF
- Windows-Local-Privilege-Escalation-Cookbook GitHub by nickvourd
- Windows Privilege Escalation - PayloadsAllTheThings
- WIN32 APIs Microsoft Documentation
- Offensive Coding by Mr.Un1k0der
- Sektor7 Institute
