However, when the machine key is set, the program will execute for ANY user that logs on under the context of that user. This means we cannot abuse this to get a shell as a different user. If the keys for the current user are set to execute a program on login, the startup key will only execute when that specific user logs on. The values for these keys can be set under the context of the current user or they can be set for the machine. Alternatively, an administrator can set any program of their choosing to autostart by making a custom value in one of these keys.

Finally, we will see how weak folder permissions can lead to privilege escalation by replacing the original executable for the program with a malicious one.Ĭertain programs that get downloaded will by default create a value in one of the startup registry keys, allowing the program to automatically start when either a specific user logs on or when any user logs. From there we will find that the startup key points to a program in a folder that we have permission to write in. We will see how we can enumerate the startup registry keys using manual techniques as well as tools. In this post, we will explore one such case regarding the autorun startup registry keys. When it comes to Windows Privilege Escalation techniques, we often find that the escalation path has to do with weak file / folder permissions. Want to stay up to date with the latest hacks?.Setting up the Exploit and Getting an Administrator Shell.Crafting a Malicious Executable to Replace the Original Program.Enumerating File and Folder Permissions on the Program.Startup Registry Key Enumeration: Tools.Startup Registry Key Enumeration: Manual Enumeration.Startup Registry Keys Enumeration: Autoruns.exe (GUI).Enumerating Machine Autorun Startup Registry Keys.