PrivCheck is a collection of Beacon Object Files (BOFs) designed to detect common privilege escalation paths in Windows OS.
It was originally forked from mertdas/PrivKit, which no longer appears to be updated. PrivCheck fixes multiple bugs from the original project and adds new modules for detecting privilege escalation paths.
PrivCheck currently includes the following modules:
| Module | Description |
|---|---|
alwayselevated |
Checks if Always Install Elevated is enabled using the registry. |
autologon |
Checks the registry for autologon information. The original module contained a bug that prevented it from returning any saved password. |
credman |
Checks the current user's Windows Credential Manager for saved web passwords and returns them. The original module contained a bug that caused it to only return the first character of the saved password. |
hijackablepath |
Checks the path environment variable for writable directories (FILE_ADD_FILE) that can be exploited to elevate privileges. The original module did not work correctly and would simply return the first directory discovered, regardless of permissions. |
tokenpriv |
Lists the current token privileges and highlights known vulnerable ones. |
unattendfiles |
Checks for leftover unattend files that might contain sensitive information (New module). |
unquotedsvc |
Checks for unquoted service paths. This module has been updated to display the vulnerable service name and path. |
vulndrivers |
Checks if any service on the system uses a known vulnerable driver (based on loldrivers.io). The list of vulnerable drivers is downloaded from loldrivers.io during compilation, then baked into the BOF. Recompile periodically to update (New module). |
All modules have been tested with Havoc and Windows 11 x64.
A Havoc module (havoc_privcheck.py) is included to provide easy integration with the Havoc framework. Use help privcheck within Havoc to view usage information.
cdinto the project folder.- Run
make. This usesx86_64-w64-mingw32-gccfor compilation andpython3to retrieve the driver list from loldrivers.io. - All compiled modules are saved in the
outputfolder.