offensive-windows-privesc

Windows Privilege Escalation

You have a standard user shell on a Windows target. Your objective is to escalate to NT AUTHORITY\SYSTEM or local Administrator through systematic enumeration and exploitation of misconfigurations, vulnerable services, and unpatched software. This skill provides a structured methodology that moves from passive reconnaissance through increasingly aggressive techniques.

Windows privilege escalation differs fundamentally from Linux. The attack surface centers on services, tokens, the registry, DLL loading mechanics, and the Windows access control model. Master these primitives and you can chain findings from any enumeration tool into a working escalation path.

Quick Workflow

1. Run automated enumeration (WinPEAS, PowerUp, Seatbelt) to surface misconfigurations.
2. Check current privileges -- SeImpersonate/SeAssignPrimaryToken are immediate wins.
3. Enumerate services for unquoted paths, weak DACLs, and writable binaries.
4. Check AlwaysInstallElevated registry keys for MSI-based escalation.
5. Identify DLL hijacking opportunities in privileged processes.
6. Attempt UAC bypass if running as a local admin without elevated context.
7. Inspect scheduled tasks, registry autoruns, and writable PATH directories.
8. Harvest credentials from SAM, DPAPI, LSA secrets, and Credential Manager.
9. Check for PrintNightmare and other unpatched vulnerabilities as a last resort.

---

Automated Enumeration

Run automated tools first to build a comprehensive picture of the attack surface. Review output methodically -- these tools surface findings you would otherwise miss.

# WinPEAS
.\winPEASx64.exe > C:\Users\Public\winpeas.txt 2>&1
.\winPEASx64.exe servicesinfo  # Specific checks only

# PowerUp
Import-Module .\PowerUp.ps1
Invoke-AllChecks | Out-File -FilePath C:\Users\Public\powerup.txt

# SharpUp / Seatbelt / BeRoot
.\SharpUp.exe audit
.\Seatbelt.exe -group=all > C:\Users\Public\seatbelt.txt
.\beRoot.exe

---

Token Impersonation