// HackTricks · CC BY-NC 4.0
Windows
108 pages · adapted from upstream with source attribution on every page.
001 Windows Abusing Active Directory ACLs/ACEs acl-persistence-abuse 002 Windows Abusing Enterprise Auto-Updaters and Privileged IPC (e.g., Netskope, ASUS & MSI) windows-local-privilege-escalation 003 Windows Abusing Tokens windows-local-privilege-escalation 004 Windows Access Tokens windows-local-privilege-escalation 005 Windows ACLs - DACLs/SACLs/ACEs windows-local-privilege-escalation 006 Windows Active Directory Methodology active-directory-methodology 007 Windows Active Directory Web Services (ADWS) Enumeration & Stealth Collection active-directory-methodology 008 Windows AD Certificates active-directory-methodology 009 Windows AD Certificates ad-certificates 010 Windows AD CS Account Persistence ad-certificates 011 Windows AD CS Certificate Theft ad-certificates 012 Windows AD CS Domain Escalation ad-certificates 013 Windows AD CS Domain Persistence ad-certificates 014 Windows AD DNS Records active-directory-methodology 015 Windows AD Dynamic Objects (dynamicObject) Anti-Forensics active-directory-methodology 016 Windows Admin Protection Bypasses via UIAccess windows-local-privilege-escalation 017 Windows Advanced DLL Side-Loading With HTML-Embedded Payload Staging dll-hijacking 018 Windows Antivirus (AV) Bypass windows-hardening 019 Windows AppendData/AddSubdirectory Permission over Service Registry windows-local-privilege-escalation 020 Windows ASREPRoast active-directory-methodology 021 Windows AtExec / SchtasksExec lateral-movement 022 Windows BadSuccessor acl-persistence-abuse 023 Windows BadSuccessor: Privilege Escalation via Delegated MSA Migration Abuse active-directory-methodology 024 Windows Basic PowerShell for Pentesters basic-powershell-for-pentesters 025 Windows Basic Win CMD for Pentesters windows-hardening 026 Windows BloodHound & Other Active Directory Enumeration Tools active-directory-methodology 027 Windows Checklist - Local Windows Privilege Escalation windows-hardening 028 Windows Cobalt Strike windows-hardening 029 Windows COM Hijacking windows-local-privilege-escalation 030 Windows Constrained Delegation active-directory-methodology 031 Windows Creating a Custom-Action MSI with WiX windows-local-privilege-escalation 032 Windows Custom Security Support Providers active-directory-methodology 033 Windows DCOM Exec lateral-movement 034 Windows DCShadow active-directory-methodology 035 Windows DCSync active-directory-methodology 036 Windows Diamond Ticket active-directory-methodology 037 Windows DLL Hijacking dll-hijacking 038 Windows DPAPI - Extracting Passwords windows-local-privilege-escalation 039 Windows DSRM Credentials active-directory-methodology 040 Windows External Forest Domain - One-Way (Outbound) active-directory-methodology 041 Windows External Forest Domain - OneWay (Inbound) or bidirectional active-directory-methodology 042 Windows Force NTLM Privileged Authentication active-directory-methodology 043 Windows From High Integrity to SYSTEM with Name Pipes windows-local-privilege-escalation 044 Windows Golden gMSA/dMSA Attack (Offline Derivation of Managed Service Account Passwords) active-directory-methodology 045 Windows Golden Ticket active-directory-methodology 046 Windows Information in Printers active-directory-methodology 047 Windows Integrity Levels windows-local-privilege-escalation 048 Windows JuicyPotato windows-local-privilege-escalation 049 Windows Kerberoast active-directory-methodology 050 Windows Kerberos Authentication active-directory-methodology 051 Windows Kerberos Double Hop Problem active-directory-methodology 052 Windows Kernel Race Condition Exploitation via Object Manager Slow Paths windows-local-privilege-escalation 053 Windows Lansweeper Abuse: Credential Harvesting, Secrets Decryption, and Deployment RCE active-directory-methodology 054 Windows LAPS active-directory-methodology 055 Windows Lateral Movement lateral-movement 056 Windows LDAP Signing & Channel Binding Hardening active-directory-methodology 057 Windows Leaked Handle Exploitation windows-local-privilege-escalation 058 Windows Local NTLM Reflection via SMB Arbitrary Port windows-local-privilege-escalation 059 Windows Mimikatz stealing-credentials 060 Windows MSI Wrapper windows-local-privilege-escalation 061 Windows MSSQL AD Abuse active-directory-methodology 062 Windows Mythic windows-hardening 063 Windows Named Pipe Client Impersonation windows-local-privilege-escalation 064 Windows Notepad++ Plugin Autoload Persistence & Execution windows-local-privilege-escalation 065 Windows NTLM ntlm 066 Windows Over Pass the Hash/Pass the Key active-directory-methodology 067 Windows Pass the Ticket active-directory-methodology 068 Windows Password Spraying / Brute Force active-directory-methodology 069 Windows Places to steal NTLM creds ntlm 070 Windows PowerView/SharpView basic-powershell-for-pentesters 071 Windows PrintNightmare (Windows Print Spooler RCE/LPE) active-directory-methodology 072 Windows Privilege Escalation with Autoruns windows-local-privilege-escalation 073 Windows Privileged Groups active-directory-methodology 074 Windows PsExec/Winexec/ScExec/SMBExec lateral-movement 075 Windows RDP Sessions Abuse active-directory-methodology 076 Windows RDPexec lateral-movement 077 Windows Resource-based Constrained Delegation active-directory-methodology 078 Windows RoguePotato, PrintSpoofer, SharpEfsPotato, GodPotato windows-local-privilege-escalation 079 Windows SCCM Management Point NTLM Relay to SQL – OSD Policy Secret Extraction active-directory-methodology 080 Windows SCMExec lateral-movement 081 Windows Secure Desktop Accessibility Registry Propagation LPE (RegPwn) windows-local-privilege-escalation 082 Windows Security Descriptors active-directory-methodology 083 Windows SeDebug + SeImpersonate - Copy Token windows-local-privilege-escalation 084 Windows SeImpersonate from High To System windows-local-privilege-escalation 085 Windows SeManageVolumePrivilege: Volume-maintenance abuse and raw-access validation windows-local-privilege-escalation 086 Windows Shadow Credentials acl-persistence-abuse 087 Windows SID-History Injection active-directory-methodology 088 Windows Silver Ticket active-directory-methodology 089 Windows Skeleton Key active-directory-methodology 090 Windows Stealing Windows Credentials stealing-credentials 091 Windows Telephony tapsrv Arbitrary DWORD Write to RCE (TAPI Server Mode) windows-local-privilege-escalation 092 Windows TimeRoasting active-directory-methodology 093 Windows UAC - User Account Control authentication-credentials-uac-and-efs 094 Windows Unconstrained Delegation active-directory-methodology 095 Windows Windows C Payloads windows-local-privilege-escalation 096 Windows Windows CPython Build-Landmark and sys.path Hijacking dll-hijacking 097 Windows Windows Credentials Protections stealing-credentials 098 Windows Windows kernel EoP: Token stealing with arbitrary kernel R/W windows-local-privilege-escalation 099 Windows Windows Local Privilege Escalation windows-local-privilege-escalation 100 Windows Windows Protocol Handler / ShellExecute Abuse (Markdown Renderers) windows-hardening 101 Windows Windows Registry Hive Exploitation Primitives windows-local-privilege-escalation 102 Windows Windows Security Controls windows-hardening 103 Windows Windows Security Controls authentication-credentials-uac-and-efs 104 Windows Windows Service Triggers: Enumeration and Abuse windows-local-privilege-escalation 105 Windows WinRM lateral-movement 106 Windows WmiExec lateral-movement 107 Windows Writable Sys Path +Dll Hijacking Privesc dll-hijacking 108 Windows WTS Impersonator stealing-credentials