// HackTricks · CC BY-NC 4.0

Windows

108 pages · adapted from upstream with source attribution on every page.

001 WindowsAbusing Active Directory ACLs/ACEs acl-persistence-abuse 002 WindowsAbusing Enterprise Auto-Updaters and Privileged IPC (e.g., Netskope, ASUS & MSI) windows-local-privilege-escalation 003 WindowsAbusing Tokens windows-local-privilege-escalation 004 WindowsAccess Tokens windows-local-privilege-escalation 005 WindowsACLs - DACLs/SACLs/ACEs windows-local-privilege-escalation 006 WindowsActive Directory Methodology active-directory-methodology 007 WindowsActive Directory Web Services (ADWS) Enumeration & Stealth Collection active-directory-methodology 008 WindowsAD Certificates active-directory-methodology 009 WindowsAD Certificates ad-certificates 010 WindowsAD CS Account Persistence ad-certificates 011 WindowsAD CS Certificate Theft ad-certificates 012 WindowsAD CS Domain Escalation ad-certificates 013 WindowsAD CS Domain Persistence ad-certificates 014 WindowsAD DNS Records active-directory-methodology 015 WindowsAD Dynamic Objects (dynamicObject) Anti-Forensics active-directory-methodology 016 WindowsAdmin Protection Bypasses via UIAccess windows-local-privilege-escalation 017 WindowsAdvanced DLL Side-Loading With HTML-Embedded Payload Staging dll-hijacking 018 WindowsAntivirus (AV) Bypass windows-hardening 019 WindowsAppendData/AddSubdirectory Permission over Service Registry windows-local-privilege-escalation 020 WindowsASREPRoast active-directory-methodology 021 WindowsAtExec / SchtasksExec lateral-movement 022 WindowsBadSuccessor acl-persistence-abuse 023 WindowsBadSuccessor: Privilege Escalation via Delegated MSA Migration Abuse active-directory-methodology 024 WindowsBasic PowerShell for Pentesters basic-powershell-for-pentesters 025 WindowsBasic Win CMD for Pentesters windows-hardening 026 WindowsBloodHound & Other Active Directory Enumeration Tools active-directory-methodology 027 WindowsChecklist - Local Windows Privilege Escalation windows-hardening 028 WindowsCobalt Strike windows-hardening 029 WindowsCOM Hijacking windows-local-privilege-escalation 030 WindowsConstrained Delegation active-directory-methodology 031 WindowsCreating a Custom-Action MSI with WiX windows-local-privilege-escalation 032 WindowsCustom Security Support Providers active-directory-methodology 033 WindowsDCOM Exec lateral-movement 034 WindowsDCShadow active-directory-methodology 035 WindowsDCSync active-directory-methodology 036 WindowsDiamond Ticket active-directory-methodology 037 WindowsDLL Hijacking dll-hijacking 038 WindowsDPAPI - Extracting Passwords windows-local-privilege-escalation 039 WindowsDSRM Credentials active-directory-methodology 040 WindowsExternal Forest Domain - One-Way (Outbound) active-directory-methodology 041 WindowsExternal Forest Domain - OneWay (Inbound) or bidirectional active-directory-methodology 042 WindowsForce NTLM Privileged Authentication active-directory-methodology 043 WindowsFrom High Integrity to SYSTEM with Name Pipes windows-local-privilege-escalation 044 WindowsGolden gMSA/dMSA Attack (Offline Derivation of Managed Service Account Passwords) active-directory-methodology 045 WindowsGolden Ticket active-directory-methodology 046 WindowsInformation in Printers active-directory-methodology 047 WindowsIntegrity Levels windows-local-privilege-escalation 048 WindowsJuicyPotato windows-local-privilege-escalation 049 WindowsKerberoast active-directory-methodology 050 WindowsKerberos Authentication active-directory-methodology 051 WindowsKerberos Double Hop Problem active-directory-methodology 052 WindowsKernel Race Condition Exploitation via Object Manager Slow Paths windows-local-privilege-escalation 053 WindowsLansweeper Abuse: Credential Harvesting, Secrets Decryption, and Deployment RCE active-directory-methodology 054 WindowsLAPS active-directory-methodology 055 WindowsLateral Movement lateral-movement 056 WindowsLDAP Signing & Channel Binding Hardening active-directory-methodology 057 WindowsLeaked Handle Exploitation windows-local-privilege-escalation 058 WindowsLocal NTLM Reflection via SMB Arbitrary Port windows-local-privilege-escalation 059 WindowsMimikatz stealing-credentials 060 WindowsMSI Wrapper windows-local-privilege-escalation 061 WindowsMSSQL AD Abuse active-directory-methodology 062 WindowsMythic windows-hardening 063 WindowsNamed Pipe Client Impersonation windows-local-privilege-escalation 064 WindowsNotepad++ Plugin Autoload Persistence & Execution windows-local-privilege-escalation 065 WindowsNTLM ntlm 066 WindowsOver Pass the Hash/Pass the Key active-directory-methodology 067 WindowsPass the Ticket active-directory-methodology 068 WindowsPassword Spraying / Brute Force active-directory-methodology 069 WindowsPlaces to steal NTLM creds ntlm 070 WindowsPowerView/SharpView basic-powershell-for-pentesters 071 WindowsPrintNightmare (Windows Print Spooler RCE/LPE) active-directory-methodology 072 WindowsPrivilege Escalation with Autoruns windows-local-privilege-escalation 073 WindowsPrivileged Groups active-directory-methodology 074 WindowsPsExec/Winexec/ScExec/SMBExec lateral-movement 075 WindowsRDP Sessions Abuse active-directory-methodology 076 WindowsRDPexec lateral-movement 077 WindowsResource-based Constrained Delegation active-directory-methodology 078 WindowsRoguePotato, PrintSpoofer, SharpEfsPotato, GodPotato windows-local-privilege-escalation 079 WindowsSCCM Management Point NTLM Relay to SQL – OSD Policy Secret Extraction active-directory-methodology 080 WindowsSCMExec lateral-movement 081 WindowsSecure Desktop Accessibility Registry Propagation LPE (RegPwn) windows-local-privilege-escalation 082 WindowsSecurity Descriptors active-directory-methodology 083 WindowsSeDebug + SeImpersonate - Copy Token windows-local-privilege-escalation 084 WindowsSeImpersonate from High To System windows-local-privilege-escalation 085 WindowsSeManageVolumePrivilege: Volume-maintenance abuse and raw-access validation windows-local-privilege-escalation 086 WindowsShadow Credentials acl-persistence-abuse 087 WindowsSID-History Injection active-directory-methodology 088 WindowsSilver Ticket active-directory-methodology 089 WindowsSkeleton Key active-directory-methodology 090 WindowsStealing Windows Credentials stealing-credentials 091 WindowsTelephony tapsrv Arbitrary DWORD Write to RCE (TAPI Server Mode) windows-local-privilege-escalation 092 WindowsTimeRoasting active-directory-methodology 093 WindowsUAC - User Account Control authentication-credentials-uac-and-efs 094 WindowsUnconstrained Delegation active-directory-methodology 095 WindowsWindows C Payloads windows-local-privilege-escalation 096 WindowsWindows CPython Build-Landmark and sys.path Hijacking dll-hijacking 097 WindowsWindows Credentials Protections stealing-credentials 098 WindowsWindows kernel EoP: Token stealing with arbitrary kernel R/W windows-local-privilege-escalation 099 WindowsWindows Local Privilege Escalation windows-local-privilege-escalation 100 WindowsWindows Protocol Handler / ShellExecute Abuse (Markdown Renderers) windows-hardening 101 WindowsWindows Registry Hive Exploitation Primitives windows-local-privilege-escalation 102 WindowsWindows Security Controls windows-hardening 103 WindowsWindows Security Controls authentication-credentials-uac-and-efs 104 WindowsWindows Service Triggers: Enumeration and Abuse windows-local-privilege-escalation 105 WindowsWinRM lateral-movement 106 WindowsWmiExec lateral-movement 107 WindowsWritable Sys Path +Dll Hijacking Privesc dll-hijacking 108 WindowsWTS Impersonator stealing-credentials

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Choose your decrypted JSON once to save access:

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.