srl
Enumerating Attack Vectors (Windows)
Windows privilege escalation is usually a configuration flaw, not a missing patch. The highest-value paths are token-impersonation privileges, weak service ACLs, credential material left on disk, and Active Directory misconfigurations. Kernel exploits exist but are secondary. This file is organized by payoff-per-minute, not by category.
Helpful Tools Miscellaneous Ghostpack Compiled Binaries UACME — UAC bypass techniques Impacket NetCat for Windows Exploit Suggesters winPEAS — broad automated enumeration Seatbelt — C# host-survey tool PowerUp / SharpUp — PowerShell/C# privilege-escalation checks JAWS — PowerShell 2.0 enumeration Watson — missing-KB enumeration WES-NG — Windows Exploit Suggester Next Generation Metasploit — use post/multi/recon/local_exploit_suggester on a backgrounded meterpreter session Credentials and Token Abuse LaZagne — credential recovery from many sources Mimikatz — LSASS dumping, PtH, PtT, golden tickets SessionGopher — saved remote-access session information SharpDPAPI — DPAPI triage and decryption (triage, rdg, credentials, masterkeys, machinetriage) SharpChrome — Chrome credential extraction Current 2026 tooling Tool What it adds Install Certipy AD CS enumeration and exploitation (certipy find -u … -p … -dc-ip … -stdout -vulnerable) — covers ESC1 through ESC17 as of 2026 pip install certipy-ad Certify C# AD CS enumeration — often more reliable in restricted PowerShell environments Ghostpack binaries SharpWSUS Fake-update injection via WSUS to push a signed binary with malicious arguments GitHub: netero1010/SharpWSUS Rubeus Kerberos abuse — unconstrained delegation capture, S4U, ticket extraction Ghostpack binaries FullPowers Recovers the default privilege set on LOCAL SERVICE / NETWORK SERVICE tokens that have been filtered GitHub: itm4n/FullPowers SigmaPotato / PrintNotifyPotato Modern Potato variants with reflection/in-memory execution; the latter abuses PrintNotify COM when the Spooler is disabled GitHub forks Nanodump / lsassy Stealthy LSASS dumping and remote parsing pip install lsassy DonPwner / nxcspray Safe password spraying respecting AD lockout policy pipx install nxc Priority Execution Order — Stop at the First Root-Equivalent Primitive Run this before the detailed sections. Most HTB/OSCP hosts fall in the first four checks.