Posts on: Windows

---

Windows privilege escalation is usually a configuration flaw, not a missing patch. The highest-value paths are token-impersonation privileges, weak service ACLs, credential material left on disk, and Active Directory misconfigurations. Kernel exploits exist but are secondary. This file is organized by payoff-per-minute, not by category. Helpful Tools Miscellaneous Ghostpack Compiled Binaries UACME — UAC bypass techniques Impacket NetCat for Windows Exploit Suggesters winPEAS — broad automated enumeration Seatbelt — C# host-survey tool PowerUp / SharpUp — PowerShell/C# privilege-escalation checks JAWS — PowerShell 2.0 enumeration Watson — missing-KB enumeration WES-NG — Windows Exploit Suggester Next Generation Metasploit — use post/multi/recon/local_exploit_suggester on a backgrounded meterpreter session Credentials and Token Abuse LaZagne — credential recovery from many sources Mimikatz — LSASS dumping, PtH, PtT, golden tickets SessionGopher — saved remote-access session information SharpDPAPI — DPAPI triage and decryption (triage, rdg, credentials, masterkeys, machinetriage) SharpChrome — Chrome credential extraction Current 2026 tooling Tool What it adds Install Certipy AD CS enumeration and exploitation (certipy find -u … -p … -dc-ip … -stdout -vulnerable) — covers ESC1 through ESC17 as of 2026 pip install certipy-ad Certify C# AD CS enumeration — often more reliable in restricted PowerShell environments Ghostpack binaries SharpWSUS Fake-update injection via WSUS to push a signed binary with malicious arguments GitHub: netero1010/SharpWSUS Rubeus Kerberos abuse — unconstrained delegation capture, S4U, ticket extraction Ghostpack binaries FullPowers Recovers the default privilege set on LOCAL SERVICE / NETWORK SERVICE tokens that have been filtered GitHub: itm4n/FullPowers SigmaPotato / PrintNotifyPotato Modern Potato variants with reflection/in-memory execution; the latter abuses PrintNotify COM when the Spooler is disabled GitHub forks Nanodump / lsassy Stealthy LSASS dumping and remote parsing pip install lsassy DonPwner / nxcspray Safe password spraying respecting AD lockout policy pipx install nxc Priority Execution Order — Stop at the First Root-Equivalent Primitive Run this before the detailed sections. Most HTB/OSCP hosts fall in the first four checks.

Windows token privileges are the most direct path to SYSTEM on a compromised host. A web shell on an IIS server or a SQL Server xp_cmdshell almost always lands in a context holding SeImpersonatePrivilege — and a single command turns that into NT AUTHORITY\SYSTEM. This file covers each high-value privilege, the tools to abuse it, and the defenses you must bypass on modern Windows (2025–2026). 0. Triage — Which Privilege Do I Have? Run this immediately after landing a shell:

Windows ships with privileged built-in groups whose membership grants powerful rights short of full administrator — and several are a direct path to SYSTEM or Domain Admin. Treat every group below as Tier-0 on a Domain Controller; membership changes should be monitored, and any foothold account that lands in one of them should be treated as a domain-compromise primitive. Triage — Which Group Do I Have? Run this immediately after landing a shell:

Windows services are one of the most common privilege escalation paths because they often run as LocalSystem while pointing to files, service objects, or registry keys that normal users can influence. Three separate misconfigurations can grant SYSTEM, and they are often confused: Attack surface You control Exploitation Primary check Writable binary The .exe on disk Replace the file, restart the service icacls on the binary Modifiable service DACL The service object Change binPath=, restart the service accesschk -uwcqv Writable registry key The service’s registry entry Edit ImagePath, restart the service accesschk -kvuqsw on HKLM\...\Services Key distinction: A writable binary is a file-system problem. A modifiable service DACL is a service-object problem — you do not need write access to the binary’s directory, only permission to reconfigure the service itself.

Internet Information Services (IIS) for Windows Server is a flexible, secure and manageable Web server for hosting anything on the Web. From media streaming to web applications, IIS’s scalable and open architecture is ready to handle the most demanding tasks. 2025–2026 context: IIS remains a live attack surface not because of the web server itself, but because of legacy Windows filesystem features it exposes, misconfigured WebDAV, and the ASP.NET ViewState/machineKey ecosystem. The tilde (8.3 short name) disclosure is still being assigned CVEs in 2025 — CVE-2025-46294 covers FileMaker Server’s implementation, rated CVSS 5.3 (CWE-200) — and the real impact is what those short names reveal: hidden upload endpoints, backup files, and configuration files that standard directory brute-forcing never finds.

Windows services are the highest-yield privilege escalation surface on the platform because they run as LocalSystem while referencing four separate objects that a low-privileged user may be able to influence: Attack surface You control Exploitation Primary check Service binary The .exe on disk Replace the file, restart the service icacls on the binary Loaded DLL A DLL path the service searches Plant a DLL with the expected name Procmon NAME NOT FOUND Service DACL The service object sc config binPath=, restart accesschk -uwcqv Service registry key ImagePath / ServiceDll Edit the value, restart accesschk -kvuqsw Key distinction: A writable binary is a file-system problem. A modifiable service DACL is a service-object problem — you do not need write access to the binary’s directory. A writable registry key is a third, separate problem. Enumerate all four.

Eighteen standalone Windows boxes from the OSCP-like list — one intended path each, the non-obvious step that decides it, and the exact command worth memorising. These are edge-case notes, not walkthroughs: every IP, hostname, port, user and payload path must be adapted to the target, and the linked writeup remains the walkthrough of record. Companion pages: Command Checklist · Pattern Library · Methodology · Machine Index. How to use this page Full port scan, then UDP. nmap -sT -p- --min-rate 5000 --max-retries 1 is the baseline; several boxes answer on nothing in the top 1000 (Chatterbox, Arctic) and services hide on UDP (AChat on 9256). Enumerate SMB and RPC before attacking. Null sessions, share listings (smbclient -N -L //IP when smbmap fails), and RID cycling (lookupsids, 1000–1050) often produce the userlist no wordlist would give you. Re-try every credential against SMB, WinRM, RDP, MSSQL and the application itself — including username-format variants (admin vs admin@domain, user vs DOMAIN\user). Then run whoami /priv, check service ACLs and writable service paths before any kernel exploit. Assume Defender and AppLocker. Prefer living-off-the-land, shell_exec over system, staged and encoded payloads; a payload that does nothing is usually AV or .NET-version mismatch, not a broken exploit. Markup Path: Default creds on the MegaShopping login → Order page posts raw XML to /process.php → XXE reads Daniel’s id_rsa → SSH → users-writable job.bat run by a SYSTEM schedule.

UAC bypasses leverage flaws or unintended functionality in different Windows builds. The following repository contains many different UAC bypassing techniques: UACME — currently lists 81 separate techniques. ⚠️ Critical: UAC bypass is not privilege escalation from a standard user. It only converts a filtered Administrator token (medium integrity) into a full Administrator token (high integrity). You must already be a member of the local Administrators group (and, for some methods, already have an elevated process). A standard user cannot UAC-bypass their way to administrator.