Windows Privilege Escalation
What to know
Begin with whoami /all (privileges and group membership), systeminfo, net user, net localgroup administrators, installed software, and patch level. Then examine services and their permissions, scheduled tasks, unquoted service paths, weak folder or service ACLs, AlwaysInstallElevated, stored credentials (cmdkey /list, runas /savecred), registry autologon values, unattended install files, Group Policy Preferences cpassword values, and DLL search-order hijacking.
Token privileges drive many escalations: SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege (Potato family), SeBackupPrivilege/SeRestorePrivilege, SeTakeOwnershipPrivilege, and SeDebugPrivilege. UAC bypass is a separate step after landing in an administrative group. Credential material lives in LSASS, the SAM, cached domain credentials, and DPAPI blobs, reachable with mimikatz or secretsdump. Local administrator password reuse across hosts is a major lateral path. Enumerators: winPEAS, PowerUp, SharpUp, Seatbelt, netexec.
Traps
- Mixing x86 and x64 binaries and seeing silent failures.
- Losing tools to Defender or AMSI; expect to obfuscate or stage downloads.
- Assuming membership in Administrators means an elevated token; UAC still applies.
- Confusing the right to change a service configuration with the right to restart it.
Rule of thumb
Enumerate privileges and misconfigurations to completion before running any exploit binary; most Windows footholds are configuration flaws, not memory corruption.