Offensive Windows Privilege Escalation

A structured, hands-on reference on escalating from a low-privileged Windows foothold to Administrator or NT AUTHORITY\SYSTEM — enumeration and methodology, service and scheduled-task misconfigurations, registry abuse and UAC bypass, token-privilege abuse, the impersonation/potato family, kernel exploits, and credential mining — written from an offensive-security perspective (escalate, then detect and defend).

Warning

Educational use only These are personal study notes. Every technique here is documented for use only against systems you own or are explicitly authorized to test (your own lab, a CTF, an authorized engagement). Escalating privileges on a host you do not have written permission to assess is unlawful in most jurisdictions. All examples use lab placeholders (10.10.14.7 attacker, 10.10.10.5/192.168.x target) — substitute your own.

What's inside

• 75+ notes organized by escalation vector, each in a consistent shape: concept → hands-on enumeration and exploitation (whoami /priv, cmd/powershell) → detection → defenses → related notes.
• Full vector coverage — automated enumeration (WinPEAS/PowerUp), service misconfigurations (unquoted paths, weak binPath/file permissions, DLL hijacking, service-via-registry, named pipes), scheduled tasks and startup apps, registry exploitation (AlwaysInstallElevated, autoruns), UAC bypass (fodhelper/eventvwr/computerdefaults/sdclt), token-privilege abuse (SeImpersonate, SeBackup/SeRestore, SeTakeOwnership, SeLoadDriver, SeDebug), the potato family (Juicy/Rogue/Print/God/Rotten), kernel exploits, and credential mining (SAM/SYSTEM, LSASS, NTDS.dit, GPP cpassword, registry, ADS, unattend files).
• A methodology checklist that indexes every vector, plus two full hands-on labs (SeImpersonate→SYSTEM, unquoted service path→SYSTEM).
• Copy-ready, language-tagged commands throughout, each with detection and defensive guidance.

Map of Content

Methodology & enumeration

Note	Covers
Escalation Methodology & Checklist	The step-by-step checklist that indexes every vector below
Situational Awareness	Network position, active defences, and detection surface
Network Enumeration · User Enumeration · Version & Configuration	Account and host detail after landing a shell
Privilege Escalation Tools	WinPEAS, PowerUp, SharpUp, Seatbelt, Watson
PowerShell Enumeration Script	Dependency-free script that auto-discovers every vector, mapped to its note

Token privileges

Note	Covers
Token Privilege Abuse (index)	whoami /priv → exploit map
SeBackup / SeRestore · SeTakeOwnership	Read/write any file; take ownership
SeLoadDriver · SeDebug	BYOVD kernel load; open any process

Built-in group memberships

Note	Covers
Windows Built-in Groups (index)	Privileged groups that grant SYSTEM/Domain Admin
Backup Operators · DnsAdmins · Server Operators	SeBackup file theft · DNS plugin-DLL · service reconfigure on a DC
Print Operators · Hyper-V Administrators · Event Log Readers	SeLoadDriver BYOVD · hypervisor/VHD abuse · command-line creds in logs

Impersonation & potato attacks

Note	Covers
Impersonation & Potato Attacks (index)	Token impersonation and the potato family
Token Impersonation · Juicy Potato · JuicyPotatoNG	Foundations and classic COM potatoes
PrintSpoofer · RoguePotato · God Potato · RottenPotato	Modern SeImpersonate→SYSTEM

Service & scheduled-task misconfigurations

Note	Covers
Services Exploitation (index)	Enumeration, control, and abuse of services
Unquoted Service Path · Insecure Permissions (binPath) · Insecure File Permissions	Service misconfiguration classes
DLL Hijacking · DLL Injection · Service via Registry · Named Pipes	Load-path, injection, and registry abuse
Scheduled Tasks · Startup Applications · RunAs	Autostart vectors

Registry & UAC bypass

Note	Covers
Registry Exploitation (index)	Registry-based escalation
AlwaysInstallElevated · Autorun Persistence	Registry escalation & persistence
UAC Bypass (index)	Medium→High integrity elevation
fodhelper · eventvwr · computerdefaults · sdclt	Auto-elevate bypass techniques

Kernel exploits

Note	Covers
Windows Kernel Exploits (index)	Kernel/driver escalation
MS10-015 · MS10-059 · MS14-058 · HTB workflow	Concrete kernel exploits

Credential & password mining

Note	Covers
Password Mining (index)	Credential discovery on Windows
LSASS Dumping · GPP cpassword · SAM & SYSTEM · NTDS.dit	Live memory, SYSVOL, hives, DC database

Post-escalation, breakout & pillaging

Note	Covers
Citrix Breakout	Escape a published/kiosk app to a host shell
Interacting with Users	Capture credentials from other logged-on users
Pillaging	Sweep the host for credentials, keys, and tokens

Targets, context & defense

Note	Covers
Communication with Processes	Named pipes, RPC/DCOM, COM, ALPC as escalation surfaces
Windows Server vs Desktop	How target type/role shifts the playbook
Legacy Operating Systems	Privesc on EOL Windows (kernel-exploit heavy)
Miscellaneous Techniques	Saved RDP creds, Utilman, WSL, COM hijacking, third-party CVEs
Windows Hardening	Defensive checklist closing every vector, verifiable with the enum script

Notable CVEs & recent additions

Note	Covers
PrintNightmare (CVE-2021-34527) · HiveNightmare / SeriousSAM (CVE-2021-36934) · CLFS Driver LPE (CVE-2023-28252)	Notable Windows LPEs
COM Hijacking · StorSvc DLL Hijack · DPAPI & Saved Credentials · WSL Privilege Escalation	COM / service-DLL / DPAPI / WSL

Flashcards

Note	Covers
Flashcards	Spaced-repetition revision decks (Q::A)

Hands-on labs

Lab	Covers
Lab Setup (PowerShell)	Provision a vulnerable VM with every technique's misconfiguration
SeImpersonate → SYSTEM	Full potato escalation walkthrough
Unquoted Service Path → SYSTEM	Service misconfiguration end to end
Skills Assessment Part 1	Self-test: service/registry vectors against the lab box
Skills Assessment Part 2	Self-test: token privileges, groups & credentials

How to read

• On GitHub — every note is fully readable and its cross-references are relative Markdown links clickable directly in the GitHub web UI; tables and alert callouts render inline. Start here and follow the Map of Content.
• Also great in Obsidian — clone the repo and open the folder as a vault. The same relative links resolve, so click-through navigation, backlinks, and the graph view all work.

Conventions

• Commands are written for a Windows target with a Kali Linux attacker unless noted; adapt IPs, paths, and account names to your environment.
• IP addresses (10.10.14.7 attacker, 10.10.10.5 target), ports, and account/file names are lab placeholders — replace them with your own.
• Callouts use GitHub alert syntax (> [!NOTE], > [!WARNING], > [!TIP]) and bold-label blockquotes; both render on GitHub and in Obsidian.
• Every technique note pairs detection and defense guidance — these are documented to be understood and defended against, not just executed.

License

Content is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0) — you may share and adapt it with attribution. All techniques are documented for authorized testing and education only; verify every command in an isolated lab before use.