DB.
Courses

Windows Privilege Escalation
OSCP · Chapter 13

Windows Privilege Escalation

Windows privilege escalation is the process of turning a low-privileged foothold into SYSTEM/Administrator access, by abusing misconfigurations rather than memory-corruption exploits in most real engagements.

Key concepts

  • Common vectors: weak service permissions (can you replace the binary a SYSTEM service runs?), unquoted service paths, and stored credentials in scripts/registry.
  • Automated enumeration scripts (WinPEAS, PowerUp) surface these misconfigurations quickly, but you must understand *why* each finding is exploitable before using it.
  • Token/impersonation abuse (e.g. Potato-family exploits) escalates from a service account to SYSTEM by abusing Windows privilege assignment.
  • Always confirm privilege escalation in a lab before attempting on a client system — some techniques can crash the target service.

Example

wmic service get name,pathname,startmode | findstr /i "auto" | findstr /vi "C:\\Windows\\"

Try it yourself

On a Windows lab VM, run WinPEAS or a manual `sc qc <service>` sweep, and identify one service you (as a low-privileged user) could write to or reconfigure.

ReferenceSearch video walkthroughs

@ Daniel Burlacu