OSCP · Module 13
Windows Privilege Escalation
Enumerate misconfigurations, abuse dangerous privileges, and exploit services to escalate from low-privilege user to SYSTEM on Windows.
~5 h 25 resources Last updated September 25, 2026
After gaining initial access to a Windows host, escalating from a low-privilege user to SYSTEM or Administrator is the next objective. PEN-200 covers manual enumeration, automated tools like winPEAS and PowerUp, service misconfigurations, dangerous privileges, token manipulation, and kernel exploits. Windows privilege escalation follows a repeatable methodology: enumerate, identify a vector, exploit, verify.
Enumeration and Automated Tools
Before exploiting anything, you need a full picture of the target: OS version, patch level, installed software, running services, user privileges, and scheduled tasks. Automated tools (winPEAS, Seatbelt, PowerUp) speed up the search, but understanding the manual checks behind them is essential for the exam. Enumeration output tells you which escalation vectors exist on this specific host.
Service and Configuration Exploits
Misconfigured services are the most common Windows privilege escalation vector. Writable service binaries, unquoted service paths, weak service permissions, DLL hijacking, and scheduled task abuse all lead to code execution as SYSTEM. Registry-based attacks (autoruns, weak registry ACLs) and AlwaysInstallElevated provide additional paths. UAC bypass techniques let you move from medium to high integrity when the user is a local administrator.
Privilege Abuse and Credential Escalation
Certain Windows privileges (SeImpersonate, SeBackup, SeRestore) are direct escalation paths when assigned to your compromised user or service account. Potato exploits abuse SeImpersonatePrivilege through NTLM relay to get SYSTEM. Token manipulation lets you steal or duplicate tokens from higher-privileged processes. Credential hunting (SAM dumps, LSASS, DPAPI, stored credentials, registry secrets) provides hashes and passwords that unlock lateral movement or direct privilege escalation through pass-the-hash.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.
-
Guide 4 min readWindows Privilege Escalation Enumeration Tools
-
Guide 3 min readWindows User and Group Enumeration
-
Guide 3 min readWindows Service Binary Hijacking
-
Guide 3 min readUnquoted Service Path Privilege Escalation
-
Guide 3 min readWeak Service Permissions Privilege Escalation
-
Guide 6 min readWeak Registry Permissions for Windows Privilege Escalation
-
Guide 4 min readWindows Scheduled Task Abuse for Privilege Escalation
-
Guide 4 min readWindows Registry Autorun Privilege EscalationFocus on #Step 1: Enumerate Autorun Entries #Step 2: Check Permissions on Autorun Binaries #Step 3a: Writable Autorun Binary (Replace It) #Step 3b: Writable Registry Key (Change the Path) #Step 3c: Add HKCU Autorun (No Privileges Needed) #Step 4: Create the Payload #Step 5: Trigger Execution #Winlogon Keys
-
Guide 3 min readToken Impersonation – SeImpersonatePrivilege Exploitation
-
Guide 4 min readWindows Credential Hunting for Privilege Escalation
-
Guide 4 min readWindows Kernel Exploit Privilege EscalationFocus on #Step 1: Identify Missing Patches with WES-ng #CVE-2021-36934: HiveNightmare / SeriousSam #MS16-032: Secondary Logon Service (Windows 7-10, Server 2008-2012) #CVE-2020-0796: SMBGhost (Windows 10 1903/1909) #CVE-2022-21882: Win32k Privilege Escalation (Windows 10/11) #Compilation for Windows Targets