# Windows Privilege Escalation

> Enumerate misconfigurations, abuse dangerous privileges, and exploit services to escalate from low-privilege user to SYSTEM on Windows.

- **URL:** https://hackindex.io/learn/oscp-pen-200-study-path/windows-privilege-escalation
- **Certification:** [OSCP (PEN-200) Study Path](https://hackindex.io/learn/oscp-pen-200-study-path.md)
- **Estimated study hours:** 5
- **Published:** 2026-09-25
- **Updated:** 2026-09-25

After gaining initial access to a Windows host, escalating from a low-privilege user to SYSTEM or Administrator is the next objective. PEN-200 covers manual enumeration, automated tools like winPEAS and PowerUp, service misconfigurations, dangerous privileges, token manipulation, and kernel exploits. Windows privilege escalation follows a repeatable methodology: enumerate, identify a vector, exploit, verify.

## Enumeration and Automated Tools

Before exploiting anything, you need a full picture of the target: OS version, patch level, installed software, running services, user privileges, and scheduled tasks. Automated tools (winPEAS, Seatbelt, PowerUp) speed up the search, but understanding the manual checks behind them is essential for the exam. Enumeration output tells you which escalation vectors exist on this specific host.

## Service and Configuration Exploits

Misconfigured services are the most common Windows privilege escalation vector. Writable service binaries, unquoted service paths, weak service permissions, DLL hijacking, and scheduled task abuse all lead to code execution as SYSTEM. Registry-based attacks (autoruns, weak registry ACLs) and AlwaysInstallElevated provide additional paths. UAC bypass techniques let you move from medium to high integrity when the user is a local administrator.

## Privilege Abuse and Credential Escalation

Certain Windows privileges (SeImpersonate, SeBackup, SeRestore) are direct escalation paths when assigned to your compromised user or service account. Potato exploits abuse SeImpersonatePrivilege through NTLM relay to get SYSTEM. Token manipulation lets you steal or duplicate tokens from higher-privileged processes. Credential hunting (SAM dumps, LSASS, DPAPI, stored credentials, registry secrets) provides hashes and passwords that unlock lateral movement or direct privilege escalation through pass-the-hash.

## Study material

- [Windows Privilege Escalation Enumeration Tools](https://hackindex.io/platforms/windows/privilege-escalation/windows-privilege-escalation-enumeration-tools.md) (read, core)
- [Windows System Enumeration](https://hackindex.io/platforms/windows/enumeration/windows-system-enumeration.md) (read, core)
- [Windows User and Group Enumeration](https://hackindex.io/platforms/windows/enumeration/windows-user-and-group-enumeration.md) (read, core)
- [Windows Service and Process Enumeration](https://hackindex.io/platforms/windows/enumeration/windows-service-and-process-enumeration.md) (read, core)
- [Windows Local Situational Awareness](https://hackindex.io/platforms/windows/post-exploitation/windows-local-situational-awareness.md) (read, core)
- [Windows Service Binary Hijacking](https://hackindex.io/platforms/windows/privilege-escalation/service-binary-hijacking.md) (read, core)
- [Unquoted Service Path Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/unquoted-service-paths.md) (read, core)
- [Weak Service Permissions Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/weak-service-permissions-privilege-escalation.md) (read, core)
- [Weak Registry Permissions for Windows Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/weak-registry-permissions.md) (read, core)
- [Windows DLL Hijacking for Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/windows-dll-hijacking-for-privilege-escalation.md) (read, core)
- [Windows Scheduled Task Abuse for Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/scheduled-task-abuse.md) (read, core)
- [Windows Registry Autorun Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/registry-autoruns.md) (read, core)
- [AlwaysInstallElevated – MSI Installer Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/alwaysinstallelevated.md) (read, core)
- [UAC Bypass for Windows Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/uac-bypass.md) (read, core)
- [Token Impersonation – SeImpersonatePrivilege Exploitation](https://hackindex.io/platforms/windows/privilege-escalation/token-impersonation-seimpersonateprivilege-exploitation.md) (read, core)
- [Windows Access Token Manipulation for Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/access-token-manipulation.md) (read, core)
- [Hot Potato and Rotten Potato – Legacy Token Impersonation](https://hackindex.io/platforms/windows/privilege-escalation/hot-potato-rotten-potato.md) (read, core)
- [SeBackupPrivilege Abuse for Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/sebackupprivilege-abuse.md) (read, core)
- [SeRestorePrivilege Abuse for Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/serestoreprivilege-abuse.md) (read, core)
- [Runas Stored Credentials Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/runas-stored-credentials.md) (read, core)
- [Windows Password Attacks – Hash Dumping and Cracking](https://hackindex.io/platforms/windows/privilege-escalation/windows-password-attacks.md) (read, core)
- [Windows Credential Hunting for Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/windows-credential-hunting.md) (read, core)
- [DPAPI Credential Decryption for Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/dpapi-credential-decryption.md) (read, core)
- [Windows Token and Credential Harvesting](https://hackindex.io/platforms/windows/post-exploitation/windows-token-and-credential-harvesting.md) (read, core)
- [Windows Kernel Exploit Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/windows-kernel-exploits.md) (read, core)