Windows:

Exploitation

Get a shell via evil-winrm, web shells, and EternalBlue

1 guide • Created May 6, 2026 • Updated May 6, 2026

1 guide

Windows Initial Exploitation

Covers techniques for gaining initial footholds on Windows systems, including exploit execution, payload delivery, and leveraging common Windows vulnerabilities.

May 6, 2026 • 7 min read

Windows exploitation covers both remote and local attacks that give you initial access or elevate from a low-privilege foothold. Remote exploits target exposed services like SMB (EternalBlue, MS17-010), RDP (BlueKeep), print spooler (PrintNightmare), and IIS. Local exploits chain with information from enumeration to go from user to SYSTEM.

Token abuse techniques like impersonation and delegation attacks work when you have SeImpersonatePrivilege or similar. Named pipe attacks, COM object abuse, and kernel exploits compiled for the target's patch level and architecture each have their place depending on the environment.

The subpages walk through specific CVEs, service-level attacks, and the methodology for matching a target's patch level and configuration to known exploits. Focus is on reliable exploitation, not just proof-of-concept crashes.