# Privilege Escalation

> Windows privesc guides covering services, tokens, registry, and more

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation
- **Platform:** [Windows](https://hackindex.io/platforms/windows.md)
- **Published:** 2026-03-15
- **Updated:** 2026-05-05

Windows privilege escalation takes a standard user shell and turns it into SYSTEM or Administrator access. Service misconfigurations are the most common path: writable service binaries, unquoted service paths with spaces in writable directories, and weak service DACLs that let you reconfigure the service binary path.

Token-based attacks exploit SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege, commonly held by service accounts and IIS application pool identities. The potato family (JuicyPotato, PrintSpoofer, GodPotato, SweetPotato) abuses these privileges through different COM/RPC mechanisms depending on the Windows version.

AlwaysInstallElevated lets you run arbitrary MSI packages as SYSTEM. DLL hijacking targets applications that load libraries from writable locations. The subpages cover each escalation vector with detection commands (winPEAS, PowerUp, SharpUp), exploitation steps, and the specific Windows versions and configurations where each technique applies.

## Guides

- [Windows Access Token Manipulation for Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/access-token-manipulation.md): Covers Windows access token manipulation techniques including token impersonation, theft, and creation to escalate privileges within Active Directory and local environments.
- [AlwaysInstallElevated – MSI Installer Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/alwaysinstallelevated.md): Exploits misconfigured AlwaysInstallElevated registry keys to run malicious MSI packages with SYSTEM privileges on Windows hosts.
- [DPAPI Credential Decryption for Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/dpapi-credential-decryption.md): Exploits Windows DPAPI to decrypt stored credentials from browser vaults, credential manager, and user secrets for local privilege escalation.
- [Hot Potato and Rotten Potato – Legacy Token Impersonation](https://hackindex.io/platforms/windows/privilege-escalation/hot-potato-rotten-potato.md): Exploits NBNS spoofing, WPAD abuse & NTLM relay to DCOM for SYSTEM token impersonation via SeImpersonatePrivilege on legacy Windows systems.
- [Windows Registry Autorun Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/registry-autoruns.md): Exploiting misconfigured Windows Registry autorun keys to execute malicious payloads with elevated privileges during system or user startup.
- [Runas Stored Credentials Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/runas-stored-credentials.md): Exploit Windows `runas /savecred` stored credentials to execute commands as another user without knowing their password, achieving privilege escalation.
- [Windows Scheduled Task Abuse for Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/scheduled-task-abuse.md): Exploiting misconfigured Windows Scheduled Tasks to escalate privileges by hijacking task binaries, weak permissions, and DLL sideloading techniques.
- [SeBackupPrivilege Abuse for Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/sebackupprivilege-abuse.md): Exploits SeBackupPrivilege on Windows to read sensitive files like SAM/SYSTEM, enabling credential extraction and local privilege escalation.
- [SeRestorePrivilege Abuse for Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/serestoreprivilege-abuse.md)
- [Windows Service Binary Hijacking](https://hackindex.io/platforms/windows/privilege-escalation/service-binary-hijacking.md)
- [Token Impersonation – SeImpersonatePrivilege Exploitation](https://hackindex.io/platforms/windows/privilege-escalation/token-impersonation-seimpersonateprivilege-exploitation.md): Exploits SeImpersonatePrivilege to impersonate high-privilege tokens via named pipes or API abuse, escalating from service accounts to SYSTEM on Windows.
- [UAC Bypass for Windows Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/uac-bypass.md): Techniques to bypass User Account Control (UAC) mechanisms, escalating standard user privileges to administrator level on Windows systems.
- [Unquoted Service Path Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/unquoted-service-paths.md): Exploits Windows services with unquoted executable paths containing spaces, allowing malicious binary placement for SYSTEM-level code execution.
- [Weak Registry Permissions for Windows Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/weak-registry-permissions.md)
- [Weak Service Permissions Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/weak-service-permissions-privilege-escalation.md)
- [Windows Credential Hunting for Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/windows-credential-hunting.md): Techniques for locating stored credentials in Windows registries, files, memory, and configs to escalate privileges on compromised systems.
- [Windows DLL Hijacking for Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/windows-dll-hijacking-for-privilege-escalation.md): Exploits Windows DLL search order to load malicious libraries, escalating privileges by hijacking vulnerable application or service executable paths.
- [Windows Kernel Exploit Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/windows-kernel-exploits.md): Exploiting unpatched Windows kernel vulnerabilities to escalate local privileges, covering vulnerable drivers, memory corruption techniques, and token manipulation.
- [Windows Password Attacks – Hash Dumping and Cracking](https://hackindex.io/platforms/windows/privilege-escalation/windows-password-attacks.md)
- [Windows Privilege Escalation Enumeration Tools](https://hackindex.io/platforms/windows/privilege-escalation/windows-privilege-escalation-enumeration-tools.md): Covers key tools for enumerating Windows privilege escalation vectors, including misconfigured services, weak permissions, unpatched vulnerabilities, and token abuse opportunities.