Windows Registry Autorun Privilege Escalation

Windows registry autorun keys launch programs automatically at login or boot. HKLM keys run as the logged-in user with their session privileges, but if a SYSTEM or Administrator process reads and executes autorun entries — or if you can modify entries pointing to executables that run as SYSTEM — you get privileged code execution. The most direct path is finding a writable autorun path whose binary runs as a high-privileged user.

Prerequisites Check

Step 1 — Enumerate Autorun Entries

Using winPEAS:

Manual registry enumeration:

Using PowerUp:

Step 2 — Check Permissions on Autorun Binaries

For each entry found, check if the binary path is writable:

Look for (W), (M), or (F) for your user, BUILTIN\Users, or Everyone.

Step 3a — Writable Autorun Binary (Replace It)

If the binary the autorun key points to is writable:

Wait for the next login or trigger if possible.

Step 3b — Writable Registry Key (Change the Path)

If the registry key itself is writable, change the path to your payload:

Step 3c — Add HKCU Autorun (No Privileges Needed)

You can always write to your own HKCU autorun keys. This executes your payload when you log in — only useful if you are already SYSTEM or can escalate another way, but worth knowing:

More useful: if an admin user regularly logs in on this machine and your payload is in HKCU for that user's profile (accessed via another technique), you can chain to their session.

Step 4 — Create the Payload

Transfer to target:

Step 5 — Trigger Execution

Autorun keys fire on the next login. Wait for an admin or SYSTEM process to log in, or force a logout/login cycle:

Winlogon Keys

Winlogon registry entries are especially powerful — they run as SYSTEM during the login process:

Check Userinit and Shell values. If these point to writable binaries or if you can modify the key, your payload runs as SYSTEM at every login.