Windows Registry Autorun Privilege Escalation

Windows registry autorun keys launch programs automatically at login or boot. HKLM keys run as the logged-in user with their session privileges, but if a SYSTEM or Administrator process reads and executes autorun entries, or if you can modify entries pointing to executables that run as SYSTEM, you get privileged code execution. The most direct path is finding a writable autorun path whose binary runs as a high-privileged user.

Prerequisites Check

Step 1: Enumerate Autorun Entries

Using winPEAS:

Manual registry enumeration:

Using PowerUp:

Step 2: Check Permissions on Autorun Binaries

For each entry found, check if the binary path is writable:

Look for these permission flags on your user, BUILTIN\Users, or Everyone:

• (F) full control

• (M) modify

• (W) write

Step 3a: Writable Autorun Binary (Replace It)

If the binary the autorun key points to is writable:

Wait for the next login or trigger if possible.

Step 3b: Writable Registry Key (Change the Path)

If the registry key itself is writable, change the path to your payload:

Step 3c: Add HKCU Autorun (No Privileges Needed)

You can always write to your own HKCU autorun keys. This executes your payload when you log in: only useful if you are already SYSTEM or can escalate another way, but worth knowing:

More useful: if an admin user regularly logs in on this machine and your payload is in HKCU for that user's profile (accessed via another technique), you can chain to their session.

Step 4: Create the Payload

Transfer to target:

Step 5: Trigger Execution

Autorun keys fire on the next login. Wait for an admin or SYSTEM process to log in, or force a logout/login cycle:

Winlogon Keys

Winlogon registry entries are especially powerful: they run as SYSTEM during the login process:

Check Userinit and Shell values. If these point to writable binaries or if you can modify the key, your payload runs as SYSTEM at every login.