Privilege Escalation

Windows Access Token Manipulation for Privilege Escalation

Covers Windows access token manipulation techniques including token impersonation, theft, and creation to escalate privileges within Active Directory and local environments.

AlwaysInstallElevated – MSI Installer Privilege Escalation

Exploits misconfigured AlwaysInstallElevated registry keys to run malicious MSI packages with SYSTEM privileges on Windows hosts.

DPAPI Credential Decryption for Privilege Escalation

Exploits Windows DPAPI to decrypt stored credentials from browser vaults, credential manager, and user secrets for local privilege escalation.

Hot Potato and Rotten Potato – Legacy Token Impersonation

Exploits NBNS spoofing, WPAD abuse & NTLM relay to DCOM for SYSTEM token impersonation via SeImpersonatePrivilege on legacy Windows systems.

Windows Registry Autorun Privilege Escalation

Exploiting misconfigured Windows Registry autorun keys to execute malicious payloads with elevated privileges during system or user startup.

Runas Stored Credentials Privilege Escalation

Exploit Windows `runas /savecred` stored credentials to execute commands as another user without knowing their password, achieving privilege escalation.

Windows Scheduled Task Abuse for Privilege Escalation

Exploiting misconfigured Windows Scheduled Tasks to escalate privileges by hijacking task binaries, weak permissions, and DLL sideloading techniques.

SeBackupPrivilege Abuse for Privilege Escalation

SeRestorePrivilege Abuse for Privilege Escalation

Windows Service Binary Hijacking

Token Impersonation – SeImpersonatePrivilege Exploitation

Exploits SeImpersonatePrivilege to impersonate high-privilege tokens via named pipes or API abuse, escalating from service accounts to SYSTEM on Windows.

UAC Bypass for Windows Privilege Escalation

Techniques to bypass User Account Control (UAC) mechanisms, escalating standard user privileges to administrator level on Windows systems.

Unquoted Service Path Privilege Escalation

Exploits Windows services with unquoted executable paths containing spaces, allowing malicious binary placement for SYSTEM-level code execution.

Weak Registry Permissions for Windows Privilege Escalation

Weak Service Permissions Privilege Escalation

Windows Credential Hunting for Privilege Escalation

Techniques for locating stored credentials in Windows registries, files, memory, and configs to escalate privileges on compromised systems.

Windows DLL Hijacking for Privilege Escalation

Exploits Windows DLL search order to load malicious libraries, escalating privileges by hijacking vulnerable application or service executable paths.

Windows Kernel Exploit Privilege Escalation

Windows Password Attacks – Hash Dumping and Cracking

Windows Privilege Escalation Enumeration Tools

Covers key tools for enumerating Windows privilege escalation vectors, including misconfigured services, weak permissions, unpatched vulnerabilities, and token abuse opportunities.