Windows:
Privilege Escalation
Windows privesc guides covering services, tokens, registry, and more
Windows Access Token Manipulation for Privilege Escalation
Covers Windows access token manipulation techniques including token impersonation, theft, and creation to escalate privileges within Active Directory and local environments.
AlwaysInstallElevated – MSI Installer Privilege Escalation
Exploits misconfigured AlwaysInstallElevated registry keys to run malicious MSI packages with SYSTEM privileges on Windows hosts.
DPAPI Credential Decryption for Privilege Escalation
Exploits Windows DPAPI to decrypt stored credentials from browser vaults, credential manager, and user secrets for local privilege escalation.
Hot Potato and Rotten Potato – Legacy Token Impersonation
Exploits NBNS spoofing, WPAD abuse & NTLM relay to DCOM for SYSTEM token impersonation via SeImpersonatePrivilege on legacy Windows systems.
Windows Registry Autorun Privilege Escalation
Exploiting misconfigured Windows Registry autorun keys to execute malicious payloads with elevated privileges during system or user startup.
Runas Stored Credentials Privilege Escalation
Exploit Windows `runas /savecred` stored credentials to execute commands as another user without knowing their password, achieving privilege escalation.
Windows Scheduled Task Abuse for Privilege Escalation
Exploiting misconfigured Windows Scheduled Tasks to escalate privileges by hijacking task binaries, weak permissions, and DLL sideloading techniques.
Token Impersonation – SeImpersonatePrivilege Exploitation
Exploits SeImpersonatePrivilege to impersonate high-privilege tokens via named pipes or API abuse, escalating from service accounts to SYSTEM on Windows.
UAC Bypass for Windows Privilege Escalation
Techniques to bypass User Account Control (UAC) mechanisms, escalating standard user privileges to administrator level on Windows systems.
Unquoted Service Path Privilege Escalation
Exploits Windows services with unquoted executable paths containing spaces, allowing malicious binary placement for SYSTEM-level code execution.
Windows Credential Hunting for Privilege Escalation
Techniques for locating stored credentials in Windows registries, files, memory, and configs to escalate privileges on compromised systems.
Windows DLL Hijacking for Privilege Escalation
Exploits Windows DLL search order to load malicious libraries, escalating privileges by hijacking vulnerable application or service executable paths.
Windows Privilege Escalation Enumeration Tools
Covers key tools for enumerating Windows privilege escalation vectors, including misconfigured services, weak permissions, unpatched vulnerabilities, and token abuse opportunities.