# Privilege Escalation

> Bypass CLM and escape JEA endpoints over WinRM sessions

- **URL:** https://hackindex.io/services/winrm/privilege-escalation
- **Service:** [WinRM](https://hackindex.io/services/winrm.md)
- **Tags:** elevation, permissions
- **Published:** 2026-04-06
- **Updated:** 2026-04-06

WinRM privilege escalation targets misconfigurations in PowerShell remoting and Just Enough Administration (JEA) to elevate access beyond what the session was intended to allow. JEA endpoints restrict users to specific cmdlets and parameters, but misconfigured role capabilities frequently expose escape paths to full PowerShell execution.

Constrained Language Mode (CLM) is commonly enforced on WinRM sessions to block .NET and COM access. Bypasses exist through allowed cmdlets that invoke arbitrary code, AppLocker misconfigurations, and MSBuild or InstallUtil execution. RunAs credentials stored in JEA session configurations can be extracted if the endpoint is configured to use a virtual account or group-managed service account with excessive privileges.

The subpages detail JEA enumeration, language mode bypass techniques, and methods for escalating from a restricted WinRM session to unrestricted command execution or SYSTEM-level access.

## Guides

- [WinRM CLM Bypass – PowerShell Constrained Language Mode Escape](https://hackindex.io/services/winrm/privilege-escalation/constrained-language-bypass.md)
- [JEA Endpoint Escape – Breaking Out of Just Enough Administration](https://hackindex.io/services/winrm/privilege-escalation/jea-escape.md)