Windows Privilege Escalation

Provide systematic methodologies for discovering and exploiting privilege escalation vulnerabilities on Windows systems during penetration testing engagements. This skill covers system enumeration, credential harvesting, service exploitation, token impersonation, kernel exploits, and various misconfigurations that enable escalation from standard user to Administrator or SYSTEM privileges.

| WinPEAS | winPEAS.exe | Comprehensive enumeration | | PowerUp | Invoke-AllChecks | Service/path vulnerabilities | | Seatbelt | Seatbelt.exe -group=all | Security audit checks | | Watson | Watson.exe | Missing patches | | JAWS | .\jaws-enum.ps1 | Legacy Windows enum | | PrivescCheck | Invoke-PrivescCheck | Privilege escalation checks |

| Unquoted paths | wmic service get pathname \| findstr /i /v """ | | Weak service perms | accesschk.exe -uwcqv "Everyone" | | AlwaysInstallElevated | reg query HKCU\...\Installer /v AlwaysInstallElevated | | Stored credentials | cmdkey /list | | Token privileges | whoami /priv | | Scheduled tasks | schtasks /query /fo LIST /v |