Windows local privilege escalation
Windows local privilege escalation exploits misconfigurations in services, registry settings, scheduled tasks, token handling, and missing patches to move from a standard user to SYSTEM or Administrator on a compromised host.
Strategic context
Windows local privilege escalation follows a different pattern than Linux. Linux escalation often focuses on file permissions and sudo policies, whereas Windows escalation frequently involves service misconfigurations, registry settings, and token manipulation. The Windows privilege model is more complex than Linux, which creates more potential escalation paths but also makes enumeration more involved.
As with Linux escalation, internal reconnaissance should have already provided the context needed to select an appropriate technique. User privileges, running services, installed software, scheduled tasks, and applied patches all inform which escalation paths are viable.
For security leaders, Windows local privilege escalation shows the risk of permissive service configurations, legacy installations, and deferred patching. Many of the techniques described here exploit conditions that are preventable through Group Policy enforcement, regular auditing, and disciplined change management.
Execution examples
Service misconfigurations
Windows services run with specific privileges, often as SYSTEM. When a service is misconfigured, it may allow a lower-privileged user to modify the service binary, change its configuration, or exploit its execution path.
Unquoted service paths create an ambiguity that Windows resolves by checking intermediate paths in order. If a service path contains spaces and is not quoted, placing an executable at an intermediate path causes it to execute with the service's privileges:
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows"Writable service binaries can be replaced with a payload that executes with the service's privileges:
sc stop service_name
# replace binary
sc start service_nameModifiable service configurations allow changing the binary path to point to an attacker-controlled executable:
sc config service_name binpath= "C:\path\to\payload.exe"Registry-based escalation
The AlwaysInstallElevated policy, when enabled in both HKLM and HKCU, allows any user to install MSI packages with SYSTEM privileges:
If both values are set to 1, a malicious MSI package provides SYSTEM access.
Autorun registry keys reference executables that run at startup. If the referenced executable is writable, replacing it provides escalation on the next boot or login.
Scheduled task exploitation
Scheduled tasks may execute writable scripts or binaries with elevated privileges:
As with Linux cron jobs, the escalation opportunity exists when the task runs with higher privileges than the current user and executes a file that the current user can modify or replace.
Token impersonation
Windows uses tokens to represent security contexts. When certain privileges are present, especially SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege, the current user can impersonate tokens from other processes, potentially including SYSTEM.
These privileges are commonly found on service accounts and IIS application pool identities. The Potato tools (JuicyPotato, PrintSpoofer, RoguePotato, SweetPotato) automate token impersonation through various Windows mechanisms.
If SeImpersonatePrivilege is enabled, token impersonation tools provide a direct path to SYSTEM.
Credential discovery
Windows systems frequently contain credentials in predictable locations:
Stored credentials, saved passwords in registry keys, configuration files with embedded credentials, and credential manager entries all warrant checking.
Automated enumeration
Automated tools accelerate the discovery of escalation paths but should supplement manual enumeration:
WinPEAS provides thorough automated enumeration of common escalation vectors. PowerUp.ps1 focuses specifically on service and registry misconfigurations. The Metasploit local exploit suggester evaluates the system against known vulnerabilities:
For offline analysis, windows-exploit-suggester.py compares systeminfo output against known vulnerabilities:
Common mistakes
Running automated tools before understanding the current privilege level and environment
Ignoring service and registry misconfigurations
Not checking for SeImpersonatePrivilege, one of the most reliable escalation paths
Attempting escalation techniques without considering OPSEC
Operator notes
Check whoami /priv early. SeImpersonatePrivilege alone may be sufficient for SYSTEM access
Service misconfigurations are the most common Windows escalation path in practice
Credential discovery is often underestimated. Checking for stored and cached credentials takes minimal time and frequently produces results
Automated tools like WinPEAS are thorough but can be noisy. Consider the detection risk relative to the engagement type
As with Linux, choose the escalation path with the least risk of disruption when multiple options exist
Last updated