domains / families / security / offensive-windows-privesc

offensive-windows-privesc

separate

Comprehensive Windows privilege escalation methodology for offensive security engagements. Covers the full attack surface from a standard user shell to NT AUTHORITY\\SYSTEM: token impersonation via SeImpersonate and SeAssignPrimaryToken privileges using JuicyPotato, PrintSpoofer, GodPotato, SweetPotato, and RoguePotato; service misconfigurations including unquoted service paths, weak service DACLs, writable service binaries, and insecure service creation permissions; AlwaysInstallElevated MSI exploitation; DLL hijacking through search order abuse, phantom DLL loading, and writable PATH directory injection; UAC bypass techniques via fodhelper.exe, eventvwr.exe, CMSTP, and environment variable manipulation; scheduled task abuse for writable task actions and new task creation; registry autorun exploitation for persistence and escalation; PrintNightmare (CVE-2021-34527) for remote and local privilege escalation; and credential harvesting from SAM database extraction, DPAPI blob decryption…

When to use

• token impersonation via SeImpersonate and SeAssignPrimaryToken
• service misconfigurations including unquoted paths and weak DACLs
• AlwaysInstallElevated MSI exploitation
• DLL hijacking through search order abuse
• UAC bypass techniques
• scheduled task abuse
• registry autorun exploitation
• credential harvesting from SAM, DPAPI, and LSA

When not to use

• Linux privilege escalation

Skill page

Source