Establish Windows token, host and process context

Needs: A functioning command channel and the actual effective token/process context

Windows commands

REM Baseline
hostname
whoami /all
systeminfo
ipconfig /all
route print
netstat -ano
tasklist /svc
query user
net user
net localgroup Administrators
driverquery /v

PowerShell commands

# Baseline
Get-ComputerInfo | Select-Object WindowsProductName,WindowsVersion,OsBuildNumber,OsArchitecture
Get-HotFix | Sort-Object InstalledOn -Descending
Get-CimInstance Win32_Process | Select-Object ProcessId,Name,ExecutablePath,CommandLine
Get-CimInstance Win32_Service | Select-Object Name,StartName,State,StartMode,PathName
Get-CimInstance Win32_SystemDriver | Select-Object Name,State,StartMode,PathName
Get-LocalUser
Get-LocalGroupMember Administrators

Interpret: record user SID, integrity label, enabled/deny-only groups and present/enabled privileges. Administrator membership with Medium integrity is a filtered token, not a high-integrity process. Get-HotFix does not list every update; use build/KB output only to form a version hypothesis.

WMIC compatibility fallbacks

REM WMIC compatibility fallbacks
wmic qfe get HotFixID,InstalledOn
wmic service get Name,StartName,State,StartMode,PathName
wmic process get ProcessId,Name,ExecutablePath,CommandLine

REM WMIC compatibility fallbacks
whoami /all
hostname
ipconfig /all

After a higher token, re-enumerate protected credentials, services, tasks, sessions, listeners, routes and domain context. Preserve the command, relevant output, trigger and restoration step. For exam use, recheck the current OffSec guide: Windows full-privilege evidence requires SYSTEM, Administrator or an account with Administrator privileges, and AI/LLM use is prohibited during the exam and report phase.

Verify → Verify represented user/SID, enabled group/privilege state and actual privileged operation.

If it fails → A prompt title or account name is insufficient. WMIC may be absent; use the documented CIM/PowerShell alternatives. More detail ↓

If → then

A privileged object appears writable or an ACL tool reports a useful right → Prove effective file, registry and service-object permissions
Needs: Correct trustee/token, object type and effective rights including parents and deny entries
Effective SERVICE_CHANGE_CONFIG on a higher-privileged service → Change a privileged service's executable configuration
Needs: Configuration-change right, accessible compatible payload path and a separate start/restart trigger
whoami /priv exposes a relevant token privilege → Select a privilege-backed impersonation or object-control route
Needs: The exact privilege and usable operation; impersonation additionally needs a compatible privileged authentication source, OS/service state and executable context
A service command line contains unquoted spaces → Exploit an unquoted service path with a writable earlier prefix
Needs: An earlier executable prefix is absent and creatable, service identity is higher and a start/restart trigger exists
Installer policy values or an administrator account with a filtered token → Validate elevated installer policy and administrative-token context
Needs: AlwaysInstallElevated requires both effective machine/user policy values and permitted MSI execution; UAC routes require their own compatible administrator/token context

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Establish Windows token, host and process context

USE WHEN: A new Windows session or claimed administrator/SYSTEM transition
STARTING ACCESS: A verified Windows foothold with a known token, integrity level and groups
RESULT: A verified identity, integrity, privilege and host state for candidate selection

Recognize the clue

At a new foothold inspect the complete token and host/service inventory before classifying the session as an administrator.

whoami /all
systeminfo
tasklist /svc

SYNTHETIC EXAMPLE OUTPUT

BUILTIN\Administrators: Group used for deny only
Mandatory Label\Medium Mandatory Level

Means: An Administrators SID exists but this effective process is filtered/medium-integrity.

Confirm: Check actual enabled privileges and object operations in the process that will perform the action.

After validation: A higher-integrity/SYSTEM token and intended operation are verified: record that privilege state.
Ruled out in this context: A medium filtered token cannot perform the assumed administrative action: reject that privilege assumption.
Still inconclusive: Username/group membership alone leaves token state unknown; inspect whoami /all.

Troubleshooting: A prompt title or account name is insufficient. WMIC may be absent; use the documented CIM/PowerShell alternatives.

Additional prerequisite checks

hostname
whoami /all
systeminfo
ipconfig /all

Interpret: record user SID, integrity label, enabled/deny-only groups and present/enabled privileges. Administrator membership with Medium integrity is a filtered token, not a high-integrity process. Get-HotFix does not list every update; use build/KB output only to form a version hypothesis.

WMIC compatibility fallbacks

WMIC is deprecated and may be absent on newer systems; PowerShell CIM is the baseline.

After a higher token, re-enumerate protected credentials, services, tasks, sessions, listeners, routes and domain context. Preserve the command, relevant output, trigger and restoration step. For exam use, recheck the current OffSec guide: Windows full-privilege evidence requires SYSTEM, Administrator or an account with Administrator privileges, and AI/LLM use is prohibited during the exam and report phase.

Why it works

Group membership can be filtered in a token, and a network logon context can differ from interactive access. Check privileges and integrity where the intended operation runs.

Worked example · hypothetical

Observation: the username belongs to Administrators. Test: inspect token groups/integrity and effective privileges. Illustrative output: the administrator SID is deny-only in a medium token. Interpretation: do not assume high-integrity service-control rights.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗