Windows Privilege Escalation

Escalating from an unprivileged user to SYSTEM (or local Administrator) is the bridge between “I have a shell” and “I own the machine.” On Windows you rarely need a kernel exploit: the norm is abusing weak configurations —service permissions, bad path definitions, token privileges, scheduled tasks— that administration itself left exploitable. The kernel is the last resort, not the first.

Threat model

The system trusts paths, permissions, and privileges the admin misconfigured. The attacker doesn’t break Windows: they use its own rules against it. A service running as SYSTEM whose binary is writable by a normal user is, in effect, SYSTEM for that user. Escalation is almost always finding that one link.

Main paths (most to least common)

1. Token privileges (whoami /priv)

The most reliable quick win. If the user (typical on IIS/MSSQL service accounts) has:

• SeImpersonatePrivilege → the Potato family (JuicyPotato, PrintSpoofer, GodPotato, RoguePotato): force a privileged service to authenticate to you and impersonate its SYSTEM token.

PrintSpoofer.exe -i -c cmd          # SeImpersonate -> SYSTEM
GodPotato -cmd "cmd /c whoami"

• SeBackupPrivilege → copy SAM/SYSTEM or NTDS.dit bypassing ACLs.
• SeRestorePrivilege, SeTakeOwnershipPrivilege → take over protected files/services.
• SeDebugPrivilege → dump LSASS, inject into privileged processes.
• SeLoadDriverPrivilege → load a vulnerable driver (BYOVD).

2. Misconfigured services

# service binary writable by the user
accesschk.exe -uwcqv "Everyone" *            # Sysinternals
# service permissions (you can change binPath)
sc qc <service> & sc config <service> binPath= "C:\tmp\evil.exe"
sc stop <service> & sc start <service>

• Weak service permissions: you can reconfigure binPath → execution as SYSTEM.
• Unquoted service path: a path with spaces and no quotes (C:\Program Files\...) → drop C:\Program.exe.
• Weak binary/folder perms: replace the service executable.
• DLL hijacking: the service loads a DLL from a writable path.

3. Scheduled tasks and autoruns

Tasks running as SYSTEM invoking writable scripts/binaries; writable startup entries (Run keys, startup).

schtasks /query /fo LIST /v
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

4. AlwaysInstallElevated

If both keys are 1, any .msi installs as SYSTEM:

reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
msiexec /quiet /qn /i evil.msi

5. Credentials and secrets

GPP cpassword, unattend.xml, registry autologon, cmdkey, DPAPI, in-memory credentials → reuse toward an admin account (see Credential Dumping).

6. Kernel exploits (last resort)

Map systeminfo+hotfixes with wesng/Watson → PrintNightmare, CVE-2021-1732, etc. Noisy and can crash the host; use it when everything else fails.

Red Team — tools

• winPEAS / PowerUp (Invoke-AllChecks) / Seatbelt — automatic detection of all the above vectors.
• accesschk.exe (Sysinternals) — service, file, and registry permissions.
• PrintSpoofer / GodPotato / JuicyPotato — SeImpersonate exploitation.
• SharpUp, WES-NG, Watson — patch-to-exploit mapping.

Impact

From user to local SYSTEM: SAM/LSASS dumping, persistence, disabling defenses, and —on a domain host— jumping to domain credentials and pivoting.

Blue Team

Detection

• Service reconfiguration (sc config, event 7040/4697), new service creation (7045).
• PrintSpoofer/Potato execution (anomalous named pipes, SpoolSv/rpcss → SYSTEM shell).
• msiexec launching installers from user paths; accesschk/winPEAS.
• Scheduled task creation/modification (4698/4702).

Telemetry

Sysmon (1/7/11/13), service- and task-creation auditing, Script Block Logging, LSASS-access alerts (event 10 to lsass.exe).

Hardening

• Correct permissions on services, binaries, and folders; quote all service paths.
• Disable AlwaysInstallElevated; review Run keys and tasks.
• Strip dangerous privileges from service accounts; use gMSA.
• LAPS for the local admin; patch promptly (closes kernel exploits).
• EDR blocking LSASS access and BYOVD.

Response

Rebuild the host if it reached SYSTEM, rotate all local secrets and accounts that logged on, close the specific vector (permission/service/task).

CVEs and real-world cases

• PrintNightmare (CVE-2021-34527 / CVE-2021-1675) — spooler RCE/LPE, mass-exploited.
• HiveNightmare/SeriousSAM (CVE-2021-36934) — lax SAM/SYSTEM ACLs let a user read hashes.
• CVE-2021-1732, CVE-2022-21882 — win32k LPE used in real attacks.
• The Potato family (SeImpersonate) is a standard TTP against IIS/MSSQL service accounts (MITRE T1134).

Testing checklist

• whoami /priv — SeImpersonate/Backup/Restore/Debug/LoadDriver?
• Services with weak permissions or reconfigurable binPath (accesschk)
• Unquoted service paths with a writable folder
• DLL hijacking in privileged services/apps
• Modifiable scheduled tasks and Run keys running elevated
• AlwaysInstallElevated = 1 in HKCU and HKLM
• Credentials in configs/registry reusable toward admin
• Unpatched build mappable to a kernel exploit (only if all else fails)

References

• HackTricks — Windows local privilege escalation
• PowerSploit — Privesc (GitHub)
• PrintSpoofer — itm4n (GitHub)
• LOLBAS — abusable living-off-the-land Windows binaries