A structured, hands-on reference on escalating from a low-privileged Windows foothold to Administrator or NT AUTHORITY\SYSTEM — enumeration and methodology, service and scheduled-task misconfigurations, registry abuse and UAC bypass, token-privilege abuse, the impersonation/potato family, kernel exploits, and credential mining — written from an offensive-security perspective (escalate, then detect and defend).

[!WARNING] Educational use only These are personal study notes. Every technique here is documented for use only against systems you own or are explicitly authorized to test (your own lab, a CTF, an authorized engagement). Escalating privileges on a host you do not have written permission to assess is unlawful in most jurisdictions. All examples use lab placeholders (10.10.14.7 attacker, 10.10.10.5/192.168.x target) — substitute your own.

What's inside

  • 75+ notes organized by escalation vector, each in a consistent shape: concept → hands-on enumeration and exploitation (whoami /priv, cmd/powershell) → detection → defenses → related notes.
  • Full vector coverage — automated enumeration (WinPEAS/PowerUp), service misconfigurations (unquoted paths, weak binPath/file permissions, DLL hijacking, service-via-registry, named pipes), scheduled tasks and startup apps, registry exploitation (AlwaysInstallElevated, autoruns), UAC bypass (fodhelper/eventvwr/computerdefaults/sdclt), token-privilege abuse (SeImpersonate, SeBackup/SeRestore, SeTakeOwnership, SeLoadDriver, SeDebug), the potato family (Juicy/Rogue/Print/God/Rotten), kernel exploits, and credential mining (SAM/SYSTEM, LSASS, NTDS.dit, GPP cpassword, registry, ADS, unattend files).
  • A methodology checklist that indexes every vector, plus two full hands-on labs (SeImpersonate→SYSTEM, unquoted service path→SYSTEM).
  • Copy-ready, language-tagged commands throughout, each with detection and defensive guidance.

Map of Content

Methodology & enumeration

Note Covers
Escalation Methodology & Checklist The step-by-step checklist that indexes every vector below
Situational Awareness Network position, active defences, and detection surface
Network Enumeration · User Enumeration · Version & Configuration Account and host detail after landing a shell
Privilege Escalation Tools WinPEAS, PowerUp, SharpUp, Seatbelt, Watson
PowerShell Enumeration Script Dependency-free script that auto-discovers every vector, mapped to its note

Token privileges

Note Covers
Token Privilege Abuse (index) whoami /priv → exploit map
SeBackup / SeRestore · SeTakeOwnership Read/write any file; take ownership
SeLoadDriver · SeDebug BYOVD kernel load; open any process

Built-in group memberships

Note Covers
Windows Built-in Groups (index) Privileged groups that grant SYSTEM/Domain Admin
Backup Operators · DnsAdmins · Server Operators SeBackup file theft · DNS plugin-DLL · service reconfigure on a DC
Print Operators · Hyper-V Administrators · Event Log Readers SeLoadDriver BYOVD · hypervisor/VHD abuse · command-line creds in logs

Impersonation & potato attacks

Note Covers
Impersonation & Potato Attacks (index) Token impersonation and the potato family
Token Impersonation · Juicy Potato · JuicyPotatoNG Foundations and classic COM potatoes
PrintSpoofer · RoguePotato · God Potato · RottenPotato Modern SeImpersonate→SYSTEM

Service & scheduled-task misconfigurations

Note Covers
Services Exploitation (index) Enumeration, control, and abuse of services
Unquoted Service Path · Insecure Permissions (binPath) · Insecure File Permissions Service misconfiguration classes
DLL Hijacking · DLL Injection · Service via Registry · Named Pipes Load-path, injection, and registry abuse
Scheduled Tasks · Startup Applications · RunAs Autostart vectors

Registry & UAC bypass

Note Covers
Registry Exploitation (index) Registry-based escalation
AlwaysInstallElevated · Autorun Persistence Registry escalation & persistence
UAC Bypass (index) Medium→High integrity elevation
fodhelper · eventvwr · computerdefaults · sdclt Auto-elevate bypass techniques

Kernel exploits

Note Covers
Windows Kernel Exploits (index) Kernel/driver escalation
MS10-015 · MS10-059 · MS14-058 · HTB workflow Concrete kernel exploits

Credential & password mining

Note Covers
Password Mining (index) Credential discovery on Windows
LSASS Dumping · GPP cpassword · SAM & SYSTEM · NTDS.dit Live memory, SYSVOL, hives, DC database

Post-escalation, breakout & pillaging

Note Covers
Citrix Breakout Escape a published/kiosk app to a host shell
Interacting with Users Capture credentials from other logged-on users
Pillaging Sweep the host for credentials, keys, and tokens

Targets, context & defense

Note Covers
Communication with Processes Named pipes, RPC/DCOM, COM, ALPC as escalation surfaces
Windows Server vs Desktop How target type/role shifts the playbook
Legacy Operating Systems Privesc on EOL Windows (kernel-exploit heavy)
Miscellaneous Techniques Saved RDP creds, Utilman, WSL, COM hijacking, third-party CVEs
Windows Hardening Defensive checklist closing every vector, verifiable with the enum script

Notable CVEs & recent additions

Note Covers
PrintNightmare (CVE-2021-34527) · HiveNightmare / SeriousSAM (CVE-2021-36934) · CLFS Driver LPE (CVE-2023-28252) Notable Windows LPEs
COM Hijacking · StorSvc DLL Hijack · DPAPI & Saved Credentials · WSL Privilege Escalation COM / service-DLL / DPAPI / WSL

Flashcards

Note Covers
Flashcards Spaced-repetition revision decks (Q::A)

Hands-on labs

Lab Covers
Lab Setup (PowerShell) Provision a vulnerable VM with every technique's misconfiguration
SeImpersonate → SYSTEM Full potato escalation walkthrough
Unquoted Service Path → SYSTEM Service misconfiguration end to end
Skills Assessment Part 1 Self-test: service/registry vectors against the lab box
Skills Assessment Part 2 Self-test: token privileges, groups & credentials

How to read

  • On GitHub — every note is fully readable and its cross-references are relative Markdown links clickable directly in the GitHub web UI; tables and alert callouts render inline. Start here and follow the Map of Content.
  • Also great in Obsidian — clone the repo and open the folder as a vault. The same relative links resolve, so click-through navigation, backlinks, and the graph view all work.

Conventions

  • Commands are written for a Windows target with a Kali Linux attacker unless noted; adapt IPs, paths, and account names to your environment.
  • IP addresses (10.10.14.7 attacker, 10.10.10.5 target), ports, and account/file names are lab placeholders — replace them with your own.
  • Callouts use GitHub alert syntax (> [!NOTE], > [!WARNING], > [!TIP]) and bold-label blockquotes; both render on GitHub and in Obsidian.
  • Every technique note pairs detection and defense guidance — these are documented to be understood and defended against, not just executed.