Windows Local Privilege Escalation

Why it matters

PEN-200 explicitly covers Windows privilege escalation after initial compromise, including enumeration, services, scheduled tasks, and exploit usage.

How to identify it

• Run whoami /all
• Check privileges
• Check services
• Check scheduled tasks
• Search config files

Expected output

• Interesting privileges
• Writable service path
• Stored creds
• Scheduled task misconfig

Success looks like

• Administrator shell
• NT AUTHORITY\\SYSTEM shell
• proof.txt readable

Failure looks like

• No obvious privesc after first pass
• AV blocks payload
• Access denied

Troubleshooting

• Use manual commands before automated tools
• Check architecture
• Use built-in commands if AV blocks scripts

Common mistakes

• Not checking whoami /priv
• Not checking service binary permissions
• Not checking ProgramData
• Not checking PowerShell history

Alternative attacks

• SeImpersonate
• Writable services
• Scheduled tasks
• Unquoted service paths

What to try next

• SeImpersonate
• Writable services
• Proof collection
• Credential hunting