XUTS LABS
Back to Red Team Playbooks
Privilege EscalationRed Team Playbook

Windows Privilege Escalation

Triage Windows local privilege escalation with evidence-first checks before exploit selection.

WindowsPrivilege EscalationServices

Purpose

Identify service, token, credential, patch, and misconfiguration paths from a Windows shell.

Inputs

  • - current user
  • - hostname
  • - OS build
  • - network context

Prerequisites

  • - Windows shell
  • - User context
  • - Rules for local enumeration tools

Operator Assumptions

  • - Manual commands come before heavy scripts on monitored hosts.
  • - Exploit choice depends on OS build and privileges.

Commands

Identity and privileges

Target shell
whoami /all

Why: Record groups, privileges, and integrity level.

Expected: User SID, group memberships, token privileges.

System info

Target shell
systeminfo

Why: Capture OS build and patch context.

Expected: OS version, hotfixes, architecture.

Service permissions

Target shell
sc.exe query state= all

Why: Start service misconfiguration review.

Expected: Installed service inventory.

Decision Points

  • - If SeImpersonatePrivilege exists, validate service context before potato-style paths.
  • - If writable service path exists, create an explicit proposal before mutation.
  • - If creds are found, validate scope before reuse.

Follow-On Actions

  • - Evidence note
  • - Finding candidate
  • - Report remediation

Evidence To Capture

  • - whoami /all
  • - systeminfo
  • - service ACLs
  • - file ACL proof

Common Failures

  • - PowerShell execution policy
  • - EDR blocks upload
  • - Architecture mismatch

Operational Cautions

  • - Do not run kernel exploits without explicit approval.
  • - Avoid destructive service changes.

Related Content

Windows Privilege EscalationAsk EXO