Privilege Escalation · Learn

Windows privilege escalation.

On Windows, the goal is SYSTEM. Attackers get there through impersonation privileges and Potato attacks, weak service permissions, unquoted service paths, AlwaysInstallElevated, DLL hijacking, and UAC bypasses. Here is the plain-language map and how to enumerate for it.

Privilege Escalation · LearnAll services
TL;DR

Windows privilege escalation is how an attacker goes from a standard user to SYSTEM or local Administrator. The frequent paths are token-impersonation privileges (SeImpersonate) abused through Potato attacks, weak service permissions, unquoted service paths, the AlwaysInstallElevated policy, DLL hijacking, and UAC bypasses. As on Linux, it is mostly enumeration: list privileges, services, and writable locations until a path to SYSTEM appears. Scripts like winpeas automate the sweep.

By John Dill, Red Team Lead, SecureLayer7Updated

The goal: become SYSTEM

On Windows the most powerful local account is NT AUTHORITY\SYSTEM, even higher than a normal administrator. An attacker with a limited shell wants SYSTEM so they can dump credentials (the SAM and LSASS), install persistence, and pivot.

Windows escalation leans heavily on privileges, services, and how programs find the files they load.

The common escalation paths

The recurring Windows privesc vectors, each with its own page:

  • SeImpersonatePrivilege: a privilege common on service accounts. Details.
  • Potato attacks: tools that turn SeImpersonate into SYSTEM. Details.
  • Weak service permissions: a service you can reconfigure. Details.
  • Unquoted service paths: a path with spaces that lets you plant an executable. Details.
  • AlwaysInstallElevated: MSI packages that install as SYSTEM. Details.
  • DLL hijacking: a program loading a DLL from a writable path. Details.
  • UAC bypass: elevating without a prompt. Details.
  • Dangerous privileges: SeBackup, SeRestore, SeDebug and more. Details.

Enumeration: where it starts

Windows escalation starts by listing privileges, services, and writable spots. Common first commands:

  • whoami /priv to list the current token’s privileges
  • whoami /groups for group membership
  • wmic service get name,pathname,startmode to find service paths
  • systeminfo to check the patch level
  • check writable service binaries and HKLM/HKCU install policy

The PEAS script winpeas automates this. The skill is spotting which privilege or service actually reaches SYSTEM.

References

  1. [1]MITRE ATT&CK: Privilege Escalation (TA0004)(MITRE)
  2. [2]Microsoft: Privilege Constants (Windows)(Microsoft)
  3. [3]NIST SP 800-115 Technical Guide to Security Testing(NIST)
Related terms

Common questions

Privilege escalation, asked often

Want your systems tested for these paths?

Scope an engagement

Find the privilege-escalation paths before an attacker does.

We run internal and host penetration tests that walk the real route from a low-privileged foothold to root or SYSTEM, then hand your team a report with reproducible evidence and a fix for every step. Free re-test included.

See all services30-min scoping call, fixed-price proposal in 48 hours.