Privilege escalation is one of the most crucial phases in penetration testing and red teaming. Gaining initial access to a system is just the first step; the real power lies in escalating privileges to obtain deeper control over the target. Windows, being a widely used OS in corporate environments, offers multiple vectors for privilege escalation, and in this blog post, I'll explore some of the most common and effective techniques.

Why Privilege Escalation Matters

As a penetration tester, gaining a foothold with limited user privileges is often not enough. Many security measures restrict the actions of non-admin users, making privilege escalation essential to bypass security controls, access sensitive data, move laterally across a network, and gain persistence for long-term access.

Windows provides various mechanisms that attackers (and security professionals) can abuse to escalate privileges. Let's break down some key techniques.

Exploiting Misconfigurations

Service Misconfigurations

Improperly configured services can often be leveraged for privilege escalation. Two of the most common misconfigurations are unquoted service paths - if a service executable's path contains spaces and isn't enclosed in quotes, an attacker might be able to insert a malicious executable and gain SYSTEM privileges - and weak service permissions, where a low-privileged user with write access to a service's binary or configuration can replace it with a malicious file and restart the service to execute their payload with higher privileges.

sc qc vulnerable_service
icacls "C:\Program Files\Vulnerable App\service.exe"

If the output shows write permissions for low-privileged users, privilege escalation is possible.

Abusing Dangerous Privileges

Windows provides a range of privileges that, if assigned to the wrong user or exploited, can result in full system compromise. Let's explore some of the most powerful ones.

Backup Privilege & Restore Privilege

These privileges allow a user to read and write any file on the system, regardless of NTFS permissions. While normally intended for backup software, attackers can abuse them to access sensitive files like SAM, SYSTEM, and SECURITY hives.

reg save HKLM\SAM C:\temp\sam.hiv
reg save HKLM\SYSTEM C:\temp\system.hiv

With the saved hives, tools like secretsdump.py can extract credentials.

Take Ownership Privilege

This allows a user to take ownership of any file or folder on the system, granting full control and the ability to modify or delete crucial system files.

takeown /f C:\Windows\System32\config\SAM
icacls C:\Windows\System32\config\SAM /grant user:F

Now the user has full access to the SAM database.

Impersonate Privilege & Assign Primary Token Privilege

These privileges allow a user to impersonate other accounts, including SYSTEM. They are commonly exploited using techniques like JuicyPotato, RoguePotato, and PrintSpoofer.

whoami /priv | findstr SeImpersonate

If enabled, an attacker can use token impersonation to escalate privileges.

Credential Harvesting

Sometimes, credentials are stored in predictable locations, making them easy targets for attackers - saved passwords in registry hives like HKLM:\SAM or HKLM:\SECURITY, plaintext credentials left behind in easily accessible files by applications or admins, and process memory, most notably LSASS, which can be dumped to extract credentials directly.

tasklist /svc | findstr lsass
rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump 1234 C:\temp\lsass.dmp full

(Requires administrative privileges.)

Unpatched Software Exploitation

Outdated software presents a major security risk. Many applications are not updated as frequently as the OS, making them vulnerable to known exploits. Attackers use tools like wmic to list installed software and check for publicly available vulnerabilities.

wmic product get name,version,vendor

Once an attacker has identified installed software, they can search for known exploits using resources like Exploit-DB, Packet Storm, or Google.

Case Study: Druva inSync 6.6.3

Druva inSync 6.6.3 had a known privilege escalation vulnerability. The application ran an RPC server on port 6064, allowing remote execution of commands as SYSTEM. By exploiting this, an attacker could gain full control over the machine.

A patch was issued, but attackers found a path traversal bug that allowed them to execute arbitrary commands, bypassing the patch. The key takeaway? Even patched software can still be vulnerable due to incomplete fixes.

Tools of the Trade

WinPEAS (Windows Privilege Escalation Awesome Script) is a powerful enumeration tool that scans the system for misconfigurations, weak service permissions, and exploitable vulnerabilities, and provides a clear output with privilege escalation paths.

PrivescCheck is a script designed to identify privilege escalation vectors on Windows systems, checking for vulnerable services, misconfigurations, and dangerous privileges assigned to users.

WES-NG (Windows Exploit Suggester - Next Generation) is a post-exploitation tool that compares Windows system patch levels against known vulnerabilities, and by analyzing installed updates, suggests potential exploits.

Metasploit, meanwhile, is a widely used penetration testing framework that includes modules for privilege escalation and can automate the process of exploiting misconfigurations, dangerous privileges, and software vulnerabilities.

Final Thoughts

Privilege escalation is a critical step in post-exploitation, and Windows provides numerous avenues for attackers to elevate access. Whether through exploiting misconfigurations, abusing inherent privileges, or leveraging vulnerable software, understanding these techniques allows penetration testers to simulate real-world attacks and help organizations strengthen their defenses.

The key takeaway here is: never assume a system is secure just because a user has limited privileges. One overlooked misconfiguration, outdated software, or excessive privilege can lead to full system compromise.

I'll be adding more practical examples and real-world case studies in future posts. If you've encountered interesting privilege escalation scenarios, feel free to share your experiences!

Stay curious, stay secure.

challenges