The goal and the mindset
An initial foothold is almost never enough. Phishing a help-desk account, exploiting a web app, or cracking a weak service login typically lands you as a low-privilege user or a service account — you can execute commands, but you cannot read other users' data, you cannot dump cached credentials, and you certainly cannot disable the endpoint agent watching you. The objective of privilege escalation is to climb from that position to Administrator, or to the highest prize on a Windows box: the SYSTEM account, which owns the operating system itself.
The single most important mental shift is this: escalation on Windows is mostly about finding misconfiguration, not writing exploits. The dramatic image of a hand-crafted memory-corruption exploit is the rare case. The common case is far more mundane and far more reliable — a service installed into a world-writable folder, a credential left in a config file, a scheduled task running as SYSTEM that any user can edit. The host has already been set up insecurely; your job is to notice that and use it.
Enumerate first — you cannot escalate what you have not mapped
Every successful escalation starts with reconnaissance of the host you already control. You cannot exploit a misconfiguration you never found, so before you reach for any attack you build a complete picture of who you are, what you can touch, and how the box is patched. A handful of built-in commands answer the first questions instantly:
- whoami /priv — lists the privileges held by your current token. This is the first thing to read; a single dangerous privilege like SeImpersonatePrivilege can be a direct path to SYSTEM.
- whoami /groups — shows your group memberships and integrity level, telling you what you already have access to and whether you are running elevated.
- systeminfo — dumps the OS version, architecture, and installed hotfixes, which is exactly what you need to judge the host's patch level and whether known kernel exploits apply.
Manual checks are precise but slow. To cover a host at scale you lean on enumeration tools that run hundreds of checks in seconds and flag the promising findings for you. The standard kit:
- WinPEAS — the workhorse. It sweeps services, permissions, stored credentials, scheduled tasks, and more, and colour-codes anything that looks exploitable.
- Seatbelt — a survey tool that gathers a broad set of security-relevant host facts, useful for building the full situational picture.
- PowerUp — a PowerShell script focused specifically on common privilege-escalation misconfigurations, often with a built-in way to abuse what it finds.
The classic escalation routes
Most Windows escalations fall into a small, well-worn set of misconfiguration categories. Learn this table and you can recognise the win the moment your enumeration tool surfaces it. Each row is one route, how it actually grants you elevation, and the check or tool that reveals it.
| Route | How it works | Check / tool |
|---|---|---|
| Unquoted service path | A service path with spaces and no quotes lets Windows try each partial path in turn. If you can write to an earlier folder, you plant a binary that runs with the service's privileges. | WinPEAS · wmic service |
| Weak service permissions | If a low-privilege user can modify a service's configuration, you point its binary path at your own payload and restart it to run as the service account. | PowerUp · accesschk |
| AlwaysInstallElevated | Two registry keys that let any user install MSI packages as SYSTEM. When both are set, a crafted installer simply runs elevated. | reg query · WinPEAS |
| DLL hijacking / writable PATH | A program loads a DLL by name from a folder you can write to. Drop a malicious DLL with that name and your code runs in the program's context. | Process Monitor · WinPEAS |
| Stored credentials | Passwords left in the registry, unattended-install files, or saved credential stores. Found, they are reused directly against higher-privileged accounts. | unattend.xml · cmdkey /list |
| Scheduled tasks as SYSTEM | A task that runs as SYSTEM but whose script or binary a low-privilege user can edit. Modify what it runs, wait for the trigger, inherit SYSTEM. | schtasks · WinPEAS |
| Unpatched kernel exploit | A missing patch leaves a known kernel vulnerability exploitable. The last resort when configuration is clean — noisier and riskier, but decisive. | systeminfo · exploit suggester |
The first six rows are all misconfiguration — mistakes in how the host was built, fixable with a setting. Only the last depends on a software flaw. That ratio is the whole point: most of the time you are exploiting an administrator's oversight, not a vendor's bug.
Token impersonation — the service-account special case
One escalation path is common enough, and reliable enough, to deserve its own section. Service accounts that run web servers and databases are frequently granted SeImpersonatePrivilege — a privilege that, by design, lets a service act on behalf of a client that connects to it. It is exactly what a web or SQL service legitimately needs, and it is also a direct ramp to SYSTEM. If whoami /priv shows this privilege enabled, you are very often one step from owning the box.
The idea behind the attack is straightforward even though the plumbing is intricate. A privileged Windows component — one running as SYSTEM — can be coerced into authenticating to a service the attacker controls. When it does, it hands over an authentication token. An account holding SeImpersonatePrivilege is allowed to impersonate that token, and impersonating a SYSTEM token means becoming SYSTEM. You did not break any cryptography or corrupt any memory; you convinced a powerful process to introduce itself, then borrowed its identity.
This family of techniques is known by a memorable name — the “Potato” attacks — and the tooling has evolved as Microsoft has closed individual variants:
- PrintSpoofer — coerces the print spooler service into authenticating, the go-to on modern Windows where older variants are patched.
- JuicyPotato — the classic of the family, effective on older systems by abusing a SYSTEM-level component.
- RoguePotato — a refresh that revives the technique against newer builds where the original was blocked.
The shortcut — and the defensive flip
When you already have an interactive post-exploitation session, some of this work is automated for you. The getsystem command will cycle through several well-known elevation techniques and try each one until it lands, and the local exploit suggester compares the host's patch level against a database of known privilege-escalation exploits to tell you which are likely to work. These are accelerators, not magic — they automate the common paths you have just learned, and understanding what they attempt is what lets you fall back to manual escalation when they fail.
Now flip the whole lesson around, because every route above is also a defensive checklist. The same misconfigurations you hunt for are the ones a hardened host simply does not have:
- Least privilege — users and service accounts get only the rights they need, so a foothold has nowhere to climb. This alone defangs the Potato family.
- Service hardening — quote service paths, lock down who can modify service configuration, and install software into protected directories to kill the path, permission, and DLL routes.
- Prompt patching — a current host has no exploitable kernel vulnerability for the suggester to find.
- Remove stored credentials — clear out unattended-install files, registry secrets, and saved credentials so there is nothing to harvest and reuse.
Escalation is the pivot of post-exploitation: once you hold SYSTEM, you can dump every credential on the host, disable defenses, and reach across the network. That is exactly where this track goes next — turning a single owned host into durable access and a foothold on its neighbours through persistence and lateral movement.