checklist-windows-privilege-escalation.md (11056B)
1 --- 2 title: "Checklist - Local Windows Privilege Escalation" 3 section: "Windows" 4 sectionSlug: "windows-hardening" 5 sourcePath: "src/windows-hardening/checklist-windows-privilege-escalation.md" 6 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/windows-hardening/checklist-windows-privilege-escalation.md" 7 sha: "188de82beb54e70956b2952367a0af91d26758b8" 8 isIndex: false 9 modified: true 10 license: "CC-BY-NC-4.0" 11 --- 12 13 # Checklist - Local Windows Privilege Escalation 14 15 ### **Best tool to look for Windows local privilege escalation vectors:** [**WinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS) 16 17 ### [System Info](windows-local-privilege-escalation/index.html#system-info) 18 19 - [ ] Obtain [**System information**](windows-local-privilege-escalation/index.html#system-info) 20 - [ ] Search for **kernel** [**exploits using scripts**](windows-local-privilege-escalation/index.html#version-exploits) 21 - [ ] Use **Google to search** for kernel **exploits** 22 - [ ] Use **searchsploit to search** for kernel **exploits** 23 - [ ] Interesting info in [**env vars**](windows-local-privilege-escalation/index.html#environment)? 24 - [ ] Passwords in [**PowerShell history**](windows-local-privilege-escalation/index.html#powershell-history)? 25 - [ ] Interesting info in [**Internet settings**](windows-local-privilege-escalation/index.html#internet-settings)? 26 - [ ] [**Drives**](windows-local-privilege-escalation/index.html#drives)? 27 - [ ] [**WSUS exploit**](windows-local-privilege-escalation/index.html#wsus)? 28 - [ ] [**Third-party agent auto-updaters / IPC abuse**](/hacktricks/windows-hardening/windows-local-privilege-escalation/abusing-auto-updaters-and-ipc) 29 - [ ] [**AlwaysInstallElevated**](windows-local-privilege-escalation/index.html#alwaysinstallelevated)? 30 31 ### [Logging/AV enumeration](windows-local-privilege-escalation/index.html#enumeration) 32 33 - [ ] Check [**Audit** ](windows-local-privilege-escalation/index.html#audit-settings)and [**WEF** ](windows-local-privilege-escalation/index.html#wef)settings 34 - [ ] Check [**LAPS**](windows-local-privilege-escalation/index.html#laps) 35 - [ ] Check if [**WDigest** ](windows-local-privilege-escalation/index.html#wdigest)is active 36 - [ ] [**LSA Protection**](windows-local-privilege-escalation/index.html#lsa-protection)? 37 - [ ] [**Credentials Guard**](windows-local-privilege-escalation/index.html#credentials-guard)[?](windows-local-privilege-escalation/index.html#cached-credentials) 38 - [ ] [**Cached Credentials**](windows-local-privilege-escalation/index.html#cached-credentials)? 39 - [ ] Check if any [**AV**](https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/windows-hardening/windows-av-bypass/README.md) 40 - [ ] [**AppLocker Policy**](/hacktricks/windows-hardening/authentication-credentials-uac-and-efs/overview#applocker-policy)? 41 - [ ] [**UAC**](https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control/README.md) 42 - [ ] [**Admin Protection / UIAccess silent elevation**](/hacktricks/windows-hardening/windows-local-privilege-escalation/uiaccess-admin-protection-bypass)?<sup>[[1]](#references)</sup> 43 - [ ] [**Secure Desktop accessibility registry propagation (RegPwn)**](/hacktricks/windows-hardening/windows-local-privilege-escalation/secure-desktop-accessibility-registry-propagation-regpwn)?<sup>[[2]](#references)</sup> 44 - [ ] [**User Privileges**](windows-local-privilege-escalation/index.html#users-and-groups) 45 - [ ] Check [**current** user **privileges**](windows-local-privilege-escalation/index.html#users-and-groups) 46 - [ ] Are you [**member of any privileged group**](windows-local-privilege-escalation/index.html#privileged-groups)? 47 - [ ] Check if you have [any of these tokens enabled](windows-local-privilege-escalation/index.html#token-manipulation): **SeImpersonatePrivilege, SeAssignPrimaryPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege** ? 48 - [ ] Check if you have [**SeManageVolumePrivilege**](/hacktricks/windows-hardening/windows-local-privilege-escalation/semanagevolume-perform-volume-maintenance-tasks) to read raw volumes and bypass file ACLs 49 - [ ] [**Users Sessions**](windows-local-privilege-escalation/index.html#logged-users-sessions)? 50 - [ ] Check[ **users homes**](windows-local-privilege-escalation/index.html#home-folders) (access?) 51 - [ ] Check [**Password Policy**](windows-local-privilege-escalation/index.html#password-policy) 52 - [ ] What is[ **inside the Clipboard**](windows-local-privilege-escalation/index.html#get-the-content-of-the-clipboard)? 53 54 ### [Network](windows-local-privilege-escalation/index.html#network) 55 56 - [ ] Check **current** [**network** **information**](windows-local-privilege-escalation/index.html#network) 57 - [ ] Check **hidden local services** restricted to the outside 58 59 ### [Running Processes](windows-local-privilege-escalation/index.html#running-processes) 60 61 - [ ] Processes binaries [**file and folders permissions**](windows-local-privilege-escalation/index.html#file-and-folder-permissions) 62 - [ ] [**Memory Password mining**](windows-local-privilege-escalation/index.html#memory-password-mining) 63 - [ ] [**Insecure GUI apps**](windows-local-privilege-escalation/index.html#insecure-gui-apps) 64 - [ ] Steal credentials with **interesting processes** via `ProcDump.exe` ? (firefox, chrome, etc ...) 65 66 ### [Services](windows-local-privilege-escalation/index.html#services) 67 68 - [ ] [Can you **modify any service**?](windows-local-privilege-escalation/index.html#permissions) 69 - [ ] [Can you **modify** the **binary** that is **executed** by any **service**?](windows-local-privilege-escalation/index.html#modify-service-binary-path) 70 - [ ] [Can you **modify** the **registry** of any **service**?](windows-local-privilege-escalation/index.html#services-registry-modify-permissions) 71 - [ ] [Can you take advantage of any **unquoted service** binary **path**?](windows-local-privilege-escalation/index.html#unquoted-service-paths) 72 - [ ] [Service Triggers: enumerate and trigger privileged services](/hacktricks/windows-hardening/windows-local-privilege-escalation/service-triggers) 73 74 ### [**Applications**](windows-local-privilege-escalation/index.html#applications) 75 76 - [ ] **Write** [**permissions on installed applications**](windows-local-privilege-escalation/index.html#write-permissions) 77 - [ ] [**Startup Applications**](windows-local-privilege-escalation/index.html#run-at-startup) 78 - [ ] **Vulnerable** [**Drivers**](windows-local-privilege-escalation/index.html#drivers) 79 80 ### [DLL Hijacking](windows-local-privilege-escalation/index.html#path-dll-hijacking) 81 82 - [ ] Can you **write in any folder inside PATH**? 83 - [ ] Is there any known service binary that **tries to load any non-existent DLL**? 84 - [ ] Can you **write** in any **binaries folder**? 85 86 ### [Network](windows-local-privilege-escalation/index.html#network) 87 88 - [ ] Enumerate the network (shares, interfaces, routes, neighbours, ...) 89 - [ ] Take a special look at network services listening on localhost (127.0.0.1) 90 91 ### [Windows Credentials](windows-local-privilege-escalation/index.html#windows-credentials) 92 93 - [ ] [**Winlogon** ](windows-local-privilege-escalation/index.html#winlogon-credentials)credentials 94 - [ ] [**Windows Vault**](windows-local-privilege-escalation/index.html#credentials-manager-windows-vault) credentials that you could use? 95 - [ ] Interesting [**DPAPI credentials**](windows-local-privilege-escalation/index.html#dpapi)? 96 - [ ] Passwords of saved [**Wifi networks**](windows-local-privilege-escalation/index.html#wifi)? 97 - [ ] Interesting info in [**saved RDP Connections**](windows-local-privilege-escalation/index.html#saved-rdp-connections)? 98 - [ ] Passwords in [**recently run commands**](windows-local-privilege-escalation/index.html#recently-run-commands)? 99 - [ ] [**Remote Desktop Credentials Manager**](windows-local-privilege-escalation/index.html#remote-desktop-credential-manager) passwords? 100 - [ ] [**AppCmd.exe** exists](windows-local-privilege-escalation/index.html#appcmd-exe)? Credentials? 101 - [ ] [**SCClient.exe**](windows-local-privilege-escalation/index.html#scclient-sccm)? DLL Side Loading? 102 103 ### [Files and Registry (Credentials)](windows-local-privilege-escalation/index.html#files-and-registry-credentials) 104 105 - [ ] **Putty:** [**Creds**](windows-local-privilege-escalation/index.html#putty-creds) **and** [**SSH host keys**](windows-local-privilege-escalation/index.html#putty-ssh-host-keys) 106 - [ ] [**SSH keys in registry**](windows-local-privilege-escalation/index.html#ssh-keys-in-registry)? 107 - [ ] Passwords in [**unattended files**](windows-local-privilege-escalation/index.html#unattended-files)? 108 - [ ] Any [**SAM & SYSTEM**](windows-local-privilege-escalation/index.html#sam-and-system-backups) backup? 109 - [ ] If [**SeManageVolumePrivilege**](/hacktricks/windows-hardening/windows-local-privilege-escalation/semanagevolume-perform-volume-maintenance-tasks) is present, try raw-volume reads for `SAM`, `SYSTEM`, DPAPI material, and `MachineKeys` 110 - [ ] [**Cloud credentials**](windows-local-privilege-escalation/index.html#cloud-credentials)? 111 - [ ] [**McAfee SiteList.xml**](windows-local-privilege-escalation/index.html#mcafee-sitelist.xml) file? 112 - [ ] [**Cached GPP Password**](windows-local-privilege-escalation/index.html#cached-gpp-pasword)? 113 - [ ] Password in [**IIS Web config file**](windows-local-privilege-escalation/index.html#iis-web-config)? 114 - [ ] Interesting info in [**web** **logs**](windows-local-privilege-escalation/index.html#logs)? 115 - [ ] Do you want to [**ask for credentials**](windows-local-privilege-escalation/index.html#ask-for-credentials) to the user? 116 - [ ] Interesting [**files inside the Recycle Bin**](windows-local-privilege-escalation/index.html#credentials-in-the-recyclebin)? 117 - [ ] Other [**registry containing credentials**](windows-local-privilege-escalation/index.html#inside-the-registry)? 118 - [ ] Inside [**Browser data**](windows-local-privilege-escalation/index.html#browsers-history) (dbs, history, bookmarks, ...)? 119 - [ ] [**Generic password search**](windows-local-privilege-escalation/index.html#generic-password-search-in-files-and-registry) in files and registry 120 - [ ] [**Tools**](windows-local-privilege-escalation/index.html#tools-that-search-for-passwords) to automatically search for passwords 121 122 ### [Leaked Handlers](windows-local-privilege-escalation/index.html#leaked-handlers) 123 124 - [ ] Have you access to any handler of a process run by administrator? 125 126 ### [Pipe Client Impersonation](windows-local-privilege-escalation/index.html#named-pipe-client-impersonation) 127 128 - [ ] Check if you can abuse it 129 130 ## References 131 132 - [1] [Project Zero - Bypassing Administrator Protection by Abusing UI Access](https://projectzero.google/2026/02/windows-administrator-protection.html) 133 - [2] [MDSec - RIP RegPwn](https://www.mdsec.co.uk/2026/03/rip-regpwn/)