windows-privilege-escalation.md (8211B)
1 --- 2 title: "Windows - Privilege Escalation" 3 topic: "Methodology and Resources" 4 topicSlug: "methodology-and-resources" 5 sourcePath: "Methodology and Resources/Windows - Privilege Escalation.md" 6 sourceUrl: "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/3ac27901c711/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md" 7 sha: "3ac27901c711" 8 isReadme: false 9 --- 10 11 # Windows - Privilege Escalation 12 13 :warning: Content of this page has been moved to [InternalAllTheThings/redteam/escalation/windows-privilege-escalation](/internal/redteam/escalation/windows-privilege-escalation) 14 15 - [Tools](/internal/redteam/escalation/windows-privilege-escalation#tools) 16 - [Windows Version and Configuration](/internal/redteam/escalation/windows-privilege-escalation#windows-version-and-configuration) 17 - [User Enumeration](/internal/redteam/escalation/windows-privilege-escalation#user-enumeration) 18 - [Network Enumeration](/internal/redteam/escalation/windows-privilege-escalation#network-enumeration) 19 - [Antivirus Enumeration](/internal/redteam/escalation/windows-privilege-escalation#antivirus-enumeration) 20 - [Default Writeable Folders](/internal/redteam/escalation/windows-privilege-escalation#default-writeable-folders) 21 - [EoP - Looting for passwords](/internal/redteam/escalation/windows-privilege-escalation#eop---looting-for-passwords) 22 - [SAM and SYSTEM files](/internal/redteam/escalation/windows-privilege-escalation#sam-and-system-files) 23 - [HiveNightmare](/internal/redteam/escalation/windows-privilege-escalation#hivenightmare) 24 - [LAPS Settings](/internal/redteam/escalation/windows-privilege-escalation#laps-settings) 25 - [Search for file contents](/internal/redteam/escalation/windows-privilege-escalation#search-for-file-contents) 26 - [Search for a file with a certain filename](/internal/redteam/escalation/windows-privilege-escalation#search-for-a-file-with-a-certain-filename) 27 - [Search the registry for key names and passwords](/internal/redteam/escalation/windows-privilege-escalation#search-the-registry-for-key-names-and-passwords) 28 - [Passwords in unattend.xml](/internal/redteam/escalation/windows-privilege-escalation#passwords-in-unattendxml) 29 - [Wifi passwords](/internal/redteam/escalation/windows-privilege-escalation#wifi-passwords) 30 - [Sticky Notes passwords](/internal/redteam/escalation/windows-privilege-escalation#sticky-notes-passwords) 31 - [Passwords stored in services](/internal/redteam/escalation/windows-privilege-escalation#passwords-stored-in-services) 32 - [Passwords stored in Key Manager](/internal/redteam/escalation/windows-privilege-escalation#passwords-stored-in-key-manager) 33 - [Powershell History](/internal/redteam/escalation/windows-privilege-escalation#powershell-history) 34 - [Powershell Transcript](/internal/redteam/escalation/windows-privilege-escalation#powershell-transcript) 35 - [Password in Alternate Data Stream](/internal/redteam/escalation/windows-privilege-escalation#password-in-alternate-data-stream) 36 - [EoP - Processes Enumeration and Tasks](/internal/redteam/escalation/windows-privilege-escalation#eop---processes-enumeration-and-tasks) 37 - [EoP - Incorrect permissions in services](/internal/redteam/escalation/windows-privilege-escalation#eop---incorrect-permissions-in-services) 38 - [EoP - Windows Subsystem for Linux (WSL)](/internal/redteam/escalation/windows-privilege-escalation#eop---windows-subsystem-for-linux-wsl) 39 - [EoP - Unquoted Service Paths](/internal/redteam/escalation/windows-privilege-escalation#eop---unquoted-service-paths) 40 - [EoP - $PATH Interception](/internal/redteam/escalation/windows-privilege-escalation#eop---path-interception) 41 - [EoP - Named Pipes](/internal/redteam/escalation/windows-privilege-escalation#eop---named-pipes) 42 - [EoP - Kernel Exploitation](/internal/redteam/escalation/windows-privilege-escalation#eop---kernel-exploitation) 43 - [EoP - Microsoft Windows Installer](/internal/redteam/escalation/windows-privilege-escalation#eop---microsoft-windows-installer) 44 - [AlwaysInstallElevated](/internal/redteam/escalation/windows-privilege-escalation#alwaysinstallelevated) 45 - [CustomActions](/internal/redteam/escalation/windows-privilege-escalation#customactions) 46 - [EoP - Insecure GUI apps](/internal/redteam/escalation/windows-privilege-escalation#eop---insecure-gui-apps) 47 - [EoP - Evaluating Vulnerable Drivers](/internal/redteam/escalation/windows-privilege-escalation#eop---evaluating-vulnerable-drivers) 48 - [EoP - Printers](/internal/redteam/escalation/windows-privilege-escalation#eop---printers) 49 - [Universal Printer](/internal/redteam/escalation/windows-privilege-escalation#universal-printer) 50 - [Bring Your Own Vulnerability](/internal/redteam/escalation/windows-privilege-escalation#bring-your-own-vulnerability) 51 - [EoP - Runas](/internal/redteam/escalation/windows-privilege-escalation#eop---runas) 52 - [EoP - Abusing Shadow Copies](/internal/redteam/escalation/windows-privilege-escalation#eop---abusing-shadow-copies) 53 - [EoP - From local administrator to NT SYSTEM](/internal/redteam/escalation/windows-privilege-escalation#eop---from-local-administrator-to-nt-system) 54 - [EoP - Living Off The Land Binaries and Scripts](/internal/redteam/escalation/windows-privilege-escalation#eop---living-off-the-land-binaries-and-scripts) 55 - [EoP - Impersonation Privileges](/internal/redteam/escalation/windows-privilege-escalation#eop---impersonation-privileges) 56 - [Restore A Service Account's Privileges](/internal/redteam/escalation/windows-privilege-escalation#restore-a-service-accounts-privileges) 57 - [Meterpreter getsystem and alternatives](/internal/redteam/escalation/windows-privilege-escalation#meterpreter-getsystem-and-alternatives) 58 - [RottenPotato (Token Impersonation)](/internal/redteam/escalation/windows-privilege-escalation#rottenpotato-token-impersonation) 59 - [Juicy Potato (Abusing the golden privileges)](/internal/redteam/escalation/windows-privilege-escalation#juicy-potato-abusing-the-golden-privileges) 60 - [Rogue Potato (Fake OXID Resolver)](/internal/redteam/escalation/windows-privilege-escalation#rogue-potato-fake-oxid-resolver)) 61 - [EFSPotato (MS-EFSR EfsRpcOpenFileRaw)](/internal/redteam/escalation/windows-privilege-escalation#efspotato-ms-efsr-efsrpcopenfileraw)) 62 - [PrintSpoofer (Printer Bug)](/internal/redteam/escalation/windows-privilege-escalation#PrintSpoofer-Printer-Bug))) 63 - [EoP - Privileged File Write](/internal/redteam/escalation/windows-privilege-escalation#eop---privileged-file-write) 64 - [DiagHub](/internal/redteam/escalation/windows-privilege-escalation#diaghub) 65 - [UsoDLLLoader](/internal/redteam/escalation/windows-privilege-escalation#usodllloader) 66 - [WerTrigger](/internal/redteam/escalation/windows-privilege-escalation#wertrigger) 67 - [WerMgr](/internal/redteam/escalation/windows-privilege-escalation#wermgr) 68 - [EoP - Privileged File Delete](/internal/redteam/escalation/windows-privilege-escalation#eop---privileged-file-delete) 69 - [EoP - Common Vulnerabilities and Exposures](/internal/redteam/escalation/windows-privilege-escalation#eop---common-vulnerabilities-and-exposure) 70 - [MS08-067 (NetAPI)](/internal/redteam/escalation/windows-privilege-escalation#ms08-067-netapi) 71 - [MS10-015 (KiTrap0D)](/internal/redteam/escalation/windows-privilege-escalation#ms10-015-kitrap0d---microsoft-windows-nt2000--2003--2008--xp--vista--7) 72 - [MS11-080 (adf.sys)](/internal/redteam/escalation/windows-privilege-escalation#ms11-080-afd.sys---microsoft-windows-xp-2003) 73 - [MS15-051 (Client Copy Image)](/internal/redteam/escalation/windows-privilege-escalation#ms15-051---microsoft-windows-2003--2008--7--8--2012) 74 - [MS16-032](/internal/redteam/escalation/windows-privilege-escalation#ms16-032---microsoft-windows-7--10--2008--2012-r2-x86x64) 75 - [MS17-010 (Eternal Blue)](/internal/redteam/escalation/windows-privilege-escalation#ms17-010-eternal-blue) 76 - [CVE-2019-1388](/internal/redteam/escalation/windows-privilege-escalation#cve-2019-1388) 77 - [EoP - $PATH Interception](/internal/redteam/escalation/windows-privilege-escalation#eop---path-interception) 78 - [References](/internal/redteam/escalation/windows-privilege-escalation#references)