Local Privilege Escalation Techniques – Windows Edition

Hacking 101 Post-Exploitation Windows Attack
  • UAC and bypass
  • Access Token Manipulation
  • Exposed credentials (Azure, PowerShell history,…)
  • Missing patches
  • Automated deployment and Autologon passwords in clear text
  • AlwaysInstallElevated (Any User can run MSI as System)
  • Misconfigured Services
  • Unquoted path
  • DLL Hijacking



Get services with unquoted paths and a space in their name

Get-ServiceUnquoted -Verbose

Get services where the currentuser can write to its binary path or change argument to the binary

Get-ModifiableServicefile -Verbose

Get the services whose configuration current user can modify

Get-ModifiableService -Verbose

Open a reverse shell listening using powercat

powercat -l -p 4444 -v -t 1024

Leave a Reply

Your email address will not be published. Required fields are marked *