the_open_door
coffee
ESEN
← Cheatsheets

Privilege escalation · Windows

Token privileges, services, credentials and exploits, with the real tools and commands from the Windows boxes.

grep>

Enumeration

Enumeration24 commands
  • Current context
  • System & patches
  • Automatic tools (PEAS/PowerUp)
  • Credential hunting
  • AlwaysInstallElevated
  • Quick escalation
  • Utilities

Privileges & services

Token privileges → SYSTEM18 commands
  • Potato (SeImpersonate)
  • Churrasco / FullPowers
  • Print Operators / driver
  • SeManageVolume
  • SeBackup / SeRestore
  • SAM dump after SYSTEM
Services & tasks22 commands
  • Enumerate services
  • weak binPath (unquoted/perms)
  • File permissions
  • DLL hijacking
  • Server Operators
  • Scheduled tasks
  • Autoruns / registry
AlwaysInstallElevated & kernel8 commands
  • AlwaysInstallElevated
  • Kernel

Credentials & execution

Credentials & run-as38 commands
  • Autologon / GPP
  • Search files
  • Password managers
  • IIS
  • History & saved credentials
  • LSASS dump
  • SAM / SYSTEM
  • Browsers & apps
  • DPAPI
  • Run as another user
  • Event log

Other

Evasion (AMSI / AppLocker / Defender)11 commands
  • Defender
  • AMSI
  • AppLocker (LOLBAS)
  • In-memory execution
  • PowerShell (policy/encoding)