Windows Privilege Escalation

Windows privilege escalation enumeration starts by running whoami, whoami /priv, and net user to map current user rights, token privileges, and group memberships on the target host. This reveals misconfigurations and potential elevation paths for further exploitation.

Service misconfigurations are identified by systematically enumerating Windows services and their permissions to detect unquoted paths, weak service ACLs, or insecure binary paths. This skill maps those misconfiguration abuse techniques to determine viable escalation paths.

Token impersonation leverages enumerated user rights and token privileges to hijate or duplicate access tokens of higher-privileged processes. This skill documents how to reveal these token manipulation vectors during security assessments.

Yes, credential discovery is a core workflow step. The skill provides workflows for credential access on Windows hosts with limited access, allowing testers to locate sensitive data and determine if harvested credentials enable further elevation.

Performing Windows kernel exploit enumeration requires specified tooling, proper authorization for the engagement, and safe handling of sensitive data. The skill outlines these prerequisites before mapping kernel-related escalation vectors.

You should check for Windows privilege escalation paths when you have achieved limited user access on a Windows host during a security assessment and need to systematically determine if misconfigurations or kernel exploits allow elevation.