Typorithm · hard

Windows PrivEsc

windows-privescpentestwindowstokensservices

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Windows PrivEsc

Privilege Escalation

Windows escalation on an authorized test abuses token privileges (SeImpersonate enables potato-style attacks), unquoted service paths, weak service permissions, and AlwaysInstallElevated. winpeas enumerates them, and each maps to a concrete fix — quote service paths, restrict ACLs, and drop dangerous privileges.

On Windows, escalation during an engagement often abuses the access token. whoami /priv shows the token's privileges, and SeImpersonate being enabled allows potato-style attacks that coerce a privileged service into yielding a SYSTEM token.

Other classic paths are configuration flaws: an unquoted service path lets Windows run an attacker-placed binary, weak service ACLs let a user reconfigure a service, and the AlwaysInstallElevated policy installs MSI packages as SYSTEM. winpeas enumerates all of these.

Each finding has a direct remediation in the report: quote service paths, restrict service ACLs to administrators, disable AlwaysInstallElevated, and remove dangerous privileges like SeImpersonate from accounts that do not need them.

SeImpersonate enables potato-style token abuse.

Unquoted paths and weak ACLs let users run as SYSTEM.

Fix: quote paths, restrict ACLs, drop privileges.

.\winpeas.exe
whoami /priv
# SeImpersonate -> potato-style token abuse
# unquoted service paths, AlwaysInstallElevated

Read the implementation

Connect each part of the code to the concept before you type.

1. Automated enumeration

winpeas enumerates Windows escalation paths — token privileges, weak service ACLs, unquoted paths, and registry flags — in one run.

.\winpeas.exe

2. List token privileges

whoami /priv lists the current token's privileges; SeImpersonate or SeAssignPrimaryToken being enabled is a known escalation path.

whoami /priv

3. Token abuse

With SeImpersonate enabled, potato-style attacks trick a privileged service into handing over a SYSTEM token.

# SeImpersonate -> potato-style token abuse

4. Service & policy flaws

An unquoted service path or the AlwaysInstallElevated policy lets a low-privileged user run code as SYSTEM.

# unquoted service paths, AlwaysInstallElevated

5. The enumeration binary

winpeas.exe is the Windows counterpart to linpeas, collecting the same class of misconfigurations.

winpeas.exe

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.