Windows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato exploits, service misconfigurations, DLL hijacking, UAC bypass, or registry autoruns.

SKILL: Windows Local Privilege Escalation — Expert Attack Playbook AI LOAD INSTRUCTION : Expert Windows privesc techniques. Covers token manipulation, Potato family, service misconfigurations, DLL hijacking, AlwaysInstallElevated, scheduled task abuse, registry autoruns, and named pipe impersonation. Base models miss nuanced privilege prerequisites and OS version specific constraints. 0. RELATED ROUTING Before going deep, consider loading: [windows lateral movement](../windows lateral movement/SKILL.md) after escalation for pivoting to other hosts [windows av evasion](../windows av evasion/SKILL.md) when AV/EDR blocks your privesc tools [active directory kerberos attacks](../active directory kerberos attacks/SKILL.md) when the host is domain joined and you need AD level escalation [active directory acl abuse](../active directory acl abuse/SKILL.md) for domain privilege escalation via ACL misconfigurations Advanced Reference Also load [TOKEN POTATO TRICKS.md](./TOKEN POTATO TRICKS.md) when you need: Detailed Potato family comparison (JuicyPotato → GodPotato evolution) OS version specific exploit selection Required privileges and protocol details per variant Also load [UAC BYPASS METHODS.md](./UAC BYPASS METHODS.md) when you need: UAC bypass technique matrix (fodhelper, eventvwr, sdclt, etc.) Auto elevate binary abuse Mock trusted directory tricks 1. ENUMERATION CHECKLIST System Context Token Privileges (Critical) Privilege Escalation Path SeImpersonatePrivilege Potato family exploits (§2) SeAssignPrimaryTokenPrivilege Token manipulation, Potato variants SeDebugPrivilege Dump LSASS, inject into SYSTEM processes SeBackupPrivilege Read any file (SAM/SYSTEM/NTDS.dit) SeRestorePrivilege Write any file (DLL hijack, service binary) SeTakeOwnershipPrivilege Take ownership of any object SeLoadDriverPrivilege Load vulnerable kernel driver → kernel exploit Services & Scheduled Tasks Installed Software & Patches Network & Credentials 2. TOKEN MANIPULATION & POTATO EXPLOITS SeImpersonatePrivilege Abuse Service accounts (IIS AppPool, MSSQL, etc.) typically hold SeImpersonatePrivilege . This enables impersonation of any token presented to you. Tool OS Support Protocol Notes JuicyPotato Win7–Server2016 COM/DCOM Requires valid CLSID; patched on Server2019+ RoguePotato Server2019+ OXID resolver redirect Needs controlled machine on port 135 PrintSpoofer Win10/Server2016 2019 Named pipe via Print Spooler Simple, fast; Spooler must run SweetPotato Broad COM + Print + EFS Combines multiple techniques GodPotato Win8–Server2022 DCOM RPCSS Works on latest patched systems SeDebugPrivilege Abuse 3. SERVICE MISCONFIGURATIONS Unquoted Service Paths If path is C:\Program Files\My App\service.exe , Windows tries: 1. C:\Program.exe 2. C:\Program Files\My.exe 3. C:\Program Files\My App\service.exe Place malicious binary at first writable location. Weak Service Permissions Writable Service Binaries 4. DLL HIJACKING DLL Search Order (Standard) 1. Directory of the executable 2. C:\Windows\System32 3. C:\Windows\System 4. C:\Windows 5. Current directory 6. Directories in %PATH% Exploitation Known Phantom DLL Targets Application Missing DLL Drop Location Various .NET apps profapi.dll Application directory Windows services wlbsctrl.dll %PATH% writable dir Third party updaters VERSION.dll Application directory 5. ALWAYSINSTALLELEVATED 6. SCHEDULED TASK ABUSE Scheduled Task via PowerShell 7. REGISTRY AUTORUNS If an autorun entry points to a writable path → replace binary or inject new entry. 8. NAMED PIPE IMPERSONATION Custom named pipe server (requires SeImpersonatePrivilege): 9. AUTOMATED TOOLS Tool Purpose Command winPEAS Comprehensive Windows enumeration winPEASx64.exe PowerUp Service/DLL/registry misconfig checks Invoke AllChecks Seatbelt Security focused host survey Seatbelt.exe group=all SharpUp C port of PowerUp checks SharpUp.exe audit PrivescCheck PowerShell privesc checker Invoke PrivescCheck BeRoot Common misconfig finder beRoot.exe 10. PRIVILEGE ESCALATION DECISION TREE

windows-privilege-escalation