Windows Privilege Escalation: Complete Methodology 2026

Why an attacker needs it

A web shell as a service account cannot dump LSASS, read another user's registry hive, install a driver, or disable Defender. SYSTEM removes every one of those limits and unlocks credential theft.

Why a defender studies it

Every vector here is a hardening item and a detection rule. If you know how PrintSpoofer, an unquoted service path, or GPP cpassword is abused, you know exactly what to audit and alert on.

Why OSCP cares

The exam scores full marks only on the SYSTEM/root proof. A foothold gets partial credit; the escalation half is where candidates lose points by guessing instead of enumerating.

Why it precedes the domain

Local SYSTEM lets you harvest cached credentials, machine account hashes and Kerberos tickets — the fuel for lateral movement and the jump from one endpoint to Domain Admin.

Pull the standard escalation binaries once and keep them in a folder you serve over HTTP. WinPEAS and PowerUp do the enumeration; accesschk.exe (Sysinternals) checks ACLs; the Potato family and PrintSpoofer abuse impersonation privileges. Match the architecture — grab the x64 build unless the target is 32-bit.

Windows has no wget, but it ships several downloaders. PowerShell's Invoke-WebRequest is the default; certutil is the classic fallback that survives on Server Core; SMB is the fastest when outbound HTTP is filtered. Drop files somewhere you can execute from, such as C:\Windows\Temp.

WinPEAS colour-codes findings — red/yellow highlights are the ones worth chasing. PowerUp's Invoke-AllChecks is a quieter PowerShell-only second opinion that also generates ready-made abuse functions. Run both; note every service, writable path, stored credential and dangerous privilege it prints.

Capture systeminfo verbatim — you feed it to a missing-patch mapper in Phase 04. Confirm the OS build, architecture and hotfix list. On a real host the "Hotfix(s)" line is often the fastest route to a kernel exploit.

The single most important command in this entire guide is whoami /priv. If it lists SeImpersonatePrivilege, SeBackupPrivilege, SeDebugPrivilege, SeRestorePrivilege or SeTakeOwnershipPrivilege as Enabled, you have a near-guaranteed path to SYSTEM (Phase 06). Then map your groups and any local admins you might already sit near.

Windows Exploit Suggester — Next Generation (WES-NG) parses systeminfo output offline and lists the CVEs the host is missing a fix for, ranked by whether a public exploit exists. Watson and the Metasploit local_exploit_suggester do the same from an active session.

Do not fire the first result blindly. Cross-check the CVE against a trustworthy write-up and prefer exploits with a clean reputation for the exact build. The table below lists common, NVD-confirmed Windows local-privilege-escalation CVEs you will meet in labs and on real hosts — each has public tooling and, for several, in-the-wild abuse.

If a service's binary path contains a space and is not wrapped in quotes, the SCM tries each space-delimited prefix as an executable. Drop a payload named for that prefix in a writable parent directory and the service launches it as SYSTEM on next start. It is old, but it still appears on real corporate hosts, third-party installers and OSCP boxes.

Say the result is C:\Program Files\Vuln Service\service.exe running auto-start. If you can write to C:\Program Files\Vuln Service\, the SCM will try C:\Program Files\Vuln.exe first, then C:\Program Files\Vuln Service\service.exe. Check the ACL, plant the payload, restart.

If your user has SERVICE_CHANGE_CONFIG on a SYSTEM service, you do not need to touch its files — just repoint its binary. accesschk shows which services you can reconfigure. Set binPath to your command, restart, and the SCM runs it as the service account.

Two adjacent misconfigurations: the service's executable file is writable by you (replace it directly), or the service's registry key under HKLM\SYSTEM\CurrentControlSet\Services is writable (edit ImagePath yourself). PowerUp flags both as "ModifiableServiceFile" and "ModifiableService".

Programs that autostart from an HKLM Run key or a scheduled task run as whoever logs in — often an admin — or as SYSTEM. If the referenced binary or its folder is writable by you, replace it and wait for the trigger. Enumerate both, then check the ACL on whatever they point at.

A privileged process that loads a DLL by name (not full path) searches its own directory and the PATH first. If any of those locations is writable and the DLL is missing there, drop a malicious one with the right export table and it loads at SYSTEM. Procmon (in a lab) reveals "NAME NOT FOUND" on DLL loads — those are your candidates.

A privilege that is present but Disabled still counts — most tools enable it on the fly. What you need is for it to appear at all in the token. Re-run the one command that matters and read the state column.

With SeImpersonatePrivilege, the Potato family coerces a SYSTEM process into authenticating to you, then impersonates its token. PrintSpoofer abuses the print spooler's named pipe; GodPotato works across modern builds via DCOM; RoguePotato is the fallback when the local spooler path is blocked. Any one drops a SYSTEM shell.

SeBackupPrivilege lets you read any file regardless of its ACL. Copy the SAM and SYSTEM registry hives, exfil them, and dump the local hashes offline with Impacket. The local Administrator hash then unlocks a pass-the-hash into a SYSTEM shell (Phase 09).

SeDebugPrivilege lets you open any process, including LSASS, which holds the plaintext-adjacent credentials of everyone logged on. Snapshot it with the signed procdump (quieter than touching mimikatz on disk) and parse the dump on Kali with pypykatz.

The Windows Credential Manager can hold cached admin logons. cmdkey /list shows stored targets; if an administrator credential is saved, you can run a command as that account without ever knowing the password using runas /savecred.

If the box auto-logs-in, the account and its cleartext password sit in the Winlogon registry key. PuTTY sessions, older VNC installs and saved WiFi profiles leak secrets the same way. Query them directly.

On domain-joined hosts, legacy Group Policy Preferences pushed local-admin passwords in Groups.xml on SYSVOL, AES-encrypted with a key Microsoft published. Any domain user can read SYSVOL, grab the cpassword value, and decrypt it instantly.

On unpatched Windows 10/11 builds, the SAM, SYSTEM and SECURITY hives were readable by non-administrators — icacls showed BUILTIN\Users with read access where there should be none. If Volume Shadow Copies exist, you copy the hives out of a snapshot and dump them offline, no admin needed.

Deployment leaves credentials in files. Unattend.xml, sysprep.xml and autounattend.xml can contain a base64 local-admin password; application web.config, .git folders and PowerShell history frequently hold connection strings and API keys. Grep the disk.

When the host is domain-joined and AD Certificate Services is present, a standard user can escalate to Domain Admin by abusing machine-account certificate enrolment — the Certifried flaw. It is out of scope for pure local SYSTEM, but if your enumeration shows a CA, note it: local SYSTEM plus ADCS is frequently a direct line to the domain.

If both the HKCU and HKLM AlwaysInstallElevated policy values are 1, any user can install an MSI that runs as SYSTEM. This is a full escalation from a standard account — no admin group needed. Check both keys; you need both set.

When your account is already an administrator but running at Medium IL, an auto-elevating binary such as fodhelper.exe can be hijacked through a writable registry key it reads, launching your command at High IL without a UAC prompt. This only works because you already hold admin rights.

If you can write to a folder a privileged scheduled task runs from, or to the All Users Startup directory, your payload executes on the next trigger or logon under a higher-privileged context. Confirm the write, drop the payload, and wait.

With local-admin rights or the Administrator hash, PsExec launches a shell as SYSTEM (-s) with the built-in service manager. If you only have a hash, Impacket's psexec/wmiexec pass it directly — no cracking required.

Capture the SYSTEM identity, the hostname and the proof file in one screenshot — an assessor wants to see nt authority\system next to the flag, not a bare hash. Then undo every change you made: restore reconfigured services, delete planted binaries and hijack keys, and remove any account you added.

The two highest-signal detections are a service binary being repointed and a SYSTEM child process spawned from a service account (the Potato pattern). Run the KQL in Microsoft Sentinel / Defender and the SPL equivalent in Splunk.

The fodhelper bypass writes a very specific registry path that no legitimate software touches, and sc config/new-service events are rare enough to alert on directly. These two catch Phases 05 and 08.