Skip to main content
Everything here is based on the informations gathered on the Windows OS Enumeration page: an enabled token privilege, a weak service permission, a writable registry key. Token privileges themselves (SeBackupPrivilege, SeDebugPrivilege, SeImpersonatePrivilege, etc.) have their own page, see Windows User Rights Assignment, this page covers the misconfigurations and exploits around them instead: services, UAC, autoruns, DLL hijacking, and known local-privesc CVEs. Also check HackTricks Windows PrivEsc techniques.

Misconfiguration-Based

Weak service/registry permissions, insecure autoruns, DLL search order. No exploit code needed beyond a payload binary.

Exploit & CVE-Based

UAC bypasses and specific vulnerabilities (PrintNightmare) that need a known technique matched to the exact build.

​
Automated Privesc Audit Tools

Worth running one of these before manually working through the sections below, each flags likely privesc vectors directly rather than requiring them to be spotted by hand. winPEAS - already covered on Windows OS Enumeration
PowerUp - the original PowerShell privesc audit script, checks services, DLL hijack opportunities, registry autoruns, and scheduled tasks in one pass.
PrivescCheck - a more actively maintained, broader successor to PowerUp, worth running
SharpUp - a .NET port covering roughly the same ground as PowerUp, useful when PowerShell execution is restricted.
If you have a meterpreter session you can use the post/multi/recon/local_exploit_suggester module

​
UAC

User Account Control gates elevated actions behind a consent prompt, a process running at a lower integrity level can’t silently reach into one running higher, until a specific bypass breaks that separation.
Also worth checking, since either one changes how remote admin logons are treated:

​
Bypassing It

Known UAC bypasses are tied to the exact Windows build, so get the version first:
The UACME project maintains every known bypass technique indexed by ID, cross-referenced against the affected build and whether Microsoft has patched it. Once the right ID is found there:

​
Insecure Service Permissions

Two separate things can go wrong with a service’s permissions, either is enough to run arbitrary code as whatever account the service runs as (frequently SYSTEM).

​
Weak Permissions on the Service Itself

If the current user can reconfigure the service’s binary path, point it at a custom command and restart the service to trigger it:

​
Weak Permissions on the Service’s Executable File

If the config itself is locked down but the binary it points to is writable, replace the binary instead of reconfiguring the service.
The swapped binary is a payload, not the real service, so once the Service Control Manager starts it, it never calls back to report “running” the way an actual service does. The SCM gives it a short window (by default around 30 seconds) before deciding the service failed to start and killing the process, taking the meterpreter session down with it.
Start a listener, restart the service (or wait for it to restart) through services.msc or sc.exe, and the moment the callback catches, migrate out of the payload process immediately (migrate -N lsass.exe in Meterpreter, or into any other stable, long-running process) before that window closes. There’s no usable warning when it’s about to die, only the fixed timeout, so migrate directly rather than waiting to see if the session looks stable.

​
Weak Permissions on the Service’s Registry Key

Same idea, as above: if HKLM\SYSTEM\CurrentControlSet\Services itself is writable for a given service, the ImagePath value can be overwritten directly, no sc.exe access needed at all.

​
Registry Autoruns

A binary path listed in one of these registry keys runs automatically, at whatever privilege the triggering context grants, writable or hijackable autoruns are a reliable persistence/privesc primitive:
KeyRuns as
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWhoever logs in, system-wide
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunThe current user only
HKLM\SYSTEM\CurrentControlSet\ServicesThe service’s configured account (see above)
If the key itself (not just the value) is writable, either add a new autorun entry pointing at a payload, or overwrite an existing entry’s path, via regedit or Set-ItemProperty the same way as the service ImagePath trick above.
Also worth a quick look while enumerating what runs automatically:

​
DLL Hijacking

If a privileged process loads a DLL by name rather than full path, and a directory earlier in its search order is writable, a malicious DLL dropped there with the same name runs in that process’s context.
Trigger whatever restarts the target process (a service restart, a scheduled task, a reboot) to get it loaded.

​
AlwaysInstallElevated

If this policy is enabled, any user, regardless of their own privileges, can install an .msi package with SYSTEM rights, Windows trusts the installer itself rather than the installing user.

​
PrintNightmare

The Print Spooler attack covered in full on AD Known Vulnerabilities works the same way locally, used to add a local administrator instead of compromising a Domain Controller:

​
Quick Reference Tools

LOLBAS

Lookup table for abusing legitimate Windows binaries, useful alongside several techniques above.

UACME

Indexed list of every known UAC bypass technique by Windows build.

PowerUp

Automated local privesc audit, see above.