Windows Privilege Escalation

When to Activate

• Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM
• Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding SeImpersonatePrivilege
• Standard-user → admin via UAC bypass (medium → high integrity) on a local-admin-group member
• Service / DLL / scheduled-task misconfiguration hunting on the host
• Kernel EoP via an unpatched local CVE or Bring-Your-Own-Vulnerable-Driver (admin → kernel/PPL)
• Privileged token-right abuse (SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug)
• Local credential harvesting (LSASS, SAM/SYSTEM, DPAPI) to fuel lateral movement

Technique Map