Windows local privilege escalation: user to admin to SYSTEM, the small tricks

You have a shell on a Windows host as some low-privilege user or service account. As on Linux, the box already carries what you need to map it: whoami, sc, reg, schtasks, wmic, and PowerShell. This walks the built-in enumeration, then the documented hops from user to Administrator or SYSTEM. It is written for pentesters, and every step closes with the signal it leaves, because that signal is what a defender watches for. Exploit code for the named CVE and token classes is not carried here; this is the misconfiguration surface and how to recognize it.

Orientation

whoami /all
systeminfo
hostname & echo %USERNAME% & echo %PATH%

whoami /all is the single most useful command: it lists your groups and, under Privileges, the tokens that decide several of the tricks below.

Enumeration with built-ins

:: Token privileges (SeImpersonate, SeBackup, SeRestore, SeTakeOwnership ...)
whoami /priv

:: Services: unquoted paths outside C:\Windows, and non-standard binaries
wmic service get Name,PathName,StartMode | findstr /i /v "C:\Windows\\"

:: Scheduled tasks and the binary each runs
schtasks /query /fo LIST /v | findstr /i "TaskName Run As"

:: AlwaysInstallElevated (both keys = 1 means any MSI runs as SYSTEM)
reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 2>nul
reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 2>nul

:: Stored credentials and secrets left lying around
cmdkey /list
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword 2>nul
where /r C:\ unattend.xml sysprep.xml 2>nul

:: Patch level for version-based exploits
wmic qfe get HotFixID,InstalledOn

:: Network and local accounts
ipconfig /all & netstat -ano
net user & net localgroup administrators

(wmic is deprecated and absent from current Windows 11 builds; where it is gone, Get-CimInstance Win32_Service and Get-HotFix are the PowerShell equivalents.)

PowerShell adds history and credential stores:

Get-Content (Get-PSReadlineOption).HistorySavePath

From a finding to admin or SYSTEM: small tricks

Each needs a specific finding above. These are documented and ordinary; the fix line is the point for defenders.

Unquoted service path with a writable gap. A service PathName like C:\Program Files\My App\svc.exe is unquoted and you can write to C:\Program Files\ (or an earlier segment). Windows tries C:\Program.exe first:

:: drop your payload where the space splits the path, then restart the service
copy payload.exe "C:\Program.exe"
sc stop myservice & sc start myservice

Detect: service start whose image path resolves to an unexpected binary; event 7045/7036; a new exe at a path segment. Fix: quote every service binPath.

Weak service permissions. accesschk (or sc sdshow) shows you can reconfigure or restart a service. Point it at your command:

sc config myservice binPath= "C:\Windows\Temp\payload.exe"
sc stop myservice & sc start myservice

Detect: sc config changing a binPath (4697/7045), a service running a Temp-dir binary. Fix: remove SERVICE_CHANGE_CONFIG/WRITE_DAC from non-admins.

Writable service binary or scheduled-task target. The exe a service or a SYSTEM scheduled task runs is writable by you. Replace it, wait for or trigger the run. Detect: modification of a service/task binary, 4698 task changes. Fix: ACL service and task binaries to admins only.

AlwaysInstallElevated. Both registry keys are 1, so any MSI installs as SYSTEM:

msiexec /quiet /qn /i C:\Windows\Temp\evil.msi

(The MSI is a standard packaged action; building it is out of scope here.) Detect: msiexec installing from a user-writable path, 4688 with that command line, 1033/1040 MsiInstaller events. Fix: never enable this policy; it is a direct SYSTEM grant.

Token privileges: the Potato class. A service account with SeImpersonate or SeAssignPrimaryToken (IIS, MSSQL, and similar run with it) can impersonate SYSTEM. The public tools for this are the Potato family and PrintSpoofer; they are referenced here by name, not carried. Detect: a service account spawning a child as SYSTEM, named-pipe or RPC coercion patterns, Sysmon process-create with a SYSTEM parent mismatch. Fix: keep SeImpersonate on as few accounts as possible and isolate those services. A related token-to-SYSTEM primitive is SeTcbPrivilege to SYSTEM.

SeBackup / SeRestore. These let you read any file. Copy the registry hives and pull hashes offline:

reg save HKLM\SAM sam.save & reg save HKLM\SYSTEM system.save

(Offline extraction is done with the usual public tooling, referenced not carried.) Detect: reg save of SAM/SYSTEM, access to the hives by a non-admin. Fix: do not grant backup rights to interactive users. The offline-extraction and detection half is in Windows credential access.

Stored credentials. cmdkey /list shows saved creds, unattend.xml and Winlogon DefaultPassword leak plaintext, and PowerShell history often holds secrets. Reuse them with runas or remote auth. Detect: credential-store reads, runas from an unusual account. Fix: scrub unattend files, never store autologon passwords, clear histories.

Kernel and known CVEs. When the configuration is clean, systeminfo plus the hotfix list from wmic qfe bounds version-based local-root exploits (the printnightmare, hivenightmare, and similar classes target specific builds). No exploit code here: identify the build, check whether a maintained public exploit matches, detect the known artifacts, and patch so the build no longer qualifies.

Detection

Turn on command-line process auditing (4688 with the full command line) and Sysmon; most of the above is invisible without them.

• Service changes. 7045 (service installed) and 4697, plus sc config or a binPath pointing into a user-writable directory, are the service-abuse signals.
• Scheduled tasks. 4698/4702 for task creation and change; a task whose action is a user-writable binary.
• Privilege use. 4672 (special privileges assigned at logon) and 4673 for sensitive-privilege use flag the token tricks; a service account suddenly holding or using SYSTEM is the tell.
• MSI and process lineage. msiexec from a Temp path, and Sysmon process-create events where a service or msiexec parents a shell, tie the MSI and service tricks together.
• Hive and credential access. reg save of SAM or SYSTEM, and reads of unattend.xml or the Winlogon password value, are narrow and high-signal.

Correlate: a low-privilege logon, then a service reconfiguration or an MSI install from Temp, then a process running as SYSTEM, is the full chain.

Hardening, briefly

Quote every service path and ACL service and task binaries to administrators; never set AlwaysInstallElevated; keep SeImpersonate, SeBackup, and SeRestore off interactive and low-trust accounts; scrub unattend and autologon secrets; patch so version-based exploits close; and enable 4688 command-line auditing plus Sysmon so the chain above is recorded. The aim is to shrink what any single finding escalates to and to make the attempt visible.

Use

Authorized and educational use only: your own systems, a lab you control, or an engagement with written permission. These are enumeration commands and documented misconfiguration hops for a host you are authorized to assess, shown with their detection so defenders can close and watch them, not for use against systems you do not own.