A Repeatable Windows Privesc Method
The win is almost always in the first ten minutes of enumeration. Here is the order that finds it.
What you will learn
- -Enumerate a Windows host in the order that surfaces the fastest win
- -Read whoami output for the privileges and groups that matter
- -Decide when to run an automated script versus check by hand
You landed a as a low-priv user on a Windows box. Maybe it's iis apppool\web from a web , maybe a from a captured hash. The instinct is to run WinPEAS and scroll. Resist it. You further, faster, by checking a handful of things in a fixed order, because the same five misconfigurations account for most Windows wins on real engagements.
Start with who you are. Not "which user", but which privileges and groups that user carries. That single command decides your whole path.
$whoami /privIf SeImpersonatePrivilege shows Enabled, stop reading and go to the lesson. That's a near-guaranteed on most Windows boxes and it's faster than anything else you'll find. Service accounts and IIS pools have it by default.
Next, your groups. Membership decides which files and services you can touch.
$whoami /groupsThen the OS itself. Patch level tells you whether a kernel exploit is even worth trying, and it usually isn't the first move, but knowing the build saves you from chasing a patched bug.
$systeminfo$wmic qfe get HotFixIDThe order that pays
Work the cheap, high-hit checks before the slow ones. This is the sequence I run on every box:
whoami /privandwhoami /groups. Impersonation or Backup Operators ends the hunt early.- Services. Weak service permissions and unquoted paths are the most common real-world win. Next lesson.
- autoruns and
AlwaysInstallElevated. One registry pair can hand you a SYSTEM MSI. - Stored . Unattend files,
cmdkey, saved RDP and browser creds. - Scheduled tasks running as a higher user with a writable script or binary.
- Kernel and OS exploits, last. Loud, crash-prone, and usually patched.
Only after those do I let an automated script confirm what I missed. WinPEAS is a checker, not a strategy. Run it to catch the thing you skipped, not to think for you.
$.\winPEASx64.exe quietEvery technique in this module gives you SYSTEM on a Windows . Run it only on machines you own or have explicit written permission to test, like an HTB box or a lab VM. Escalating privileges on a system you were not authorized to touch is a crime in most jurisdictions.
Read WinPEAS or seatbelt output in your own editor, not the target's terminal. to a file, exfil it, and search it locally. You spot patterns in a text editor that scroll right past you in a shell.
Your shell is an IIS application pool account. What is the single most valuable first command?
On a lab Windows VM, run whoami /priv and whoami /groups. Write down every privilege marked Enabled and every non-default group. For each one, name which lesson in this module it points you toward.