🦹
CYBERSECURITY BOOK
  • 👽CS && PEN-TESTING BOOK
    • 🔍Reconnaissance
      • 🈴Passive Recon
        • M365/Azure Tenant Recon
          • MSFTRecon
        • 🕵️OSINT
          • Data Breach and Leaks Resources
          • OSINT Tools and Resources
          • Shodan
          • Creepy
          • The US Army manual ATP 2-22.9
          • NATO OSINT manual
          • Twitter Geolocation
          • Geotagging: GeoSocial Footprint
          • Bitcoin Address Lookup
          • Google Docs OSINT
          • Monitoring Tools
          • TOR Onion Links
          • Phone Numbers
          • Mitaka - In-Browser Tool
          • Russian Target
          • FTP Servers
          • War Related
        • 🎟️ADINT
          • Surveillance
        • 🗺️GEOINT
          • Methodology
          • SunCalc - Geospatial OSINT using shadows
        • ☢️SIGINT
          • Methodology
          • Wifi
            • Kismet
        • ⛓️DNS Recon and Route Mapping
        • 👨‍💼Obtain User Information
        • 🕸️Web Recon
        • 🕷️Scraping Crypto Addresses
        • File Sharing Services
      • ☢️Active Recon
        • 🐹Stealth Scanning Strategies
        • 🏭Identify Network Infrastructure
        • 💻Host Enumeration
        • ⛷️Sparta
        • 🧩Fuzzing
          • ❄️Wfuzz
          • Fuzzing Applications
          • Linux Kernel Fuzzing
          • Fuzzing Chrome V8 Engine
      • ☦️Doxing
        • Doxing Anyone
        • Gmail Address
      • 🎥Surveillance
        • Location Tracking Techniques
    • 🔢Enumeration
      • 🔅Protocols and Ports
        • 21 - FTP
        • 22 - SSH
        • 23 - Telnet
        • 25, 465 - SMTP
        • 110, 143 - POP3, IMAP4
        • 1521 - Oracle DB Server
        • 3306 - Mysql
        • 2375 - Docker
        • 8080, 50000 - Jenkins
        • 80, 443 - HTTP, HTTPS
        • 3389 - RDP
        • 5900 - VNC
        • 445 - SMB
        • 161 UDP - SNMP
        • 11211 - Memcached
        • 2049 - NFS
      • 🐧Linux - POST
      • 🪟Windows - POST
      • 🕸️Web Apps
        • Directory Enumeration
        • Identify Virtual Websites
    • ☮️Public Exploits
      • Look for Public Exploits
      • Metasploit
    • 🕎Vulnerability Scanning
      • ⚛️Nuclei
      • ⛵Tsunami Security Scanner
      • Hunting and Exploiting Vulnerable Windows Drivers
    • 🕳️Tunneling & Exfiltration
      • SSH Tunneling
      • ICMP Exfiltration
      • DNS Exfiltration
      • DNS Tunneling
      • TCP/UDP Tunneling
      • CloudFlare Tunnel
      • SOCKS
      • Ngrok - Port Forwarding
      • CURL - Exfiltration
      • Rclone - Data Exfiltration
      • Data Bouncing - External Data Exfiltration
    • Backdoors
      • Asymmetric Backdoor
    • 🎣Pivoting (Post Exploitation)
      • Using Metasploit
      • SOCKS, SSH - Pivoting
      • Remote Port Forwarding
      • Tool - Chisel
      • Chisel - Double Pivoting
      • Bypassing Firewall with Forward Relays
      • Reverse Relays - Metasploit
      • Pivoting using Ligolo-Ng
    • 🎯Active Directory Pentesting
      • 🔑Crendentials
        • Group Policy Preferences
        • LLMNR Poisoning
        • LDAP (Post)
        • Brute Force
        • LAPS Toolkit
        • PFX File
      • 🐕‍🦺Kerberos Attacks
        • ASREProast
        • Kerberoast
        • Pass the Certificate
      • 🏁AD Post Exploitation
        • Active Directory Post Exploitation
      • ℹ️Introduction to Identities
      • 🔧Testing Active Directory
      • 🎓Advanced Penetration Testing
      • 🔧Automated Tools
        • ADCS Exploitation Tool
        • BadSuccessor – Full Active Directory Compromise
      • Hacking Active Directory Environment
        • 🕵️Enumeration
        • 🦸Exploitation
        • 🚪Privilege Escalation
      • Windows and Active Directory Attacks
        • Shared Local Administrator Password
        • NTLM/SMB Relay
    • 🐳Docker
      • Docker Container
      • Expose Docker Remotely
    • ☸️Kubernetes
      • Basic Commands
    • 🙅‍♂️Social Engineering
      • 🗺️Location Phishing
      • 🧘‍♂️0-Click Email Attack
      • 🐧Binary Linux Trojan
      • 📧Phishing Mail
      • 📁Malicious File
      • ♉Malicious USB Drive
      • 📩Spear-Phishing Methods (VIP)
      • 🧑‍💼Insider Attack
      • Wifi Phishing - Wifiphisher
      • 🔐MFA Bypass
      • Link Attacks
      • 📋Clipboard Hijacking (Post)
      • Copy-Paste Spoofing
    • 🗺️CEH Mindmaps
      • ℹ️Recon and Information Gathering
        • Lab 1: Perform Footprinting Through Search Engines
          • Task 1: Gather Information using Advanced Google Hacking Techniques
          • Task 2: Gather Information from Video Search Engines
          • Task 3: Gather Information from FTP Search Engines
          • Task 4: Gather Information from IoT Search Engines
        • Lab 2: Perform Footprinting Through Web Services
          • Task 1: Find the Company's Domains and Sub-domains using Netcraft
          • Task 2: Gather Personal Information using PeekYou Online People Search Service
          • Task 3: Gather an Email List using theHarvester
          • Task 4: Gather Information using Deep and Dark Web Searching
          • Task 5: Determine Target OS Through Passive Footprinting
        • Lab 3: Perform Footprinting Through Social Networking Sites
          • Task 1: Gather Employee's Information from LinkedIn using theHarvester
          • Task 2: Gather Personal Information from Various Social Networking Sites using Sherlock
          • Task3: Gather Information using Followerwonk
        • Lab 4: Perform Website Footprinting
          • Task 1: Gather Information About a Target Website using Ping Command Line Utility
          • Task 2: Gather Information About a Target Website using Photon
          • Task 3: Gather Information About a Target Website using Central Ops
          • Task 4: Extract a Company's Data using Web Data Extractor
          • Task 5: Mirror a Target Website using HTTrack Web Site Copier
          • Task 6: Gather Information About a Target Website using GRecon
          • Task 7: Gather a Wordlist from the Target Website using CeWL
        • Lab 5: Perform Email Footprinting
          • Task 1: Gather Information about a Target by Tracing Emails using eMailTrackerPro
        • Lab 6: Perform Whois Footprinting
          • Task 1: Perform Whois Lookup using DomainTools
        • Lab 7: Perform DNS Footprinting
          • Task 1: Gather DNS Information using nslookup Command Line Utility and Online
          • Task 2: Perform Reverse DNS Lookup using Reverse IP Domain Check and DNSRecon
          • Task 3: Gather Information of Subdomain and DNS Records using SecurityTrails
        • Lab 8: Perform Network Footprinting
          • Task 1: Locate Network Range
          • Task 2: Perform Network Tracerouting in Windows and Linux Machines
          • Task 3: Perform Advanced Network Route Tracing Using Path Analyzer Pro
        • Lab 9: Perform Footprinting using Various Footprinting Tools
          • Task 1: Footprinting a Target using Recon-ng
          • Task 2: Footprinting a Target using Maltego
          • Task 3: Footprinting a Target using OSRFramework
          • Task 4: Footprinting a Target using FOCA
          • Task 5: Footprinting a Target using BillCipher
          • Task 6: Footprint a Target using OSNIT Framework
      • 🔄Network Scanning
        • Tasks
      • 🔢Enumeration
        • Tasks
      • 👨‍🔧Vulnerability Analysis
        • Tasks
      • 🦸System Hacking
        • Tasks
      • *️Malware Analysis
        • Tasks
      • ❄️Sniffing
        • Tasks
      • 🧑‍🤝‍🧑Social Engineering
        • Tasks
      • 🚫Denial of Service
        • Tasks
      • 🛩️Session Hijacking
        • Tasks
      • 🆔Evading IDS, Firewalls, and Honeypots
        • Tasks
      • 🖥️Web Server Hacking
        • Tasks
      • 🕸️Web Application Hacking
        • Tasks
      • 💉SQL Injection
        • Tasks
      • 👁️‍🗨️Wireless Network Hacking
        • Tasks
      • 📱Mobile Hacking
        • Tasks
      • 👨‍🔬IoT and OT Hacking
        • Tasks
      • ☁️Cloud Computing
        • Tasks
      • 🔏Cryptography
        • Tasks
    • 🗾CND Mindmaps
    • 👿Vulnerability Research
      • 👨‍💻Code Review
    • 📶Network Security
      • 🦝Installing and Configuring Network Based IDS In Ubuntu: Suricata
      • 🏛️OpenSSL
      • 👩‍🚒Active Directory
        • LAPS
    • 🛂Port Forwarding
      • 🐧Linux
      • 🪟Windows
      • 🔄Router
    • 👾API Testing
      • Reverse Engineering
        • Reverse Engineer an API using MITMWEB and POSTMAN
      • API Hacking Basics
        • Practicals
      • 🕵️‍♂️API Recon
      • 📄API Documentation
        • ⚗️Lab: Exploiting an API endpoint using documentation
      • 👨‍🎤Identifying and Interacting with API Endpoint
        • ⚗️Lab: Finding and exploiting an unused API endpoint
      • 🦮Finding Hidden Parameters
      • 🍷Mass assignment vulnerabilities
        • ⚗️Lab: Exploiting a mass assignment vulnerability
      • ✅Preventing vulnerabilities in APIs
      • 😷Server-side parameter pollution
      • 🕵️‍♂️Testing for server-side parameter pollution in the query string
        • ⚗️Lab: Exploiting server-side parameter pollution in a query string
      • 🛣️Testing for server-side parameter pollution in REST paths
      • 🚧Testing for server-side parameter pollution in structured data formats
        • ⚗️Lab: Exploiting server-side parameter pollution in a REST URL
      • 👨‍🚀Testing with automated tools
      • 🚨Preventing server-side parameter pollution
    • 🕸️Web App Pentesting Notes
      • 🧰Web App Pentesting Tools
        • Fuzzing: ffuf Tool
        • Nosql Injection: NoSqlMap
        • Kiterunner
        • Burp Suite
      • ❌XSS and XSRF Together
      • 💉NoSQL Injection
        • NoSQL Databases
        • NoSQL syntax injection
        • NoSQL operator injection
        • Exploit Syntax Injection to Extract Data
        • Exploiting NoSQL operator injection to extract data
        • Timing based injection
        • Preventing NoSQL injection
      • 🧙Cross Site Request Forgery
      • 📼Hidden Parameter Discovery
      • 📌SSTI : Server Side Template Injection
        • Lab: Basic server-side template injection
        • Lab: Basic server-side template injection (code context)
        • Lab: Server-side template injection using documentation
        • Lab: Server-side template injection in an unknown language with a documented exploit
        • Lab: Server-side template injection with information disclosure via user-supplied objects
      • 💎JWT Attack
        • Exploiting flawed JWT signature verification
        • Brute-forcing secret keys
        • JWT header parameter injections
        • Prevent JWT attacks
      • 📊GraphQL API Vulnerabilities
        • Exploiting Unsanitized Arguments
        • Discovering Schema Information
          • Lab: Accessing private GraphQL posts
          • Lab: Accidental exposure of private GraphQL fields
        • Bypassing GraphQL introspection defenses
          • Lab: Finding a hidden GraphQL endpoint
        • Bypassing rate limiting using aliases
          • Lab: Bypassing GraphQL brute force protections
        • GraphQL CSRF
          • Lab: Performing CSRF exploits over GraphQL
      • 🔏Authentication Vulnerabilities
      • 🏇Race Conditions
        • Limit overrun race conditions
        • Multi Endpoint Race Conditions
        • Single Endpoint Race Conditions
        • Time Sensitive Attacks
      • 🧠LLM Attacks
        • Exploiting LLM APIs, functions, and plugins
        • Indirect Prompt Injection
      • ☸️Host Header Attacks
        • Testing for Vulnerability
        • Password Reset Poisoning
        • Web Cache Poisoning
        • Accessing Restricted Functionality
    • 🛩️Wireless Hacking
      • Zigbee Attacks
      • Wifi Attacks
        • Hack WPA2 Networks
        • Automated: Wifite
      • Bluetooth Attacks
        • BlueDucky Script
      • RFID Attacks
    • 🏁CEH Engage Walkthroughs
      • 1️⃣CEH Engage Part 1
      • 2️⃣CEH Engage Part 2
      • 3️⃣CEH Engage Part 3
      • 4️⃣CEH Engage Part 4
    • 🎃Evasion
      • OWASP-ZSC
      • AMSI Bypass
      • Windows Evasion
      • Windows Defender Application Control (WDAC): Killing EDR
      • InvisibilityCloak - C# Obfuscation Toolkit
    • 🚪Post exploitation
      • 🛬Living Off The Land Tools
      • 🥝Mimikatz
      • 🐧Privilege escalation: Linux
      • 🪟Privilege escalation: Windows
      • 👾PAC Tempering
      • Amnesiac - EDR Bypass
      • GraphRunner: A Post-Exploitation Toolset for Microsoft 365
    • 🔓Hashing & Password Cracking
      • Hashing
      • Custom Wordlist
      • Hydra
      • John
      • Windows - Local Password Cracking
      • Password Cracking using Rules
    • 📒Hacking Cheat Sheets
      • 🔍Recon Cheatsheet
      • 🔢Enumeration Cheatsheet
      • 🐚Shells and Reverse Shells Cheat Sheet
      • 🐮Meterpreter Cheat Sheet
      • ☄️Powershell Commands Cheat Sheet
      • 💉Command Injection Cheat Sheet
      • 🪡SQL Injection Cheat Sheet
      • 🐮Metasploit Cheat Sheet
      • 🧰Ethical Hacking Tools
      • 🐧Linux Hacking Basics
      • 🔺MSFVenom
    • 🏇CEH Practical
      • CEH Practical Tools
      • 🔍Network Scanning
      • 🐕‍🦺Service Enumeration
      • 🖊️Stegnography
      • 🔓Cryptography
      • 🕸️Web and Android Hacking
      • 🚪Privilege Escalation
      • 🦄Malware Threats
    • ☁️Cloud Pentesting
      • ✏️AWS Pentesting
        • 🌆AWS Environments
          • Identity and Access Management
          • Identity Based Policies
          • Resource Based Policy
          • Untitled
        • 🧰Tools
          • AWS CLI
          • Pacu
          • Prowler
          • Cloudsplaining
        • Attacks & Methodology
          • 👨‍🔬Exploiting AWS Misconfigurations
          • AWS Pentest Methodology
        • Initial Access
          • Public Access
          • Leaked Secrets
          • Phishing
          • Resource Exploitation
        • Post-Compromise Recon
          • AWS Command Line
          • Resource Enumeration
          • IAM Policy Enumeration
          • Identifying Public Resources
        • S3 Buckets
          • S3 Bucket Misconfiguration
      • 🅰️Azure Pentesting
        • Azure Attack Matrix
        • Stealing Access Tokens
        • Lateral Movement - Skeleton Key Attack
    • 🪟Windows Security
      • 🕵️‍♂️Recon
        • Host Discovery
        • SMB
        • MSSQL
        • IIS
      • 🦹Exploitation
        • CMD Commands
      • 🚪Post Exploitation
        • Dump Password Hashes
        • Mimikatz
      • 🦕Persistence (Post)
        • User Accounts, Hash Cracking, RID Hijacking
        • Backdoors
        • Services
        • Scheduled Tasks
        • Windows Startup
    • 🐧Linux Security
      • 🏋️‍♂️Privilege Escalation
        • 1️⃣1⃣ 1⃣ Exploiting Setuid Programs
        • 2️⃣2⃣ 2⃣ Cron Jobs
        • 3️⃣3⃣ 3⃣ Permissions
        • 4️⃣4⃣ 4⃣ Logs
        • 5️⃣5⃣ 5⃣ Restricted Shell
      • Persistence
        • D3m0n1z3dShell
    • 🍎MacOS Security
      • Endpoint Security
        • eslogger
      • Gaining Access
        • Setup and weaponize Mythic C2 using DarwinOps to target MacOS
    • 📱Android Security
      • Android Pentesting Notes
      • Android Application Pentesting Part 1
        • Static Analysis
        • Dynamic Analysis
      • Android Application Pentesting Part 2
        • Aspects of Android Security
        • Static Application Testing
        • Dynamic Application Testing - Part 1
        • Platform Interaction Testing
        • Dynamic Application Testing - Part 2
        • OWASP Top 10
      • Mobile Application Pentesting Part 3
        • Mobile Security Controls
        • Dynamic Analysis
        • Static Code Analysis
        • Insecure Data Storage
        • Runtime Security
    • 🍎iOS Security
      • iOS Application Analysis
    • 🧾Scripting
      • 💎Ruby
        • Basics
        • Object Types
      • 🐍Python
        • Web Scrapping Scripts
      • 🐧Bash
      • 🐪Perl
      • 🐘PHP
    • 🐉Reverse Engineering & Malware Analysis
      • RE Preparation
        • RE Process
        • Malware Analysis Tools
        • Malware Components: Windows
      • Shellcode Analysis
        • Automated Extraction
      • 1️⃣Disassembly and Disassembler
      • 2️⃣Binary Analysis
      • 🐧Linux ELF Format
      • ♎Yara Guide
      • 📱Android Reverse Engineering
        • Spyware Reverse Engineering
      • 📲Mobile Applications
        • Flutter Mobile Apps
    • 🌠Protocol Exploitation
      • ARP
      • DNS
      • VoIP
    • 🛜Network Pentesting
      • SNMP - Authentification
    • 👮Digital Forensics & Incident Response
      • 📩Email Forensics
        • Callback Phishing
        • Business Email Compromise Investigations
          • Investigating using Hawk
          • Microsoft Defender Explorer
      • 💸Ransomware Forensics
        • Decrypting Intermittent Encryption
      • 💱Blockchain Forensics
        • 🍾Frontrunning/Sandwich Bot Finder
      • 📝Memory Forensics
        • Process
        • Memory Analysis - Volatility3
      • ☄️Network Forensics
        • Pcap Analysis
      • 🪟Windows Forensics
        • NTDS Secret Extraction
        • Detecting Hidden Processes
        • Analyzing Prefetch Files
        • Windows MFT Parsing
        • USN Journal Forensics
      • 📼Media Forensics
        • Rubber Ducky Analysis
        • RDP Bitmap Cache
        • USB Event Tracking
      • 🧙Forensic Imaging
        • Image Analysis: Autopsy
      • 🪅Data Collection
        • 🪟Windows
        • 🐧Unix/Linux
      • 🔏Privacy Research
        • Deanonymization - TOR Hidden Services
        • Deanonymization - Flash Code
        • Dark Web - OSINT
        • Dark Web Investigation
      • 🕸️Web Investigations
        • Investigating Favicon Hashes
      • 🏴‍☠️Threat Detection
        • Reading Clipboard Data via Powershell
        • Detection of Windows Defender Tampering via Powershell
        • Detection of Remote Template Injection
    • 🦋Cisco Attacks
      • Decrypting Type 5 Cisco Passwords
    • 🐼CVE's
      • libssh 0.8.1 - CVE 2018-10933
      • proftpd-1.3.3c-backdoor
      • zerologon - CVE-2020-1472
      • Apache Ghostcat - CVE 2020-1938
      • Spring Authorization Bypass - CVE 2024-38821
      • Apache Solr - CVE-2024-45216
      • Bypassing Mark of the Web with 7zip CVE-2025-0411
      • CVE-2025-24054, NTLM Exploit in the Wild
    • 🐛OWASP TOP 10
      • LLM
        • OWASP Top 10 for LLM Applications
      • Machine Learning
        • OWASP Machine Learning Security Top Ten
      • 🕸️WEB
        • 1️⃣A01:2021 – Broken Access Control
        • 2️⃣A02:2021 – Cryptographic Failures
        • 3️⃣A03:2021 – Injection
        • 4️⃣A04:2021 – Insecure Design
        • 5️⃣A05:2021 – Security Misconfiguration
        • 6️⃣A06:2021 – Vulnerable and Outdated Components
        • 7️⃣A07:2021 – Identification and Authentication Failures
        • 8️⃣A08:2021 – Software and Data Integrity Failures
        • 9️⃣A09:2021 – Security Logging and Monitoring Failures
        • 🔟A10:2021 – Server-Side Request Forgery (SSRF)
      • 🦄API
      • 🌆IoT
      • 📱MOBILE
    • 🛼Web 3 Vulnerabilities
      • Fuzzing Ethereum Smart Contract
      • Static Analysis using Slither
      • Solidity Audit using Mythril
      • 🎆Reentrancy Vulnerabilities
      • 🥪Sandwich Attacks
      • 🌇Integer Attacks
      • 🚂Authorization Issues
      • 🌉Bad Randomness
    • 🛩️Web 3 Smart Contract
      • ⛎Blockchain Hacking (Python)
        • 🌆Smart Contract Template
        • 🎆Interact with ERC20 Tokens
        • 📲Interact with Wallets
        • 🍷Reverse Engineering Bytecode
        • ✒️Sign Transactions
        • 🪢Smart Contract Interactions
        • 🧜‍♀️Subscribing to Events
        • 🟤Brownie Interactions
        • 👾Exploit PoC
    • 🌃Smart Contract Audits
      • 🐸Thunder Loan Audit
        • 1️⃣Initial Review
    • 👩‍💼GRC Frameworks
      • NIST 800-39
      • SOC 2
      • HIPAA
      • PCI-DSS
      • NIST CSF
      • FedRAMP
      • CSA STAR
      • SOX
      • GDPR
      • ISO 27001
  • 🦹REAL WORLD && CTF
    • ⚛️Scripts and Systems
      • R: Code Execution
      • Python2 Input Vulnerability
  • 🦸MISCELLANEOUS
    • Decrypt SSL Traffic
    • 🏦OpenSSL Commands
    • 🔒GPG
    • 🔐SSH Commands
    • OWASP BWAPP Setup
    • Commando VM Setup
    • Living Off The Land Applications
    • 🐧Develop Your Own Linux Distro
    • 🐱GitHub Commands
      • 📔Cheatsheet
  • 🧛‍♂️ADVANCED PERSISTENT THREATS - RESEARCH
    • Reconnaissance
    • Resource Development
    • Initial Compromise
    • Execution
    • Establish persistence
    • Escalate privileges
    • Defense Evasion
    • Credential Access
    • Discovery
    • Lateral movement
    • Collection
    • Command and Control
    • Data exfiltration
    • Impact
  • 👾THREAT HUNTING - RESEARCH
    • MacOS
    • Azure Sentinel
    • Network Data
      • Network Data Sources
      • Network Threat Hunting Too
      • Hunting the Undetected
      • Protocols
      • Network Threat Hunts
    • Active Directory
      • Introduction
      • Threat Hunting
      • Threat Hunting in Active Directory
    • Data Collection
      • Internal Data
      • External Data
        • Private Data Sources
        • Community Data Sources
        • Public Data Sources
      • OSINT
    • Data Management and Processing
      • Data Processing
      • Common CTI Standards
      • Storage and Integration
      • Threat Intelligence Platforms
    • Analysis
      • Introduction
      • Analysis of Competing Hypothesis
      • Cyber Kill Chain and Diamond Model
      • Cyber Kill Chain and Courses of Action
    • Campaign Analysis
      • Introduction
      • Heatmap Analysis
      • Visual Analysis
      • MITRE Threat Group Tracker
      • Threat Intelligence Naming Conventions
    • Attribution
      • Introduction
      • Cognitive Biases
      • Logical Fallacies
      • Manage Biases
      • Nation-State Attribution
    • Dissemination and Sharing
      • Introduction
      • Tactical Intelligence
      • Operational Intelligence
      • Strategic Intelligence
  • 🦅CISA - INCIDENT RESPONSE PLAYBOOK
    • Overview
Powered by GitBook
On this page

Was this helpful?

Edit on GitHub
  1. CS && PEN-TESTING BOOK
  2. Post exploitation

Privilege escalation: Windows

PreviousPrivilege escalation: LinuxNextPAC Tempering

Last updated 1 year ago

Was this helpful?

Windows:

👽
🚪
🪟
https://github.com/pentestmonkey/windows-privesc-check
http://www.fuzzysecurity.com/tutorials/16.html
https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/