Your shell is unstable, the clock is ticking, and a generic windows privilege escalation checklist is burning time you don’t have. Running every enumeration script in alphabetical order works fine for research. It fails during a timed assessment where minutes decide your score. You need a triage sequence that prioritizes high-probability vectors over exhaustive coverage, and filters noise before it turns into a rabbit hole.
This guide assumes you’ve already established a foothold and managed to stabilize your reverse shell so commands execute reliably without dropping your session. We focus strictly on the decision logic you need when standard enumeration returns nothing obvious, moving from fast manual checks to targeted automation only after you’ve established a baseline.
Triage Order Over Raw Technique Lists
Why Enumeration Sequence Matters Under Exam Pressure
Dumping tools blindly ignores the reality that exam environments test methodology, not just tool proficiency. MITRE ATT&CK defines privilege escalation as techniques adversaries use to gain higher-level permissions on a system or network, and the framework emphasizes systematic enumeration over opportunistic exploitation. Six hours into an engagement with no root flag, the gap between passing and failing often comes down to whether you verified a finding manually or chased a false positive from an automated scanner.
You can’t treat every output line as equally valid when your 24-hour exam pacing strategy demands constant forward momentum. A structured approach forces you to validate quick wins first. Deeper investigation only happens after you’ve ruled out or exploited the surface-level misconfigurations.
The High-Yield First Pass
Start every Windows privesc exam engagement with native commands that return instantly and need no file transfer. Uploading binaries triggers AV and burns minutes you don’t have. This initial phase establishes your user context, group memberships, and enabled privileges before you introduce external variables that might alert defensive mechanisms or crash a fragile service. Exam methodology prioritizes checking existing privileges via whoami /priv before you run automated scripts at all, which keeps you from triggering defensive alerts for no reason.
whoami /priv
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
net localgroup administrators
These three commands tell you if you hold SeImpersonatePrivilege, whether the OS version is vulnerable to known kernel exploits, and whether you’re already closer to admin than you realize. If whoami /priv shows disabled privileges, stop looking at token impersonation. Pivot immediately to service misconfigurations or stored credentials instead of forcing a path that doesn’t exist.
Service Misconfiguration Privesc Vectors
Service misconfiguration privesc remains the most reliable vector on OSCP and CPTS boxes because it relies on administrator error, not unpatched binaries. Automated scanners flag these issues constantly, but they rarely distinguish between a theoretical vulnerability and one you can actually exploit given your current write permissions.
Unquoted Service Path Exploitation
An unquoted service path is only exploitable if you have write access to the specific directory where Windows will search for the missing binary component. Verify this manually with icacls on each folder segment in the path before you attempt to plant a malicious executable. Assume write access based on the path string alone, and you’ll waste a cycle on a failed exploitation attempt.
wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\\Windows\\" | findstr /i /v "\""
icacls "C:\Program Files\Vulnerable App"
If icacls doesn’t explicitly show (W) or (M) for your user or a group you belong to, the unquoted service path is a dead end regardless of what winPEAS reported. Move on immediately rather than trying to force permission changes the exam environment never intended you to make.
Modifiable Service Binaries and Registry Keys
Direct binary replacement requires full write access to the executable itself. Registry-based modification targets the ImagePath value under HKLM\SYSTEM\CurrentControlSet\Services instead. Both vectors look identical in automated output but need completely different verification steps and exploitation payloads, so confusing them wastes time crafting the wrong attack.
Check registry permissions with reg query and accesschk before touching the binary. Modifying a protected registry key generates logs and may trigger alerts even if the change fails. If you can modify the ImagePath but not the binary, create a new service entry pointing to your reverse shell executable and restart the service through sc stop and sc start.
AlwaysInstallElevated Policy Abuse
AlwaysInstallElevated lets any user install MSI packages with SYSTEM privileges, but the policy must be enabled in both Computer Configuration and User Configuration at once to function. Scanners often report it as enabled when only one half of the requirement is met, which leads to failed installation attempts that look like syntax errors.
Verify both registry keys manually before generating a malicious MSI payload, since building and transferring installers takes real time compared to other vectors. If either key returns 0x0 or is missing entirely, this vector is dead and you should drop it without further testing.
Token Impersonation Privesc Workflows
Token impersonation privesc depends entirely on which specific privileges your account holds and which Windows version you’re targeting. Pick the wrong tool for your privilege set and you fail immediately; pick the right one and you get SYSTEM in seconds.
Identifying Impersonation Privileges
SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege are distinct capabilities that need different exploitation approaches, yet plenty of candidates treat them as interchangeable. Review your whoami /priv output carefully to determine which capability is actually enabled. PrintSpoofer requires SeImpersonatePrivilege, while older JuicyPotato variants needed SeAssignPrimaryTokenPrivilege.
Disabled privileges in the output mean the token exists but can’t be used for impersonation attacks until something enables it. Don’t waste time on token tools if these privileges are absent. Pivot to credential hunting or service abuse instead of hunting for exotic enablement techniques that rarely show up in certification exams.
PrintSpoofer and JuicyPotatoNG Selection
| Tool | Required Privilege | Supported Versions | CLSID Dependency |
|---|---|---|---|
| PrintSpoofer | SeImpersonatePrivilege | Server 2016-2022, Win 10-11 | None |
| JuicyPotatoNG | SeImpersonatePrivilege | Server 2016-2022, Win 10-11 | Optional |
| GodPotato | SeImpersonatePrivilege | Server 2012 R2-2022, Win 8-11 | Auto-resolved |
| SweetPotato | SeImpersonatePrivilege | Mixed legacy/modern | Built-in |
GodPotato currently offers the broadest compatibility across exam-relevant Windows versions because it automatically resolves valid CLSIDs without manual enumeration. Use PrintSpoofer as your second choice on modern systems where GodPotato fails, and reserve JuicyPotatoNG only for environments where you’ve already confirmed working CLSIDs through prior recon.
Scheduled Task Privesc and Persistence Checks
Scheduled task privesc targets custom tasks created by administrators, not the default Windows tasks, which are usually locked down correctly. These custom tasks often run as SYSTEM with modifiable binaries or arguments, which makes them high-value targets that generic checklists frequently skip.
Enumerating Custom Scheduled Tasks
Filter scheduled tasks down to the ones running with elevated privileges and non-standard paths. Sifting through hundreds of default Microsoft tasks manually is impossible inside exam constraints. The verbose list format exposes the command line, run-as user, and next run time in a single view, which makes anomalies visible immediately.
schtasks /query /fo LIST /v | findstr /i "TaskName Run: User/Author Command"
Focus exclusively on tasks where the “Run As User” field shows SYSTEM or Administrator and the command path points outside System32. Default Windows tasks in System32 are almost never the intended vector. Investigating them burns time better spent on custom application directories.
File Permission Weaknesses in Task Actions
The executable or script referenced in a scheduled task action is only exploitable if you can modify it or replace it entirely. Check NTFS permissions on the exact file path shown in the task properties, including any batch files or PowerShell scripts the task invokes indirectly.
Modifiable arguments in task actions are an equally valid but less obvious vector, especially when the executable itself is protected. If the task runs cmd.exe /c C:\Scripts\backup.bat and you can write to backup.bat, you get code execution as SYSTEM without touching the signed Windows binary.
Credential Hunting and Stored Secrets
Stored credentials provide lateral movement opportunities and sometimes direct privilege escalation when you find them in privileged contexts. Exam environments deliberately place credentials in predictable locations to reward thorough filesystem enumeration over brute-force attacks.
SAM Database and Cached Credentials
Extracting hashes from SAM and SYSTEM hives requires read access to those files, which normally exists only when Volume Shadow Copy is available or when you have Backup Operators membership. Copying live registry hives without shadow copies typically fails with sharing violations, so check VSS availability first with vssadmin list shadows.
Cached domain credentials in the SECURITY hive offer an alternative authentication path even when SAM extraction fails, particularly in Active Directory exam scenarios. Tools like pypykatz can parse these caches offline if you manage to exfiltrate the hive files through backup privileges or misconfigured share permissions.
Unattend.xml and Configuration Files
Unattend.xml, sysprep.inf, and web.config files frequently contain plaintext or base64-encoded passwords left behind during automated deployments. Search common deployment directories recursively rather than relying on filename patterns alone, because exam authors often rename these files to test thoroughness.
cd C:\
dir /s /b *unattend*.xml *sysprep*.inf *web*.config 2>nul
findstr /si "password" *.xml *.inf *.config
Base64 strings in these files decode to plaintext credentials more often than encrypted values show up in exam environments, so always try decoding before you dismiss encoded content as unusable. Web.config connection strings similarly reveal database credentials that may reuse administrator passwords elsewhere on the system.
Automated Tool Triage: winPEAS and PrivescCheck
Automated tools speed up enumeration but introduce noise that can misdirect your efforts during the critical phases of an exam. Whether they save you time or cost you time comes down to how well you read their output.
Interpreting winPEAS Output Without Noise
WinPEAS color-codes findings by severity, but red highlights indicate potential interest, not confirmed exploitability. Treat every red line as a guaranteed vector and you’ll end up frustrated. Cross-reference each highlighted finding with manual verification commands before you invest time in exploitation, since the tool can’t test write permissions or service states with perfect accuracy.
Distinguish informational output from actionable vulnerabilities by checking whether winPEAS gives specific exploitation guidance or just flags a configuration anomaly. Informational entries about installed software or user accounts support broader enumeration but rarely serve as direct privesc paths, so deprioritize them while active vectors remain untested.
PrivescCheck for Low-Noise Enumeration
PrivescCheck enumerates common Windows security misconfigurations that can be leveraged for privilege escalation and gathers information that might be useful for further attacks, all while producing cleaner output than winPEAS in AV-sensitive environments. Its modular design lets you run specific check categories independently, which avoids the all-or-nothing approach that triggers defensive alerts.
Reach for PrivescCheck when PowerShell logging is aggressive or when previous winPEAS uploads have triggered antivirus responses. Its smaller footprint and segmented execution cut detection probability. The trade-off is less comprehensive coverage, so reserve it for targeted verification rather than initial broad-spectrum enumeration.
Recognizing Dead Ends and Pivoting Strategy
Knowing when to abandon a vector matters as much as knowing how to exploit it, because sunk-cost thinking kills exam scores faster than technical ignorance does. Clear failure indicators let you pivot decisively rather than cycling through variations of the same broken approach.
When a Vector Is Not Exploitable
Access denied errors on write tests, missing dependencies for exploit binaries, and patched KB numbers matching known fixes are definitive signs a technique won’t work in this environment. Continuing to troubleshoot these conditions wastes time that could uncover viable alternatives elsewhere on the system.
This windows privilege escalation checklist doesn’t guarantee root access on every box. Some exam machines intentionally lack exploitable misconfigurations to test whether you can recognize a clean system and pivot to lateral movement. Accept that limitation early and you avoid hours of futile enumeration on hardened targets.
Fallback Enumeration After Failed Attempts
When service misconfigurations yield nothing, move straight to token impersonation checks. When tokens fail, hunt stored credentials. When credentials produce no elevation, re-enumerate network shares and connected drives for overlooked data. This pivot sequence covers the major vector categories systematically instead of randomly revisiting failed approaches.
Document each failed attempt briefly in your notes so you don’t accidentally retest the same dead end thirty minutes later when fatigue sets in. Structured OSCP study resources emphasize this documentation habit because it directly correlates with exam success rates under time pressure.
Frequently Asked Questions
How do I know if winPEAS flagged a false positive?
Cross-reference every red-highlighted finding with manual verification commands like icacls or sc qc before attempting exploitation. WinPEAS reports potential interest based on pattern matching, not confirmed write access or functional exploitability, so treat its output as leads requiring validation rather than guaranteed vectors.
Which token impersonation tool works best for Windows Server 2019?
GodPotato offers the broadest compatibility for Server 2019 because it auto-resolves valid CLSIDs without manual enumeration. PrintSpoofer serves as a reliable fallback if GodPotato fails, while JuicyPotatoNG should only be used when you have pre-confirmed working CLSIDs through separate reconnaissance.
What indicates a privilege escalation vector is truly dead?
Definitive failure signs include explicit access denied errors on permission tests, missing exploit dependencies that cannot be transferred, and KB patches matching known fix versions for the vulnerability. When these conditions appear, pivot immediately to the next vector category rather than troubleshooting variations of the same broken approach.
Where should I search for stored credentials beyond standard locations?
Search recursively for unattend.xml, sysprep.inf, and web.config files across all drives, then grep for password strings and base64 blocks within those files. Exam environments also hide credentials in custom application config files, log directories, and backup archives that automated tools often skip during standard scans.