Privilege Escalation
Local privilege escalation is split across two phases on this site, and this page is the map between them: what belongs to exploitation, what belongs to post-exploitation, and where the mechanics of each technique are actually taught.
Danger
The Phase Split
The two cases use the same commands but answer different questions. Exploitation-phase escalation is when the escalation is the way in: you land a web shell as an IIS application-pool identity, or a service account from a config file, and the next step is SYSTEM on that same host so the boundary you crossed is the service rather than the operating system. Post-exploitation escalation is when the host is already yours and you are working a checklist — enumerate, find the escalatable thing, escalate, then repeat across the estate.
That distinction decides how the finding is written. An exploitation-phase escalation is a finding about a service: a web application running as a privileged identity is the defect, and hardening the application identity is the remediation. A post-exploitation escalation is a finding about host build: an unquoted service path or a writable service binary is the defect, and it is one row in a build-standard exception list. The command that produced each is identical, which is exactly why the two phases get confused in reports.
| If you are… | Phase | Page |
|---|---|---|
| Escalating on the host you just got a shell on, because that host is the way past a service boundary | Exploitation | 06a — Windows Privilege Escalation |
| Running the full local enumeration checklist after a foothold, across every host you reach | Post-exploitation | 06a — Windows Privilege Escalation |
| Escalating on a Linux host (sudo, SUID, capabilities, kernel) | Post-exploitation | 06b — Linux Privilege Escalation |
| Escalating from local administrator to domain control | Exploitation | 05f, 05i, 05k, 06d |
What 06a Owns
Every Windows local technique has one home, and it is
06a:
the enumeration tools (WinPEAS, PowerUp, Seatbelt), unquoted service paths, weak service
permissions and writable service binaries, the Potato family and SeImpersonatePrivilege,
AlwaysInstallElevated, UAC bypass, credential hunting, and the token privileges behind
them (SeImpersonatePrivilege, SeBackupPrivilege,
SeRestorePrivilege), each with detection guidance. This page deliberately does not
repeat the mechanics — a second copy is how one of the two drifts out of date.
06a — Windows PrivEsc
Service abuse, tokens, UAC, credential files, with per-technique detection
06b — Linux PrivEsc
sudo, SUID/SGID, capabilities, cron and PATH abuse
05f — AD Exploitation
From local admin to directory-level control: GPO abuse and DCShadow
What Local Admin Is Actually For
Once local admin is in hand, "how do I get SYSTEM" stops being the interesting question — SYSTEM on
a workstation buys nothing you did not already have. The useful question is what this host's admin
rights reach. Local admin is a credential-access position, because SAM, LSA secrets and any cached
domain logon are readable (
05g);
it is a lateral-movement position, because every remote-execution primitive needs it (
05d);
and on the right host it is a delegation position, because a compromised server may hold cached TGTs
or writable msDS-AllowedToActOnBehalfOfOtherIdentity (
05k).
Read the finding you are about to write before you escalate further: "local administrator on a member server" and "domain administrator" are different severity claims, and the second one is only defensible if you can show the path, not just the hash you ended up holding.
External Resources
HackTricks - Windows PrivEsc
Comprehensive Windows privilege escalation reference
PEASS-ng (WinPEAS) - GitHub
Privilege Escalation Awesome Scripts Suite
UACME - GitHub
70+ UAC bypass methods, indexed by Windows build
FuzzySecurity - Windows PrivEsc
Classic Windows privilege escalation fundamentals
Practice Labs
Practise the techniques 06a teaches end to end
Evidence Collection
Before and after:
The token or integrity level you arrived with and the one you ended with (whoami /groups, whoami /priv), captured before and after. A shell that is merely "on the box" is not an escalation.
Which phase the finding belongs to: If the escalation crossed a service boundary, the evidence is the service identity and the application defect; if it crossed a host build control, the evidence is the misconfigured service, path or ACL. The page above explains why that decides the remediation.
The mechanism, named:
Unquoted service path, writable binary, SeImpersonatePrivilege, AlwaysInstallElevated, UAC bypass method — the named mechanism is what the client can search their estate for.
CVSS range: Local privilege escalation from a service account to SYSTEM: 7.8–8.8 | Crossing from local admin to domain control: 9.8 (report through 05f)
False Positive Identification
- SYSTEM on a workstation is usually not an escalation finding: If the account already had local admin, "escalated to SYSTEM" buys nothing and rates as informational. The useful finding is what SYSTEM reaches that admin did not — cached credentials, a service account, a delegation ticket.
- Inherited privilege is not a vulnerability: A process that already ran as SYSTEM gave you SYSTEM. Confirm the privilege came from the mechanism you are about to report, not from the parent process.
- A UAC bypass on an admin account is not a privilege boundary: UAC is an integrity control, not a security boundary; bypassing it from an already-elevated context proves nothing. State the starting integrity level.
Testing Checklist
This page is orientation, so its checklist is the decision itself: which phase the finding belongs to, and whether the token you hold at the end differs from the one you arrived with.
Establish the starting point
- ☐
whoami /groupsandwhoami /privare captured before any attempt; without a starting token there is no "after" to compare. - ☐ Local admin state on the host is confirmed (
nxcPwn3d!or Administrators membership) - if it is already admin, the finding changes class.
Classify the finding
- ☐ The finding is assigned to one phase: a service-boundary escalation, or a host-build control gap - the two have different owners.
- ☐ The mechanism is named - unquoted service path, writable binary,
SeImpersonatePrivilege,AlwaysInstallElevated- because the name is what the client searches the estate for. - ☐ The escalated context is captured after the fact and differs from the captured start; a shell that is merely on the box is not an escalation.
Remediation
If the finding is a service
- • Change the application identity to a low-privilege, per-application account — an IIS app-pool identity running as SYSTEM is the defect, and no host hardening fixes it.
- • Remove standing local admin from service accounts and audit which services can impersonate (SeImpersonate, SeAssignPrimaryToken).
If the finding is a host build
- • Fix the build baseline: quoted service paths, no writable directories in service binaries' search order, no
AlwaysInstallElevated, current patch level. - • Add the check to the standard image and to configuration monitoring, so a new host cannot ship with it.
- • Fed through 06a for the Windows mechanics and 06b for Linux.