Windows PrivEsc

Windows privilege escalation concepts on YOUR $LAB_VM — literacy and defender notes, not daily-driver recipes.

Windows PrivEsc• Audio Walkthrough

00:00/03:13

Visual · t19_windows_privesc

PrivEsc = move from lower to higher privilege on a host. $LAB_VM only. Original Cyberlium.

Understanding Windows privesc helps you patch and monitor — not climb on a roommate's gaming PC.

Windows privilege escalation means gaining higher privileges on a compromised host — from standard user to local administrator, or abusing service misconfigurations, weak permissions, unquoted paths, token issues, and patch gaps on intentional vuln images. Cyberlium teaches concept names and defender controls on YOUR disposable $LAB_VM under written RoE — not step-by-step chains for Windows workstations you do not own. OSCP-style labs use boxes designed for privesc; real life needs patching, least privilege, EDR, and service hardening. Never run privesc tooling on employer laptops, school machines, or neighbor hosts 'to learn.'

1. Concept categories (lab literacy)

Misconfigured services, weak folder permissions, stored credentials, kernel issues on outdated lab images — ATT&CK labels like T1068 Privilege Escalation.

Learn to read 'why this box is vuln' in course briefs — not export recipes to stranger networks.

Command guide

Try these commands — Concept categories (lab literacy)

═══ WINDOWS (CMD & POWERSHELL) ═══

Check current user privileges (look for SeImpersonate, SeDebug, SeBackupPrivilege)

Command — copy this

whoami /priv
whoami /groups

Check for unquoted service paths

Command — copy this

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows" | findstr /i /v """"

Enumerate running non-standard services

Command — copy this

Get-CimInstance win32_service | Where-Object {$_.State -eq 'Running' -and $_.PathName -notlike 'C:\Windows*'} | Select-Object Name, PathName, StartName | Format-Table -AutoSize

Check AlwaysInstallElevated registry keys

Command — copy this

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 2>nul
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 2>nul

Check scheduled tasks in current user context

Command — copy this

schtasks /query /fo LIST /v | findstr /i "TaskName Author Run" | head -20

Primary tools to practice this lesson: curl, python3. Reference sites: Linux privesc literacy (https://attack.mitre.org/techniques/T1548/); GTFOBins (https://gtfobins.github.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Defender controls

Patch cadence, remove local admin from daily users, harden service accounts, monitor suspicious service installs and token manipulation.

Credential Guard, LSA protection, and EDR alerts on common privesc patterns — your blue-team notes matter as much as the concept names.

3. Scope boundary

Practice only on $LAB_VM images you deploy and can snapshot-revert per RoE.

No privesc attempts on host OS, bridged dorm LANs, or cloud tenants without signed engagement.

4. What you ship: Windows privesc literacy

PrivEsc definition + two concept categories + two defender controls + $LAB_VM-only sentence.

5. What you record before the next lesson

Windows privesc literacy paragraph.

6. Wrong vs right: stranger nets vs YOUR lab VMs

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Run Windows privesc exploit chain on roommate's PC 'because OSCP prep.'
Right: Name Windows privesc concepts and defenses. Next: Linux PrivEsc.

Hands-on Exercise