# Checklist - Local Windows Privilege Escalation

## **Best tool to look for Windows local privilege escalation vectors:** [**WinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS)\*\*\*\*

## [System Info](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#system-info)

* [ ] Obtain [**System information**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#system-info)\*\*\*\*
* [ ] Search for **kernel** [**exploits using scripts**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#version-exploits)\*\*\*\*
* [ ] Use **Google to search** for kernel **exploits**
* [ ] Use **searchsploit to search** for kernel **exploits**
* [ ] Interesting info in [**env vars**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#environment)?
* [ ] Passwords in [**PowerShell history**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#powershell-history)?
* [ ] Interesting info in [**Internet settings**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#internet-settings)?
* [ ] [**Drives**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#drives)?
* [ ] \*\*\*\*[**WSUS exploit**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#wsus)?
* [ ] \*\*\*\*[**AlwaysInstallElevated**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#alwaysinstallelevated)?

## [Logging/AV enumeration](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#enumeration)

* [ ] Check [**Audit** ](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#audit-settings)and [**WEF** ](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#wef)settings
* [ ] Check [**LAPS**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#laps)\*\*\*\*
* [ ] Check if [**WDigest** ](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#wdigest)is active
* [ ] [**LSA Protection**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#lsa-protection)?
* [ ] \*\*\*\*[**Credentials Guard**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#credentials-guard)[?](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#cached-credentials)
* [ ] [**Cached Credentials**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#cached-credentials)?
* [ ] Check if any [**AV**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#av)\*\*\*\*
* [ ] \*\*\*\*[**AppLocker Policy**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#applocker-policy)?
* [ ] [**UAC**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#uac)?

## \*\*\*\*[**User Privileges**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#users-and-groups)

* [ ] Check [**current** user **privileges**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#users-and-groups)\*\*\*\*
* [ ] Are you [**member of any privileged group**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#privileged-groups)?
* [ ] Check if you have [any of these tokens enabled](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#token-manipulation): **SeImpersonatePrivilege, SeAssignPrimaryPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege** ?&#x20;
* [ ] [**Users Sessions**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#logged-users-sessions)?
* [ ] Check[ **users homes**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#home-folders) (access?)
* [ ] Check [**Password Policy**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#password-policy)\*\*\*\*
* [ ] What is[ **inside the Clipboard**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#get-the-content-of-the-clipboard)?

## [Network](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#network)

* [ ] Check **current** [**network** **information**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#network)\*\*\*\*
* [ ] Check **hidden local services** restricted to the outside

## [Running Processes](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#running-processes)

* [ ] Processes binaries [**file and folders permissions**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#file-and-folder-permissions)\*\*\*\*
* [ ] \*\*\*\*[**Memory Password mining**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#memory-password-mining)\*\*\*\*
* [ ] \*\*\*\*[**Insecure GUI apps**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#insecure-gui-apps)\*\*\*\*

## [Services](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#services)

* [ ] [Can you **modify any service**?](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#permissions)
* [ ] [Can you **modify** the **binary** that is **executed** by any **service**?](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#modify-service-binary-path)
* [ ] [Can you **modify** the **registry** of any **service**?](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#services-registry-permissions)
* [ ] [Can you take advantage of any **unquoted service** binary **path**?](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#unquoted-service-paths)

## \*\*\*\*[**Applications**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#applications)\*\*\*\*

* [ ] **Write** [**permissions on installed applications**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#write-permissions)\*\*\*\*
* [ ] \*\*\*\*[**Startup Applications**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#run-at-startup)\*\*\*\*
* [ ] **Vulnerable** [**Drivers**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#drivers)\*\*\*\*

## [DLL Hijacking](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#path-dll-hijacking)

* [ ] Can you **write in any folder inside PATH**?
* [ ] Is there any known service binary that **tries to load any non-existant DLL**?
* [ ] Can you **write** in any **binaries folder**?

## [Network](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#network)

* [ ] Enumerate the network(shares, interfaces, routes, neighbours...)
* [ ] Take a special look to network services listing on local (127.0.0.1)

## [Windows Credentials](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#windows-credentials)

* [ ] \*\*\*\*[**Winlogon** ](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#winlogon-credentials)credentials
* [ ] [**Windows Vault**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#windows-vault) credentials that you could use?
* [ ] Interesting [**DPAPI credentials**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#dpapi)?
* [ ] Passwords of saved [**Wifi networks**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#wifi)?
* [ ] Interesting info in **\*\*\[**&#x73;aved RDP Connections\*\*]\(windows-local-privilege-escalation/#saved-rdp-connections)?
* [ ] Passwords in [**recently run commands**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#recently-run-commands)?
* [ ] [**Remote Desktop Credentials Manager**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#remote-desktop-credential-manager) passwords?
* [ ] [**AppCmd.exe** exists](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#appcmd-exe)? Credentials?
* [ ] [**SCClient.exe**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#scclient-sccm)? DLL Side Loading?

## [Files and Registry (Credentials)](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#files-and-registry-credentials)

* [ ] **Putty:** [**Creds**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#putty-creds) **and** [**SSH host keys**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#putty-ssh-host-keys)\*\*\*\*
* [ ] \*\*\*\*[**SSH keys in registry**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#ssh-keys-in-registry)?
* [ ] Passwords in [**unattended files**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#unattended-files)?
* [ ] Any [**SAM & SYSTEM**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#sam-and-system-backups) backup?
* [ ] [**Cloud credentials**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#cloud-credentials)?
* [ ] \*\*\*\*[**McAfee SiteList.xml**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#mcafee-sitelist-xml) file?
* [ ] \*\*\*\*[**Cached GPP Password**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#cached-gpp-pasword)?
* [ ] Password in [**IIS Web config file**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#iis-web-config)?
* [ ] Interesting info in [**web** **logs**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#logs)?
* [ ] Do you want to [**ask for credentials**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#ask-for-credentials) to the user?
* [ ] Interesting [**files inside the Recycle Bin**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#credentials-in-the-recyclebin)?
* [ ] Other [**registry containing credentials**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#inside-the-registry)?
* [ ] Inside [**Browser data**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#browsers-history) (dbs, history, bookmarks....)?
* [ ] \*\*\*\*[**Generic password search**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#generic-password-search-in-files-and-registry) in files and registry
* [ ] \*\*\*\*[**Tools**](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#tools-that-search-for-passwords) to automatically search for passwords

## [Leaked Handlers](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#leaked-handlers)

* [ ] Have you access to any handler of a process run by administrator?

## [Pipe Client Impersonation](https://chinnidiwakar.gitbook.io/githubimport/windows-local-privilege-escalation#named-pipe-client-impersonation)

* [ ] Check if you can abuse it

## And more...

If you want to **know** about my **latest modifications**/**additions** or you have **any suggestion for HackTricks or PEASS**, **join the** [**💬**](https://emojipedia.org/speech-balloon/) [**PEASS & HackTricks telegram group here**](https://t.me/peass), or **follow me on Twitter** [🐦](https://emojipedia.org/bird/)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**\
If you want to **share some tricks with the community** you can also submit **pull requests** to **\*\*\[**<https://github.com/carlospolop/hacktricks**](https://github.com/carlospolop/hacktricks>) **\*\*that will be reflected in this book.**\
**Don't forget to** give ⭐ on the github\*\* to motivate me to continue developing this book.

![](https://4153509160-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MaoGr_g3I50alM2whW0%2Fsync%2F4c4968b48f0ebf20a73e46cd07c9315dc629c00c.png?generation=1622227467459076\&alt=media)

​[**Buy me a coffee here**](https://www.buymeacoffee.com/carlospolop)\*\*\*\*
