Windows Local Privilege Escalation Map

For Windows local privilege escalation, compare the rights held by the current user with those granted over services and files. Check the facts manually first, then use tools such as WinPEAS if needed to find what you missed.

Investigation Order

1. Check the OS, patches, and installer settings under System Information and Installers.
2. Identify Security Features and Detection Settings.
3. Look for accessible targets under Users, Processes, and Services and Applications, DLLs, and Networks.
4. Check Credentials and Privilege Escalation Paths.

Access Token Manipulation and JuicyPotato have separate articles. See Investigation Tools and References for programs used in the investigation.

Windows Basics to Learn First

• Access tokens: Hold user IDs, groups, privileges, and other information. See Access Tokens for details.
• ACLs, DACLs, SACLs, and ACEs: Express access permissions and audit settings. See ACLs, DACLs, SACLs, and ACEs for their structure.
• Integrity levels: Even with the same administrator account, a process’s integrity level changes what it can do. See Integrity Levels.

Windows Security Features

Antimalware, UAC, logging settings, and other controls affect how you investigate. Check the current settings, then compare them with Windows Security Controls.