Advanced Windows Priviledge Escalation For OSCP & Beyond!

Set up a hands-on lab with Kali Linux, Windows 10, and Windows 11 in VMware Workstation, update systems, and begin privilege escalation exploration.

Download Kali Linux installer images and Windows 10/11 ISOs, select 64-bit or 32-bit as needed, and prepare these machines with VMware for virtualization.

Set up Kali Linux, Windows 10, and Windows 11 VMs in VMware, configuring RAM, CPUs, disks, and network adapters, then adjust the virtual network editor for reliable IPs.

Install Kali Linux in a virtual machine, configure language, hostname, user, and disk partitioning, set up grub boot loader, and perform a repository update and upgrade for latest tools.

Install and optimize Windows 11 and Windows 10 VMs, trim features for performance, remove unnecessary software, enable dark mode, and keep both up to date with the latest security updates.

Explore the windows privilege escalation realm and build a foundational understanding of the topic. Prepare to navigate the next learning unit.

Examine Windows user privileges and how specific permissions enable privilege escalation, including impersonate, assign primary, backup, restore, and take ownership, such as the juicy potato exploit.

Discover how Windows access tokens are created by the kernel at user authentication, carrying integrity levels and privileges that govern privilege escalation and UAC behavior.

Practice practical Windows privilege escalation in a TryHackMe lab by deploying a vulnerable Windows VM, escalating to admin or system, and delivering a reverse shell via SMB and netcat.

Move and explore four top Windows privilege escalation resources in a Kali Linux lab, opening links for user enumeration, system information, environment variables, and service checks to guide practical experiments.

Learn Windows user enumeration with whoami, query user, echo username, and net user, then use PowerShell to inspect local groups and identify administrator accounts for privilege escalation.

Enumerate a Windows system to reveal hostname, system info, Windows Server 2019 details, disk and process lists, patches, and installed software, using PowerShell and WMI checks.

Perform practical Windows network enumeration using ipconfig, arp, and netstat to map interfaces, IP addresses, DNS suffix, and active connections, including RDP and reverse shell ports.

Explore antivirus and firewall enumeration on Windows, verify Windows Defender status, compare commands across Windows versions, and interpret firewall configuration and admin privilege requirements.

Discover manual techniques to hunt for passwords in Windows files, including searches in directories, text files, and config data, and compare them with later automated methods.

Enumerate and map Windows drives, switch between C, D, E, and F, and explore drive structures to locate ownership details and passwords.

Learn how to hunt for passwords in the Windows registry by manual querying and automated methods, focusing on registry keys, values, and Winlogon hives.

Learn to enumerate wifi credentials on a Windows system, view saved and cleartext passwords, inspect networks like home or convenient, and collect MAC addresses for further attacks.

Explore windows credential harvesting techniques, showing how prompts and scripts can solicit user authentication and expose credentials on windows systems, with practical considerations for privilege escalation.

Explore automated tools for privilege escalation, including Wimps, Windows XP suggester, Shop Up, and Seat Belt, using Metasploit Meterpreter and Kali Linux labs with Windows exploits repositories.

Learn to run winpeas to automatically enumerate Windows misconfigurations and vulnerabilities for privilege escalation, interpreting color-coded results and credentials found for oscp readiness.

Explore Windows Exploit Suggester NextGen, clone and update its vulnerability database, and identify recent remote code execution and elevation of privilege exploits on Windows Server 2019.

Explore the seatbelt enumeration tool to quickly collect Windows system information, including user privileges, environment variables, services, firewall rules, and network shares for privilege escalation.

Learn how automated enumeration tools save time, build a checklist from results, and read interesting files to uncover information that helps you escalate.

Set up a Kali lab, connect via VPN and RDP to a Windows target, generate a payload, and use wind piece to identify misconfigurations and insecure service permissions.

Learn to locate insecure service permissions by scanning services and reading their configurations, then modify a service's binary pathname to a reverse shell payload and escalate to local system privileges.

Explore weak registry permissions on the RegSVC service with system privileges. Override the image path registry key to a payload and spawn a shell via reg svc to verify escalation.

Explore how insecure service executables enable privilege escalation on Windows targets. Learn how to replace a vulnerable service binary and obtain a shell as NT authority system.

Learn to search the Windows registry for password keys, extract admin credentials like password 123, and perform privilege escalation from a standard user to admin using registry findings.