Windows Security & Privilege Escalation
Windows privilege escalation techniques including DLL injection, privileged group abuse, and security group exploitation for penetration testing.
Overview
Windows environments present numerous opportunities for privilege escalation through misconfigured security groups, DLL hijacking, and improper service configurations. This section covers techniques for escalating privileges on Windows systems.
Privileged Group Abuse
Windows security groups often grant more privileges than administrators realize. Membership in these groups can lead to full system compromise:
- Event Log Readers - Extract credentials from security logs
- Hyper-V Administrators - Escape to host from virtual machines
- Print Operators - Load malicious drivers
- Server Operators - Service manipulation for SYSTEM access
Code Injection Techniques
- DLL Injection - Inject malicious code into running processes
Attack Methodology
- Enumeration - Use PowerView to identify group memberships
- Privilege Analysis - Determine exploitable group permissions
- Exploitation - Abuse group privileges for escalation
- Persistence - Maintain access through privileged accounts
Related Resources
- Windows Privilege Escalation Vulnerabilities - SE_* privileges and service attacks
- Active Directory Attacks - Domain-level privilege escalation
- BloodHound - Visualize attack paths
- Impacket - Remote execution tools
Last updated on
EDR Evasion Techniques in Modern Red Team Operations
EDR evasion techniques including API hooking bypass, AMSI evasion, ETW tampering, memory injection, and advanced code obfuscation strategies.
Tools
As a Offensive Security engineer, I rely on a curated set of tools to perform comprehensive security assessments across networks, web applications, and systems. This section provides a categorized overview of the tools I regularly use during red teaming, vulnerability assessments, and exploit development.