In a nutshell Windows is the most common target after Linux: corporate networks, Active Directory, workstations. To attack it you have to understand how it's built inside — where users and permissions live, what System32, the registry and UAC are. Here's the base map the later topics (privilege escalation, Active Directory) lay onto.
Why Windows matters to an attacker
Linux is the pentester's own environment, but targets are more often on Windows: offices, Active Directory domains, employees' PCs. Most corporate breaches go through Windows infrastructure. So "I only know Linux" is half the picture.
Driving Windows from the command line
Besides the GUI there are three ways to "talk" to the system:
- cmd (Command Prompt) — the old command line, simple commands (
dir,cd,type). - PowerShell — a powerful modern shell, the analogue of the Linux terminal but with its own language (cmdlets like
Get-Process,Get-ChildItem). It can do almost anything, which makes it the main post-exploitation tool on Windows. - GUI — with the mouse, for everyday use.
A mapping to Linux (handy to keep in mind):
| Task | Linux | Windows cmd | PowerShell |
|---|---|---|---|
| where am I | pwd |
cd |
Get-Location |
| list files | ls |
dir |
Get-ChildItem |
| read a file | cat |
type |
Get-Content |
| who am I | whoami |
whoami |
whoami |
| processes | ps |
tasklist |
Get-Process |
The file system: NTFS
Modern Windows runs on NTFS (New Technology File System). What matters in it for security:
- Access permissions (ACL — Access Control List) — each file and folder is assigned who may do what (read, write, execute, change permissions). This is the foundation of access control: understanding the ACL, you understand what's protected and what can be read or overwritten (a writable executable that isn't yours is a road to privilege escalation).
- Journalling — resilience to crashes.
- EFS — file encryption, quotas, compression.
The old FAT32 has no access permissions at all — which is why NTFS is everywhere in corporate environments. USB sticks are often FAT32/exFAT — hence, by the way, the lack of permissions on them.
Key folders
| Path | What's there |
|---|---|
C:\Windows |
the system itself |
C:\Windows\System32 |
the core: system files, DLLs, Windows utilities |
C:\Users\Name |
the user's profile (their files, settings) |
C:\Program Files |
installed programs (64-bit) |
C:\Program Files (x86) |
32-bit programs |
System32 is the heart of the system. Critical libraries and system utilities live there. Many of those utilities are used by attackers too — the "living off the land" technique: don't drag in your own malware, wield Windows' built-in programs instead, so as not to attract the antivirus. Write access to System32 = effective control of the machine, which is why it's strictly protected.
Accounts and permissions
Two main types:
- Administrator — full control.
- Standard user — limited: doesn't install system software, doesn't touch other people's things.
A special, most powerful one — SYSTEM (even above Administrator; system services run as it). Many privilege-escalation techniques aim at exactly SYSTEM.
The attacker's goal is the classic one: got in as an ordinary user → escalate privileges to Administrator/SYSTEM (see the Windows PrivEsc material).
UAC — User Account Control
UAC by default gives even an administrator ordinary rights, and for actions that need admin ones it shows an "Allow this change?" window.
Why: if malware launched in an administrator's session, without UAC it would immediately get full power. UAC inserts a manual confirmation — a barrier. UAC bypass is a class of privilege-escalation techniques of its own.
From Colizeum practice: on the club machines UAC was turned off — the barrier removed. Convenient for the player, bad for security: any process that starts gets full rights straight away.
The registry
The registry is a huge hierarchical database of Windows settings (system, programs, users). It's split into "hives" (HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER, and others). It matters for security because:
- auto-start is configured there (a frequent spot where malware persists);
- settings are stored, sometimes passwords/keys;
- many UAC bypasses and persistence tricks go through the registry.
(The registry in more detail — in Windows Fundamentals 2/3.)
Task Manager and processes
Task Manager (Ctrl+Shift+Esc) — processes, load, auto-start, services. The first look at "what's happening in the system": a suspicious process (an odd name, high load, launched from a temp folder) is a reason to dig. The command-line analogues: tasklist, Get-Process.
Where this leads next
- Windows PrivEsc — how to go from an ordinary user to Administrator/SYSTEM.
- Active Directory Basics — how corporate Windows domains are built (the biggest topic in Windows pentesting).