In a nutshell You've got a shell on a Windows box as a normal user and you want Administrator or SYSTEM. Like on Linux, it's a methodical hunt through known misconfigurations — weak service permissions, scheduled tasks, stored credentials, unquoted paths, missing patches — not a magic trick. Enumerate first; the escalation reveals itself.
The target: Administrator, and above it SYSTEM
On Windows the top isn't just "Administrator." SYSTEM is higher still — the account system services run as (see Windows internals). You get in low and climb; winPEAS automates the checklist.
Analogy — the master keycard again. You're in as a cleaner. You check the usual spots a master card gets left: a service anyone can reconfigure, a scheduled task nobody locked down, a password saved in a file.
The usual suspects
whoami /priv # your privileges — SeImpersonate → a direct road to SYSTEM
whoami /groups
systeminfo # OS build / patch level → known exploits
cmdkey /list # saved credentials
| Suspect | The weakness | The win |
|---|---|---|
| whoami /priv | SeImpersonatePrivilege (common on service accts) |
the "Potato" exploits → SYSTEM |
| weak service perms | you can reconfigure a service | point its exe at yours, restart → SYSTEM |
| unquoted service path | C:\Program Files\My App\svc.exe no quotes |
Windows tries C:\Program.exe — writable? win |
| writable service binary | you can overwrite the .exe | swap in yours |
| scheduled task | admin task runs a script you can edit | its privileges become yours |
| stored creds | Windows is full of them | cmdkey, registry autologon, unattend.xml, PS history |
| missing patch | unpatched OS/driver CVE | powerful, noisier |
The Colizeum reminder
Recall the Windows internals note — on the club machines UAC was off and users had admin, so there was barely a climb to make. Least privilege is what forces an attacker to actually work for it: lock down service permissions, quote service paths, don't let low users edit task scripts, never store passwords in files/registry, and patch promptly.