Skip to content
 

Privilege escalation on Windows: When you want it and when you don’t

  

Table of contents:
What is a privilege escalation attack?
Vertical and horizontal privilege escalation
Privilege escalation focuses on privileged accounts and access
How privileges are created and delegated in Windows system
Windows Security Identifiers
How do privilege escalation attacks work?
Step-by-step path to privilege escalation
Examples of privilege elevation techniques
How to automate privilege escalation
Privileged escalation attack paths with the Mitre ATT&CK framework
Top tips to make privilege escalation difficult for attackers

Privilege escalation is when a user with limited access to IT systems can increase the scope and scale of their access permissions. For trusted users, privilege escalation allows expanded access for a limited time to complete specific tasks. For example, users may need access to troubleshoot a technical problem, run a quarterly financial report, or install a program.

Privilege escalation is also one of the most common techniques attackers use to discover and exfiltrate sensitive, valuable data.

What is a privilege escalation attack?

A privilege escalation attack is a cyberattack that aims to gain unauthorized access into a system and attempt to access elevated rights, permissions, entitlements, or privileges. An attack can employ either vertical privilege escalation or horizontal privilege escalation to carry out the attack and ultimately gain access to high-value assets. 

From a hacker’s perspective, privilege escalation is the art of increasing privileges from initial access, which is typically that of a standard user or application account, all the way up to administrator, root, or even full system access. With NT Authority\System access, attackers have full access to one system. With Domain Administrator access, they own the entire network.

An attacker may employ a variety of strategies to escalate privileges

Let’s say an attacker successfully steals a User’s password and gains access to their account. That password may enable certain privileges, for example, it may only unlock data stored locally on a laptop. But an attacker is hungry for more. They’re looking for more sensitive data they can resell on the Dark Web. They’re looking for access to business-critical systems so they can deploy ransomware, threaten shutdown, and demand financial payment.

To achieve those goals, an attacker employs a variety of strategies to escalate privileges:

Horizontal vs Vertical Privilege Escalation Windows

  • Vertical privilege escalation, sometimes referred to as privilege elevation, is when an attacker compromises a user account that has limited permissions on a system. They then look for ways to increase their privileges using the same account. For example, they might add the compromised account to the local administrator group.

  • Horizontal privilege escalation, the more common method, is when an attacker gains access to another credential on the network with higher privileges than the initial one used to gain their foothold. With higher-level privileges, an attacker can move freely around the network without detection.


Horizontal vs Vertical Privilege Escalation Attacks Windows

Examples illustrating the difference between vertical and horizontal privilege escalation


In this blog, you’ll learn how an attacker escalates privileges on Windows systems using a step-by-step process. By viewing privilege escalation through the lens of a hacker, you’ll see how attackers exploit security vulnerabilities to achieve their goals. And you’ll identify opportunities to increase Windows privilege management to reduce your risk of a cyberattack.

Here's an example of the elevation of a privilege attack using EternalBlue privilege escalation exploit:

Example of elevation of privilege attack: EternalBlue

Example of when an attacker has pwned a system with NT Authority\System

Privilege escalation focuses on privileged accounts and access

Before we start getting into the mechanics of Windows privilege escalation attacks, we must first understand what privileged accounts are used for, the different types of privileges on Windows systems, and how they work. This foundation will help you understand the strategies cyber criminals use when attacking Windows systems so you know where to focus your defenses.

Privileged accounts are at the core of every business. They ensure the IT team can manage the organization’s systems, infrastructure, and software, and they enable employees to access the data that enables them to make critical business decisions.

Privileged accounts are distinguished from standard User accounts that represent human identities, such as an Active Directory User account with a password to restrict access.

Privileged accounts enable administrative or specialized levels of access based on higher levels of authorization. It’s common to have shared privileged access used by a department or group of Users to access applications or systems. A privileged account can be human or non-human. Some types of non-human high privileged accounts are application accounts used to run services requiring specific permissions.

Privileged accounts allow Users to make system and software configuration changes, execute administrative tasks, create and modify accounts, deploy software, back up data, install security patches, enable interactive logins, and of course, access privileged data. All these activities are crucial to ensure a business can function by keeping systems and software running.

How privileges are created and delegated in Windows systems

A privilege in Windows operating systems is the authorization delegated to a User account or Group that allows access to system resources, objects, and tasks. Privileges can be Local or Domain, which determines the scope of access the User account has.

On Windows systems, you can find a list of Local User Accounts under Local Users and Groups in the computer management menu. Administrator, Default, and Guest are default accounts.

Computer Management Local Users and Groups

Computer Management Local Users and Groups

A Local User account can be assigned as a member of a Group, which determines its privileges.

User account properties

User account properties showing it is a member of the Users Group

Default Groups on a Windows system depend on the operating system role and features enabled. Groups tend to be focused on roles or tasks that the User will perform based on their job function.

Unfortunately, many organizations rely on out-of-the-box roles. When unsure which role to assign to Users, most delegate Local Administrator privileges. This results in many overprivileged Users, which attackers search for and quickly abuse.

Each Windows system has its own Security Account Manager database, known as the SAM file, which stores User accounts and security descriptors on the local computer. When a User logs onto the system, they access a token that contains privileges. When they perform any action on the system, it checks if those permissions permit the action.

Some Default Groups

A few default Groups that determine the privileges of users

Typically, when a User doesn’t have permissions to an object within Windows, they’ll be prompted to enter a different User account with the necessary privileges. This is commonly known as User Account Control (UAC) and enables a User to run most tasks as a non-Administrator.

User Account Control

User Account Control requiring elevated privileges to run cmd application

Once the Users and Groups have been assigned and configured, security settings are determined and privileges are assigned to each Object, such as file systems, registries, services, and system resources. In a hierarchy, each Object can inherit permissions and privileges from its parent.

Common Security Settings

Common Security Settings aka ACL for an Object in Windows

Example of Permissions

Example of permissions aka ACL within the registry

Windows Security Identifiers (SID)

In Windows, the SID is how the operating system refers to accounts and processes instead of using an account or process name.

Each account, Group, and process, is assigned a unique SID (Security Identifier) to represent the security context it’s running under. When a User logs onto a system or executes a process, the SID is assigned an access token that contains everything the system needs to determine the security context, permissions, privileges, Groups, and access.


To check the User account’s SID, you can use the WMIC (Windows Management Instrumentation Command-Line Utility). Use the command prompt: wmic useraccount get name,sid.

Example of User Account SIDs

An Example of User Account SIDs

To learn more about SIDs, I recommend reading Microsoft’s full documentation which can be found here:

Microsoft Security Identifiers Documentation

Did you catch the security concerns?

We've now covered the ways privileges are created and assigned in Windows. That’s the “happy path,” in which everything works out according to plan. But, even if you follow all of the steps outlined above to manage privileges, you’re leaving yourself open to a privilege escalation attack.

Next, we’ll cover the “unhappy path.” That’s when a cyber attacker targets your Windows privileged accounts and successfully exploits the security holes.

Privilege escalation attacks and exploit techniques

For hackers, privilege escalation is the art of elevating privileges from initial access (typically, standard User or application account) to Administrator, root, or even full system access, on Windows referred to as NT Authority\System.

How do privilege escalation attacks work?

To target privileged accounts, attackers use common steps and proven techniques to identify system misconfigurations, vulnerabilities, overprivileged Users, and weak credentials.

First, they explore systems to determine an attack path that won’t alert the security team that anything malicious is occurring. They’re looking for privileged accounts which are left unmanaged and unmonitored.

Some of the most common privileged accounts that attackers go after include:

  • The King of Accounts “Domain Admin Accounts”
  • The challenging and scary “Domain Service Accounts”
  • The forgotten “Local Administrator Accounts”
  • The help me “Emergency Accounts”
  • The hidden and forever “Service Accounts”
  • The elevated “Application Accounts”
  • The silent but deadly “Privileged Data User Accounts”

You can learn more about these types of accounts in the blog: The 7 Deadly Privileged Accounts You MUST Discover, Manage, and Secure.

Step-by-step path to privilege escalation

Steps an attacker will take

Example of the steps an attacker will take

Let’s assume the attacker has gained an initial foothold on a Windows system. The initial foothold could mean different things, such as a reverse shell (aka without creds), access to an application running on the system, or creds (credentials) of an account with limited privileges, such as a standard user account. Each type of foothold allows the attacker to begin their privilege escalation attack path.

In a privilege escalation exploit, the attacker commonly seeks to discover as much as possible about an IT environment to determine their attack path. They do this through reconnaissance and enumeration of the compromised systems.

They perform some type of system enumeration using commands like the ones below:

Commands


Operator Handbook by NETMUX is a great book that includes many enumeration commands and tips. This book has an awesome collection of steps to enumerate a system.

Operator Handbook

Below is an example of these enumeration commands in action:

Manual Enumeration

Manual Enumeration

Examples of privilege elevation techniques

When performing enumeration, attackers are looking for security vulnerabilities that allow for privilege escalation exploits, such as:


1. Insecure service permissions

This occurs when a service that's running under SYSTEM privileges, but the User has permissions to change the executable binpath to one which could create a reverse shell.

2. Unquoted service paths

Surprisingly, while this is a known technique used for many years, it’s still common to find many services with unquoted service paths. When combined with weak folder permissions, this allows an attacker to place an executable in a parent folder, where Windows will look for the executable first to execute. For example, you might have a service path as C:\Program Files\Vendor\binary.exe. When the path is unquoted and the User has permissions to place objects in the C:\Program Files\ path, Windows will first try to execute program.exe. If the attacker can place a binary called program.exe in the path, they can then elevate privileges to the account which that service is running.

3. Weak registry permissions

Like the insecure service permissions example, if an attacker can modify the registry configuration of a service, they can then change the path in service configuration to execute a binary they choose. This could create a reverse shell or elevate privileges on the system.

4. Insecure service executables

If an attacker can simply replace the original executable with their own, they can then gain privilege escalation of the account which that service is running under.

5. Passwords

I can’t tell you how many times I’ve found passwords for privileged users sitting in a text file on a desktop, in a browser, or in a configuration file. Even today, when many people know that passwords are a top attack target, it’s still common to store passwords in easy-to-find places. Many people create weak, crackable passwords, reuse them, and share them.

Attackers can quickly search for stored passwords using the common techniques, such as:

Searching the registry using the query: reg query HKLM /f password /t REG_SZ /s

Searching the file system within xml, ini and txt files for the string password: findstr /si password *.xml *.ini *.txt

Finding a text file on the desktop labeled something like “passwords,” or “important stuff.”

Important Stuff File

Identifying stored passwords in an internet browser:

Stored Passwords


6. Overprivileged Users

For example, standard business Users may have Local Administrator rights on their personal workstations. Attackers can leverage these Local Administrator rights to escalate privileges up to Full Domain using tools such as mimikatz and changes in the OS configuration. You can see how this privilege escalation strategy progresses in the 3-minute video.

 

 


7. Security Account Manager (SAM)

Windows stores credentials within the Security Account Management (SAM) database in an encrypted form called a hash. This is a one-directional cryptographic algorithm, which means you need to know the original password to recreate the hash. The SAM and SYSTEM files are locked when Windows is running, but an attacker might find a backup copy under the Windows repair directory.

Getting access to both the SYSTEM and SAM database could allow an attacker to extract the hashes. If the original password was a weak, reused password, it’s very likely the attacker can crack it. Here's an example of cracking a hash using Hashcat.

Hashcat

Example" Using Hashcat to crack hashes


8. Pass-the-hash

If an attacker can’t crack the password from the hash, they may still be able to move around the network using only the hash. This technique is called pass-the-hash. An example of privilege escalation using pass-the-hash for lateral movement is below:

Pass-the-Hash

9. Insecure GUI apps

For example, a recent vulnerability in a Razer Mouse software enabled a User who plugs in a mouse to escalate privileges to a Windows 10 Administrator. Once the mouse was plugged in, a Windows update would launch, downloading the Razer Installer as SYSTEM. A User could then use Explorer to launch an elevated PowerShell window. An example of privilege escalation using insecure GUI Apps is below.

Razer Mouse
View the Insecure GUI App example on Twitter

10. OS vulnerabilities or kernel exploits

While these types of escalation attacks are less common, sometimes attackers will wait for months with access to a low privileged User, waiting for the moment a vulnerability is disclosed. A recent example known as Print Nightmare (CVE 2021 34527) is a vulnerability in the Print Spooler that enabled an attacker to perform remote code execution and privilege escalation.

An example of privilege escalation using Print Nightmare to create an Admin User on the system is below:

delinea-blog-privilege-escalation-19-exploiting-print-nightmare-cve-2021-34527

Example: Exploiting Print Nightmare CVE 2021 34527

How to automate privilege escalation

A hacker wants to escalate privileges as quickly as possible to avoid detection. Therefore, they may use tools to automate the privilege escalation process, such as the examples below:

BloodHound

BloodHound is a single-page Javascript web application, built on top of Linkurious, compiled with Electron, with a Neo4j database fed by a C# data collector. It uses graph theory to reveal hidden and often unintended relationships within an Active Directory environment.

Attackers can use BloodHound to easily identify highly complex attack paths that would otherwise be impossible to find. Defenders can use BloodHound to identify and eliminate those same paths. Both blue and red teams can use BloodHound to easily gain a deeper understanding of privilege relationships in an Active Directory environment. An example of an Active Directory privilege escalation attack is below, using Bloodhound to find the attack path to elevation of privileges.

Bloodhound Example

Bloodhound example from Hackthebox

Windows Exploit Suggester—Next Generation (WES-NG)

WES-NG is a tool based on the output of Windows’ systeminfo utility. It provides the list of vulnerabilities the OS is vulnerable to, including any exploits for these vulnerabilities. Every Windows OS between Windows XP and Windows 10, including their Windows Server counterparts, is supported.

WES-NG

WES-NG running against Windows 10 System Info

Windows Privilege Escalation Awesome Scripts

Using winPEAS can help Administrators look for ways to prevent privilege escalation attacks by assessing systems for possible misconfigurations or vulnerabilities. WinPEAS is a compilation of local Windows privilege escalation scripts to check for cached credentials, user accounts, access controls, interesting files, registry permissions, service accounts, patch levels, and more. WinPEAS is helpful because it includes hints on where you should focus your attention.

WinPEAS

WinPEAS running on Windows 10 endpoint

We recently had the awesome Carlos Polop, author of winPEAS and Hacktricks.xyz, on the 401 Access Denied podcast to discuss winPEAS and privilege escalation. Make sure to check out the podcast and Carlos’s Hacktricks book, as it goes into full detail on many of the techniques used in this blog.

 

 

PowerUp

PowerUp is a collection of PowerShell scripts for finding common Windows privilege escalation vectors that rely on misconfigurations. Running Invoke-All checks will look for common misconfigurations on Windows endpoints.

PowerUp

PowerUp running on Windows Endpoint

Seatbelt

Seatbelt is a C# project that performs security-oriented host-survey “safety checks” relevant from both offensive and defensive security perspectives. Simply, Seatbelt is an enumeration tool to show information that could lead to privilege escalation.

Seatbelt

Seatbelt running on Windows endpoint

Privileged escalation attack paths with the Mitre ATT&CK framework

The Mitre ATT&CK framework is a tremendous knowledge base of the common tactics and techniques used in real-world attacks. Knowing the techniques and how to reduce risk is critical to making your organization resilient against cyberattacks.

Mitre ATT&CK Framework Privilege Escalation

 Mitre ATT&CK Framework Privilege Escalation

Top tips to make privilege escalation difficult for attackers

Now that we’ve covered the common attack strategies cybercriminals use to escalate privileges, let’s dig into the defense strategies you can use to protect your organization.

It’s dangerous to assume anyone can definitively prevent privilege escalation attacks

First, let’s address the word “prevent.” It’s dangerous to assume anyone can definitively prevent privilege escalation attacks. In fact, assuming that you can prevent can lead to a false sense of security. Instead, we can reduce risks, we can make it more difficult for attackers to be successful, and we can increase visibility to stop the progression of exploits.

Therefore, it’s important to harden your Windows systems as much as possible, forcing attackers to use more noisy techniques that raise alarms. The earlier you get the warning signs, the better your chance of preventing a catastrophe.

Here are some best practices to make privilege escalation exploits harder for attackers:

1. Move passwords into the background using an enterprise password manager or Privileged Access Management (PAM) solution

Help users avoid making poor security decisions by helping them move passwords into secure vaults so they aren’t easily found by attackers during the enumeration phase. A strong password manager or PAM solution will help avoid passwords being left on the desktop in clear text, hidden in configuration files, or stored in insecure browsers.

With a PAM solution, you can ensure all services have a provisioned account with the correct security controls, including complex passwords, rotated frequently. Throw universal keys and standing privileges away and move to on-demand, just-in-time privileges.

Learn more in our whitepaper: Invisible PAM: Balance Productivity and Security Seamlessly

2. Remove local administrator privileges and practice the Principle of Least Privilege

We’ve all heard about Zero Trust. But, how do you put those strategies into practice? The best place to start is moving to non-persistent privileges or least standing privileges, which means a user or account should have just enough privileges to perform the task or action they are assigned to do. This reduces the possibility of exposing several of the privilege escalation paths described above, such as insecure services, registry, and directory paths.

3. Implement MFA everywhere

Passwords are one of the most common targets, so let’s not leave them as the only security control to critical systems, applications, or privileges.

Rather, make sure to add security controls such as Multi-Factor Authentication, access workflows, and approvals, to ensure that only authorized users can use privileges even when an attacker compromises the password. MFA should be required not only at system log-in, but also at the point of horizontal and vertical privilege elevation.

4. Implement application control

Limit the ability to run applications and scripts that can be used to enumerate or exploit privileges. Approval lists control which applications and scripts can execute. Deny lists control which known malicious applications and scripts are blocked or require additional auditing.

5. Patch and update systems and applications

It’s not 100% protection, but it certainly makes the attacker’s goal of privilege attack and escalation more difficult.

6. Audit and log all privilege access usage

Make sure to monitor privilege usage for abuse and suspicious activity. Set alerts to ensure you have visibility and can investigate when something suspicious occurs. Should a privilege escalation exploit occur, you’ll be able to conduct incident response and identify the root cause of the attack to prevent it from happening again.

Looking for more advice on defending against privilege escalation attacks?

We’ve covered a basic explanation of privileges in Windows and foundational techniques and security controls to combat privilege escalation attacks. Privilege escalation defense does get more complicated when we start looking into Active Directory, cloud environments, and Single-Sign-On.

If you’re looking for more detail on privilege escalation techniques on Active Directory, I recommend reading our whitepaper:

Active Directory Security and Hardening

FREE WHITEPAPER
Active Directory Security and Hardening

An ethical hacker’s guide to reducing AD risks