> For the complete documentation index, see [llms.txt](https://dudisamarel.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dudisamarel.gitbook.io/oscp-notes/windows/local-privilege-escalation.md).

# Local Privilege Escalation

## Basic Enumeration

{% content-ref url="/pages/RALKWYO5g600N4XBWrqc" %}
[Local Enumeration](/oscp-notes/windows/enumeration/local-enumeration.md)
{% endcontent-ref %}

## Windows Services Exploitations

### Service Binary Hijacking

This attack involves replacing the service binary with a malicious version and restart the service.

{% content-ref url="/pages/fCo9loCl3HT4OENI7fA9" %}
[Service Binary Hijacking](/oscp-notes/windows/local-privilege-escalation/service-binary-hijacking.md)
{% endcontent-ref %}

### Service DLL Hijacking

This attack is similar to the "Service Binary Hijacking" but Instead of replacing the binary, it involves overwriting a [DLL ](https://en.wikipedia.org/wiki/Dynamic-link_library)the binary uses.

Another method is to hijack the DLL search order.

```
1. The directory from which the application loaded.
2. The system directory.
3. The 16-bit system directory.
4. The Windows directory. 
5. The current directory.
6. The directories that are listed in the PATH environment variable.
```

{% content-ref url="/pages/pumD661QmXDvSyhPeNjj" %}
[Service DLL Hijacking](/oscp-notes/windows/local-privilege-escalation/service-dll-hijacking.md)
{% endcontent-ref %}

### Unquoted Service Paths

This attack relies on windows find an executable path when it's Unquoted.

{% content-ref url="/pages/3t07NFY7Bc7H4KkUHH0L" %}
[Unquoted Service Paths](/oscp-notes/windows/local-privilege-escalation/unquoted-service-paths.md)
{% endcontent-ref %}

## Scheduled Tasks

Windows Task Scheduler can execute automated tasks. This tasks can execute binary files and also scripts. Also, The scheduled tasks is running behalf on user.

{% content-ref url="/pages/dyhysKb0KvX4wNltqXso" %}
[Scheduled Tasks](/oscp-notes/windows/local-privilege-escalation/scheduled-tasks.md)
{% endcontent-ref %}

## Token impersonation

Windows identifies users by generating an access token assigned to each user. This token contains information about the user's privileges. When a user runs a process or thread, the primary token is assigned, specifying the permissions for that process. A thread can also have an impersonation token assigned, which provides a different security context; in this case, the process will run based on the impersonation token instead of the primary token.

{% content-ref url="/pages/sFU61qxT9zXOKVRMgwLa" %}
[Token impersonation](/oscp-notes/windows/local-privilege-escalation/token-impersonation.md)
{% endcontent-ref %}

## References

{% embed url="<https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation>" %}
Hacktricks - Windows Local Privilege Escalation
{% endembed %}