Ravindra BagaleCourses & study guides मराठी Track your progress

26. Privilege Escalation

26.5 A Note on Windows Escalation

By Last updated:

Windows var privilege escalation cha kalpana sarkhich aahe, marg vegle:

  • Unquoted service paths and services with weak permissions.
  • AlwaysInstallElevated registry setting.
  • Stored credentials and tokens.
  • Missing patches (tools like WinPEAS enumerate these, like linPEAS on Linux).

You do not need a Windows lab for this book, but know the idea for interviews: the goal is the same (become Administrator/SYSTEM); only the specific weaknesses differ.

Ravindra Bagale's Tip

If an interviewer asks about "Windows privilege escalation", don't panic – the concept is the same: misconfiguration, weak permissions, missing patches. The tool is called WinPEAS. Saying just this much already makes a good impression.

Practice task

In one paragraph, explain why privilege escalation is the same idea on Linux and Windows, and name the enumeration tool for each (linPEAS and WinPEAS).

Windows hardening basics that block common escalation

Windows has its own escalation patterns (token abuse, weak services, unquoted paths, old drivers). Defenders focus on:

  1. Keep Windows and drivers patched.
  2. Run users as standard users, not local admins.
  3. Use Credential Guard and LSA protection where licences allow.
  4. Monitor with Windows Event logs and EDR tools.

Real examples

Global: Microsoft publishes hardening baselines. Indian company (sample): a call-centre VDI environment removed local admin rights and cut malware impact sharply.

Recap

  • Patch, least privilege, credential protection.
  • Lab practise only on machines you own.

Defender's worksheet (do this today)

  1. Write the lesson title and date in your notebook.
  2. List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
  3. Run one safe command or checklist item from the lesson on a lab system only.
  4. Paste the command and its output under an Evidence heading.
  5. Write one fix you would give a teammate in two sentences.
  6. Write one mistake students make with this topic and how to avoid it.

More real-world pictures

Indian workplace (sample data)

Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.

Global practice

Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.

Home and family

Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.

Connect to earlier chapters

Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.

Common mistakes

  • Skipping written permission just for a quick scan.
  • Practising on hostel or office Wi-Fi targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Teach one other person the warning from this lesson.

Windows checklist you can hand to IT

1) No local admin on day-to-day accounts. 2) LAPS or equivalent for local admin passwords. 3) Prompt patching of drivers. 4) Disable unused services. 5) EDR installed and healthy. This checklist blocks a large share of practical Windows escalation paths without teaching attackers anything new.