Windows - Grimoire

Windows post-exploitation centres on understanding where you sit in the local and domain privilege hierarchy, then escalating through misconfigs, token abuse, or credential access. These pages cover the core paths.

Privilege Escalation

Service misconfigs, unquoted paths, AlwaysInstallElevated, token impersonation, SeImpersonatePrivilege, and WinPEAS

Post Exploitation

Credential dumping, persistence, AV evasion basics, and lateral movement prep from a Windows foothold

First Things After Shell

Run these immediately on landing to understand your position before escalating:

whoami /all                          :: current user, groups, and privileges
hostname                             :: machine name
systeminfo                           :: OS version, patch level, architecture
net user                             :: local accounts
net localgroup administrators        :: who is local admin
ipconfig /all                        :: interfaces and DNS (tells you if domain-joined)
netstat -ano                         :: active connections and listening ports
tasklist /svc                        :: running processes with service names

# Check if domain-joined
(Get-WmiObject Win32_ComputerSystem).PartOfDomain

# List all local users and their enabled status
Get-LocalUser | Select-Object Name, Enabled, LastLogon

awk Windows Privilege Escalation

Privilege Escalation

Post Exploitation

​First Things After Shell

First Things After Shell