Windows - Grimoire

Windows post-exploitation centres on understanding where you sit in the local and domain privilege hierarchy, then escalating through misconfigs, token abuse, or credential access. These pages cover the core paths.

Privilege Escalation

Service misconfigs, unquoted paths, AlwaysInstallElevated, token impersonation, SeImpersonatePrivilege, and WinPEAS

Post Exploitation

Credential dumping, persistence, AV evasion basics, and lateral movement prep from a Windows foothold

First Things After Shell

Run these immediately on landing to understand your position before escalating:

whoami /all                          :: current user, groups, and privileges
hostname                             :: machine name
systeminfo                           :: OS version, patch level, architecture
set                                  :: environment variables (check PATH for writable dirs)
net user                             :: local accounts
net localgroup administrators        :: who is local admin
ipconfig /all                        :: interfaces and DNS (tells you if domain-joined)
netstat -ano                         :: active connections and listening ports
netstat -ano | findstr LISTENING     :: just the listening ports (+ owning PID)
netsh advfirewall show allprofiles   :: firewall state per profile (Domain/Private/Public)
tasklist /svc                        :: running processes with service names
qwinsta                              :: RDP/console sessions and who is logged on
query user                           :: logged-on users with session IDs and idle time

qwinsta (aka query session) shows other active sessions. A second Active or Disc session for a privileged user is a hijack opportunity: tscon <ID> /dest:<your-session> from a SYSTEM context steals it without a password.

# Check if domain-joined
(Get-WmiObject Win32_ComputerSystem).PartOfDomain

# List all local users and their enabled status
Get-LocalUser | Select-Object Name, Enabled, LastLogon

Check netstat -ano for services bound to 127.0.0.1 — internal-only listeners are common privesc and pivot targets. See Listening Services and Ports.

Windows commands

Microsoft’s full reference for every built-in command: syntax, flags, and examples.