Windows Privilege Escalation with WinPEAS

Task: Setup Vulnerable VM

Bypass method: Set-ExecutionPolicy -ExecutionPolicy bypass -scope currentuser

#	Vulnerability	Exploit	Fix	Resource
1	Unquoted service path — VulnSvc (C:\Program Files\Vulnerable Service\Vulnerable Service.exe)	Drop payload at an earlier unquoted breakpoint (e.g. C:\Program.exe), restart service	Quote the ImagePath value	Blackpoint- Unlocking the Mystery of Unquoted Service Paths
2	AlwaysInstallElevated (HKLM + HKCU = 1)	Build malicious MSI (msfvenom -f msi), run with msiexec /quiet /qn /i payload.msi	Set both registry values to 0 or delete them	Specterops- AlwaysInstallElevated
3	Weak service permissions — WeakSvc	sc config WeakSvc binpath= "C:\payload.exe", then restart service	Reset service ACL with sc sdset so only admins can reconfigure	The Hacker Recipes- Weak Service Permissions
4	Weak registry permissions — RegSvc	reg add to overwrite ImagePath directly under the service's registry key	Restrict registry key ACL to admins only	Juggernaut Pentesting Academy - Weak Registry Key Permissions
5	DLL hijacking — DLLHijackSvc (C:\Program Files\DLL Hijack App)	Drop malicious DLL with expected filename in the writable, earlier-searched folder	Load DLLs by full path in code; restrict folder write access	Crowdstrike
6	Missing binary — MissingBinSvc (C:\Program Files\Missing App)	Create payload at the exact expected path, start the service	Remove orphaned service entry or restore real binary with locked-down folder	SecQuest- Binary Exploitation Techniques
7	Writable PATH directory (C:\Program Files\Common PATH)	Drop payload named after a commonly-invoked binary in the writable PATH folder	Remove directory from PATH or restrict its ACL	Praetorian
8	Writable all-users startup folder	Drop payload exe in the Startup folder, executes at next login for any user	Restrict write access to Administrators/SYSTEM only	Mitre Attack
9	Unattend.xml with plaintext credentials (C:\Windows\Panther\Unattend\Unattended.xml)	Decode Base64 <Password> field to recover cleartext credential	Delete unattend files after provisioning	Specterops- Unattended Install Files
10	Vulnerable scheduled task — VulnScheduledTask (unquoted path, C:\Program Files\Scheduled Task)	Drop payload at unquoted breakpoint, trigger task (schtasks /run /tn VulnScheduledTask)	Quote task action path, restrict directory ACL	Cymulate - Scheduled Tasks

---

Issues and Fixes Log

#	Issue	What Happened	How it Was Fixed	Status
1	msfvenom not found	Ran msfvenom on the Windows VM instead of Kali	Switched to the Kali terminal	✅ Fixed
2	missing.exe built in wrong format	Used -f exe instead of -f exe-service for the service payload	Regenerated with -f exe-service flag — confirmed by larger file size (12288 vs 7168 bytes)	✅ Fixed
3	exploit unknown command in msfconsole	Used use payload windows/meterpreter/reverse_tcp directly instead of the correct handler module	Switched to use exploit/multi/handler then set the payload inside it	✅ Fixed
4	Payloads disappeared after download	Windows Defender automatically quarantined both missing.exe and svchost.exe immediately after download	Opened elevated PowerShell as Administrator, disabled Defender with Set-MpPreference -DisableRealtimeMonitoring $true, added exclusion for C:\Users\champuser, re-downloaded both files	✅ Fixed
5	Could not disable Defender	Ran Set-MpPreference without admin rights and got a permissions error	Closed PowerShell and reopened it as Administrator (right click → Run as Administrator)	✅ Fixed
6	sc qc returned nothing in PowerShell	PowerShell's sc is an alias for Set-Content, not the Service Control Manager	Used sc.exe explicitly instead of sc in PowerShell	✅ Fixed
7	sc qc failed with display name	Used the display name shown in services.msc (e.g. "Missing Binary Service (Lab)") instead of the internal service name	Used Get-WmiObject Win32_Service | Where-Object {$_.Description -like "*SEC-335*"} | Select-Object Name, DisplayName, PathName to find real internal names and paths	✅ Fixed
8	MissingBinSvc disappeared from service list	Using sc (which was actually Set-Content) instead of sc.exe to stop/start the service corrupted or removed the service entry	Re-ran Setup-Lab.ps1 to replant all 10 vulnerabilities	✅ Fixed
9	Setup script showed errors on second run	Services already existed from first run so the script couldn't create them again	Errors were non-critical — script still completed successfully and all 10 vulnerabilities were confirmed present	✅ Fixed
10	http.server stopped mid-session	Python web server timed out or was closed between sessions	Restarted with python3 -m http.server 8000 on Kali	✅ Fixed
11	curl alias causing argument errors in PowerShell	PowerShell's built-in curl alias behaves differently than the real curl.exe	Used curl.exe explicitly to bypass the PowerShell alias	✅ Fixed
12	Second listener failed to bind to port 9090	Tried to start a new listener while the original was still running on the same port	Killed all jobs with jobs -K before starting a new listener	✅ Fixed
13	Netcat could not bind to port 9090	Metasploit listener was already holding port 9090 so netcat couldn't use it	Not a real error — confirmed the Metasploit listener was still active	✅ Fixed
14	Payload not calling back to Metasploit listener	missing.exe executes (service times out as expected) but no session appears in Metasploit even when run directly	Tried: regenerating payloads, changing ports, killing and restarting listener, running payload directly, network connectivity test (passed). Currently switching to port 4444 and regenerating payloads again	🔲 Unsolved