Notes
  • Enumeration
  • Shells
    • Interactive TTY Shell
    • Spawn a Shell
    • Reverse Shells
  • Buffer OverFlow
    • Do Stack Buffer Overflow Good
    • Server-Memc.exe
  • Tools
    • hydra
    • Hashcat
    • SSH tricks
    • Git
    • pspy
    • Impacket-tools
    • Evil-winrm
    • Crackmapexec
    • Empire
    • SQLMap
    • msfvenon
    • Mimikatz
    • Docker
    • Weevely
    • gpp-decrypt
    • PLink.exe
    • john
    • wfuzz
    • Searchsploit
  • Python
    • Useful Libraries
    • Python Tricks
    • Using fstrings Python3
  • PHP
    • Web shells
    • Bypassing Dangerous PHP Functions
    • Exploiting RFI in a PHP application and bypassing remote URL inclusion restrict
    • PHP - LFI and RFI
  • SQL Injection
    • Getting a Shell
    • Enable xp_cmdshell
    • Shell From PHPMyAdmin
  • OpenSSL - CheatSheet
  • Windows
    • TeamViewer Decrypt
    • Commando VM
    • PrivEsc
      • Bypass AppLocker
      • Disable Windows Defender
      • Abusing Services
      • Blogs About Windows
      • Guides
      • Powershell Runas
      • Living Off The Land Binaries and Scripts
      • DLL Injection
      • Common Windows PrivEsc
      • Windows PrivEsc Exploits
      • Abusing Files Permissions
      • Interesting Files
      • File Transfer Methods
      • Bloodhound
      • Potatos and Tokens
        • PrintSpoofer Win10 - Server 2016/2019
      • SessionGopher.ps1
      • Sherlock.ps1
      • Windows - PrivEsc Scripts
        • Windows Exploit Suggester
    • Powershell
    • Anti-Virus Evasion
    • Post-Exploitation
      • Extract Windows Hashes Offline
      • Dumping Domain Password Hashes
    • Vulnerabilities
      • MS15-051
      • MS17-010
      • MS08-067
    • Active Directory
      • Get-DomainSPN Ticket
      • Kerberos
      • Bloodhound
      • DNS Admin to SYSTEM
      • DC Sync Attack
      • Escalating privileges with ACLs in Active Directory
      • How SMB Relay Works
      • Practical Guide to NTLM Relaying
      • Microsoft Exchange – ACL
  • Linux
    • PrivEsc
      • LXE to root
      • MySQL as root
      • Logrotate PrivEsc 3.15.1
      • Guides
      • SSH Tricks
      • Abusing Unix Wildcards
      • Linux - PrivEsc Scripts
    • Kernel Exploits
  • OSCP
    • Resources & Guides
      • WordPress PrivEsc
    • HackTheBox - Writeups
      • HTB - Networked
      • HTB - Cronos
      • HTB - Nibbles
      • HTB - LaCasaDePapel
      • HTB - Sense
      • HTB - October
      • HTB - Brainfuck
      • HTB - Mirai
      • HTB - Blocky
      • HTB - Teacher
      • HTB - Tally
      • HTB - Bank
      • HTB - Jeeves
      • HTB - Silo
      • HTB - Bastard
      • HTB - Legacy
      • HTB - Heist
      • HTB - Active
      • HTB - Bastion
      • HTB - Haystack
      • HTB - Bashed
      • HTB - Blue
      • HTB - Tenten
      • HTB - Artic
      • HTB - Bounty
      • HTB - Jerry
  • CTF
    • TryHackMe Writeups
      • TryHackMe - Tempus Fugit Durius
      • TryHackMe - Jack
    • Tools and Resources
Powered by GitBook
On this page
  1. Windows
  2. PrivEsc

Windows PrivEsc Exploits

PreviousCommon Windows PrivEscNextAbusing Files Permissions

Last updated 5 years ago

Privilege Escalation Table

The following table has been compiled to assist in the process of privilege escalation due to lack of sufficient patching.

Operating System

Description

Security Bulletin

KB

Exploit

Windows Server 2016

Windows Kernel Mode Drivers

3199135

Windows Server 2008 ,7,8,10 Windows Server 2012

Secondary Logon Handle

3143141

Windows Server 2008, Vista, 7

WebDAV

3136041

Windows Server 2003, Windows Server 2008, Windows 7, Windows 8, Windows 2012

Windows Kernel Mode Drivers

3057191

Windows Server 2003, Windows Server 2008, Windows Server 2012, 7, 8

Win32k.sys

3000061

Windows Server 2003, Windows Server 2008, 7, 8, Windows Server 2012

AFD Driver

2975684

Windows XP, Windows Server 2003

Windows Kernel

2914368

Windows Server 2003, Windows Server 2008, 7, 8, Windows Server 2012

Kernel Mode Driver

2778930

Windows Server 2008, 7

Task Scheduler

2305420

Windows Server 2003, Windows Server 2008, 7, XP

KiTrap0D

977165

Windows Server 2003, XP

NDProxy

2914368

Windows Server 2003, Windows Server 2008, 7, 8, Windows Server 2012

Kernel Driver

3057839

Windows Server 2003, XP

AFD.sys

2592799

Windows Server 2003, XP

NDISTAPI

2566454

Windows Server 2003, Windows Server 2008, 7, 8, Windows Server 2012

RPC

3067505

Windows Server 2003, Windows Server 2008, 7, 8, Windows Server 2012

Hot Potato

3164038

Windows Server 2003, Windows Server 2008, 7, XP

Kernel Driver

3036220

Windows Server 2003, Windows Server 2008, 7, XP

AFD.sys

2503665

MS16-135
Exploit
Github
MS16-032
GitHub
ExploitDB
Metasploit
MS16-016
Github
MS15-051
GitHub
ExploitDB
Metasploit
MS14-058
GitHub
ExploitDB
Metasploit
MS14-040
Python
EXE
ExploitDB
Github
MS14-002
Metasploit
MS13-005
Metasploit
ExploitDB
GitHub
MS10-092
Metasploit
ExploitDB
MS10-015
Exploit
ExploitDB
GitHub
Metasploit
MS14-002
Exploit
ExploitDB
ExploitDB
Github
MS15-061
Github
MS11-080
EXE
Metasploit
ExploitDB
MS11-062
ExploitDB
MS15-076
Github
MS16-075
GitHub
PowerShell
HotPotato
MS15-010
GitHub
ExploitDB
MS11-046
EXE
ExploitDB
LogoPrivilege Escalation – Page 2 – Penetration Testing LabPenetration Testing Lab