so you've popped box inside nice juicy windows network maybe you leveraged remote heap overflowor you phished your way into the network it' time to start looking for ways to escalate privileges if you're already system or administratoryou probably want several ways of achieving those privileges in case patch cycle kills your access it can also be important to have catalog of privilege escalations in your back pocketas some enterprises run software that may be difficult to analyze in your own environmentand you may not run into that software until you're in an enterprise of the same size or composition in typical privilege escalationyou're going to exploit poorly coded driver or native windows kernel issuebut if you use low-quality exploit or there' problem during exploitationyou run the risk of system instability we're going to explore some other means of acquiring elevated privileges on windows system administrators in large enterprises commonly have scheduled tasks or services that will execute child processes or run vbscript or powershell scripts to automate tasks vendorstoooften have automatedbuilt-in tasks that behave the same way we're going to try to take advantage of highprivilege processes handling files or executing binaries that are writable by low-privilege users there are countless ways for you to try to escalate privileges on windowsand we are only going to cover few howeverwhen you understand these core conceptsyou can expand your scripts to begin exploring other darkmusty corners of your windows targets we'll start by learning how to apply windows wmi programming to create flexible interface that monitors the creation of new processes we harvest useful data such as the file pathsthe user that created the processand enabled privileges our process monitoring then hands off all file paths to file-monitoring script that continuously keeps track of any new files created and what is written to them this tells us which files are being accessed by high-privilege processes and the file' location the final step is to intercept the file-creation process so that we can inject scripting code and have the high-privilege process execute command shell the beauty of this whole process is that it doesn' involve any api hookingso we can fly under most antivirus software' radar