Windows Privilege Escalation Cheatsheet
A practical, ordered checklist for Windows local privilege escalation during labs, CTFs, and authorised internal testing.
SharpHound
HTB: Escape
Active Directory machine demonstrating MSSQL abuse leading to credential leakage and AD CS certificate abuse for full domain compromise.
HTB: Forest
Active Directory machine demonstrating anonymous LDAP enumeration, AS-REP Roasting, nested group abuse, and DCSync-based domain compromise.
HTB: Sauna
Active Directory machine demonstrating username generation, AS-REP Roasting, AutoLogon credential discovery, and DCSync-based domain compromise.