Windows Privilege Escalation

You have a low-privilege shell on a Windows system. Reason through the privilege escalation attack surface systematically.

**User & System Context**
- What does `whoami /all` reveal about your current privileges?
- What privileges in the token are immediately exploitable? (SeImpersonatePrivilege, SeDebugPrivilege, SeBackupPrivilege)
- What does `systeminfo` reveal about the patch level and hotfixes?

**Service Misconfigurations**
- What is an unquoted service path and how do you exploit it?
- How do you identify services with weak file or folder permissions?
- What does a writable service binary allow you to do?
- How do you check service permissions using `accesschk`?

**Registry Misconfigurations**
- What registry keys controlling service binaries might be writable by your user?
- What is the AlwaysInstallElevated policy and how do you exploit it?
- How do you check AutoRun registry keys for writable paths?

**Token Privileges**
- Given SeImpersonatePrivilege, which Potato attack applies to your target Windows version?
- What does SeBackupPrivilege allow you to do for credential extraction?
- How does SeRestorePrivilege lead to privilege escalation?

**DLL Hijacking**
- How do you identify DLL hijacking opportunities in service startup?
- What is the Windows DLL search order and which positions are exploitable?
- What does Process Monitor show that reveals DLL hijacking candidates?

Output:
- Privilege escalation checklist with tool commands
- Privilege token decision tree
- WinPEAS output interpretation guide