Lion Cipher Lab
Find (and fix) privilege-escalation paths on your own Windows lab
- Penetration Testing / Red Team
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Attackers rarely land on Windows as an administrator. They get in as some ordinary account — a compromised login, a service account, a user who clicked the wrong thing — and then hunt for a misconfiguration that lets them climb to Administrator or SYSTEM, the all-powerful built-in account that owns the whole machine. That climb is privilege escalation, and on Windows it almost always abuses something an admin left wrong: a service whose program path isn't quoted, a service whose permissions let ordinary users rewrite it, an installer policy that hands out SYSTEM, or a password sitting in a…
What you'll learn
- what Windows privilege escalation, SYSTEM, and a Windows service are
- enumerating a Windows host for privesc misconfigurations
- spotting and fixing an unquoted service path
- recognising weak service permissions (service ACLs) and AlwaysInstallElevated
- using WinPEAS to enumerate a host you own
- remediating each misconfiguration you find and confirming it is closed
Steps in this lab
- The one rule, and what Windows privilege escalation is
- Open PowerShell as your normal user
- Look for unquoted service paths
- Look for weak service permissions (service ACLs)
- Check AlwaysInstallElevated
- Look for stored credentials
- Enumerate systematically with WinPEAS
- Fix what you found
- Why hunting your own box is the point