Escalate on a Windows VM you weakened, and harden it

short · 60 min · Objective 4.3

Task

Escalate from a standard user to administrator on a Windows VM you built and deliberately weakened, using a configuration path rather than an exploit, then apply the hardening that removes it — because reading about Windows tokens and service permissions is no substitute for seeing one give way.

Steps

  1. On the lab you own, build a disposable Windows VM and plant one escalation path: an unquoted service path with a writable directory, a service whose binary or configuration a standard user can modify, or a stored credential in the registry. Snapshot it.
  2. Log in as a standard user and enumerate: service permissions, unquoted paths, stored credentials, writable locations in the system path.
  3. Identify the planted path from enumeration, recorded in /tmp/path.md.
  4. Escalate to administrator by that path.
  5. Apply the hardening that removes it — quote the path, tighten the service permission, remove the stored credential — and confirm the path no longer works.
  6. Revert the snapshot.

Verify

grep -ciE "escalat|administrator|SYSTEM|high integrity" /tmp/result.md
grep -ciE "unquoted|service permission|stored credential|writable" /tmp/path.md
grep -ciE "quoted|tightened|removed|no longer" /tmp/hardening.md

The first count must be non-zero: you recorded reaching administrator or SYSTEM. The second must be non-zero: you recorded which Windows-specific misconfiguration gave the path — the point is that these are configuration issues, not exploits. The third must be non-zero: you demonstrated the hardening removing the path, which turns the exercise into a finding with a fix.

Notes

Tokens and privileges are Windows-specific, and what SeImpersonate buys an attacker is the kind of thing that only lands when you see it. Unquoted service paths, weak service permissions and stored credentials are configuration findings, worth reporting even where you demonstrate no full escalation. The hardening that removes each path is the remediation the report needs. Everything ran on a disposable Windows VM you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.