Hello there, I’ve been checking out a bunch of guides, including the TCM-Security Course on Windows Privilege Escalation.

Description: Find the path by chaining multiple vulnerabilities, leading you to capture the flag

USER ACCOUNTS VS. SERVICE ACCOUNTS

Using Spartacus as a starting point, we created Crassus to extend Windows privilege escalation finding capabilities beyond simply looking for missing files.

All you need to know about Windows OS security as an Ethical Hacker — User mode vs Kernel Mode, Access Token vs ACL, Privileges vs…

A technical walkthrough of chaining Windows Server misconfigurations into full administrative compromise.

A technical walkthrough of chaining Windows Server misconfigurations into full administrative compromise.

Hi Everyone!! I am documenting my learning here with you inorder to track and revise it later.

Today, we’re diving into LDAP exploitation. Using the Vulnlab box ‘Baby,’ we’ll cover how to enumerate directory services, find hidden…

How are Groups and Privileges used by Windows in granting access? What about Integrity Levels?

📌 Introduction

Introduction

During a penetration test against the INLANEFREIGHT organization, you encounter a non-domain joined Windows server host that suffers from…

As an add-on to their annual penetration test, the INLANEFREIGHT organization has asked you to perform a security review of their standard…

Description : Practice your Windows Privilege Escalation skills on an intentionally misconfigured Windows VM with multiple ways to get…

TL;DR A public proof-of-concept now targets CVE-2026-42980, a Windows privilege escalation flaw in the NT kernel. The bug lets a local, low-privileged user reach SYSTEM. Microsoft patched it in th…

TL;DR Researchers at Calif.io published full technical details and working proof-of-concept exploit code for CVE-2026-50343, tracked as Dark Elevator. The Windows privilege escalation bug, rated C…

## Overview

This write-up covers how an attacker with access to an account in the DNSAdmins group can leverage the native DNS management features to…

This write-up covers how an attacker with access to an account in the DNSAdmins group can leverage the native DNS management features to…