> For the complete documentation index, see [llms.txt](https://book.ice-wzl.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.ice-wzl.xyz/windows-priv-esc.md).

# Windows

* [Windows Privilege Escalation](/windows-priv-esc/win-priv-esc.md) - Enumeration, weak permissions, kernel exploits, UAC bypasses, services, miscellaneous techniques
* [Windows Privilege Abuse](/windows-priv-esc/windows-privilege-abuse.md) - SeImpersonate, SeDebug, SeTakeOwnership, SeBackup, DnsAdmins, Print Operators, Server Operators
* [Windows Credential Hunting](/windows-priv-esc/windows-credential-hunting.md) - Config files, browser data, PowerShell history, WiFi passwords, mRemoteNG, cookies, VHDX/VMDK
* [DLL Injection & Hijacking](/windows-priv-esc/dll-injection.md) - LoadLibrary, Reflective DLL, Manual Mapping, DLL Hijacking, DLL Proxying
* [Citrix / Restricted Desktop Breakout](/windows-priv-esc/citrix-breakout.md) - Dialog box escapes, SMB access, shortcut abuse, post-breakout priv esc
* [PowerShell Cheatsheet](/windows-priv-esc/powershell-cheatsheet.md)
* [Anti-Virus Evasion](/windows-priv-esc/windows-antivirus.md)
* [Windows Registry](/windows-priv-esc/windows-registry.md)
* [Windows Kernel Vulnerabilities](/windows-priv-esc/windows-kernel-vulnerabilities.md)
* [Windows Defender](/windows-priv-esc/windows-defender.md)
* [AMSI Bypasses](/windows-priv-esc/amsi-bypasses.md)
* [pktmon Packet Capture](/windows-priv-esc/pktmon-packet-capture-windows.md)
* [PowerShell Constrained Language Mode](/windows-priv-esc/powershell-constrained-language-mode.md)
* [Windows Survey](/windows-priv-esc/windows-survey.md)
* [Windows Persistence](https://github.com/jtaubs1/OSCP-Prep/blob/main/windows-priv-esc/windows-persistence.md)
* [Windows World Writeable Dirs](/windows-priv-esc/windows-world-writeable-dirs.md)
* [netsh](/windows-priv-esc/netsh.md)

{% file src="/files/4QbnpqAQhLToBOkhhtl6" %}