Windows Privesc Playground
A misconfigured service runs as SYSTEM with a writable binary path. Replace it and escalate — no exploit needed.
A service running as SYSTEM whose binary sits somewhere you can write. No exploit, no memory corruption — just a misconfiguration, which is how most real privilege escalation happens.
How to use it
- Enumerate services and their binary paths.
- Find the one running as SYSTEM with a writable path.
- Replace it and escalate on restart.
What to take away
Misconfiguration beats exploitation
Weak service permissions, unquoted paths and writable directories in PATH are far more common than an unpatched kernel bug, and far more reliable.
Enumeration is most of the work
The escalation itself is usually seconds. Finding the one weak setting among hundreds is the skill.
Frequently asked questions
What is an unquoted service path?
A service path with spaces and no quotes, so Windows tries each prefix in turn. C:\Program Files\My App\svc.exe means it will try C:\Program.exe first — writable by a low-privileged user in some configurations.
How is this prevented?
Quote service paths, restrict write access to service binaries and their directories, run services as low-privileged accounts, and audit permissions regularly.
Where this fits in the course
This security lab pairs with Path 16 — Advanced — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Linux Privesc Playground — Enumerate SUID binaries on a simulated box and find the one GTFOBins turns straight into a root shell.
- Active Directory Attack Lab — A guided walkthrough of BloodHound-style graph recon, Kerberoasting a weak service account, and forging a Golden Ticket.
- Kerberoasting Simulator — Request a service ticket for a weak-password service account, then crack the offline-crackable hash it hands you.
- Docker Escape Playground — A container mounts the host's Docker socket. Use it to spin up a privileged container and step onto the host itself.