What does this tool do?
The Windows Privilege Escalation Reference is a searchable catalogue of techniques to reach SYSTEM on Windows, each with an explanation of why it works. It covers token abuse (SeImpersonate -> PrintSpoofer/GodPotato/JuicyPotato), unquoted service paths, weak service permissions, AlwaysInstallElevated, registry autoruns and cleartext AutoLogon passwords, scheduled tasks, DLL hijacking, stored credentials (cmdkey, runas /savecred), LSASS dumping and SeBackupPrivilege. Everything runs in your browser with no data sent to a server; it is intended for authorized testing and educational use only.
How to use it
- Enter your listener IP and port.
- Pick the command or payload that fits your setup.
- Copy it and use it only on systems you are authorized to test.
Typical workflow
After landing a shell, enumerate automatically: run winPEAS or PowerUp.ps1 and check your token privileges with 'whoami /priv'. Search the finding here (e.g. SeImpersonatePrivilege enabled, an unquoted service path, AlwaysInstallElevated=1) to get the matching exploit chain and commands — most paths lead straight to an 'nt authority\system' shell.
Why these techniques work
Many rely on Windows letting you abuse a specific privilege or misconfiguration. The SeImpersonate privilege enables Potato attacks, which trick a SYSTEM service into connecting to a rogue RPC/named pipe and steal its token. An unquoted service path ('C:\Program Files\My App\svc.exe') is abused because Windows splits the path on spaces and tries a writable location like 'C:\Program.exe' first.
Frequently asked questions
What is SeImpersonate and the Potato attack?
SeImpersonatePrivilege lets a process impersonate another user's security token and is common on service accounts (IIS, MSSQL). Potato attacks (PrintSpoofer, GodPotato, JuicyPotato) force a SYSTEM component to authenticate to an attacker-controlled endpoint, impersonate the returned SYSTEM token, and spawn a new process with it to gain full privileges.
How do I check my token privileges?
Run 'whoami /priv' to list every privilege on your current token with its state (Enabled/Disabled). If entries like SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege, SeBackupPrivilege or SeRestorePrivilege show 'Enabled', you can jump straight to the matching exploit in this reference.
What is an unquoted service path?
It is a service whose executable path contains spaces but is not wrapped in quotes, so Windows parses the path left to right, appending '.exe' at each space. For 'C:\Program Files\Sub Dir\svc.exe' it tries 'C:\Program.exe' first, so if you can write to that folder you drop your own payload there and run code as SYSTEM when the service starts.
Is Windows Privilege Escalation Reference free?
Yes. Windows Privilege Escalation Reference and all 300+ tools on MagmaNex are completely free with no signup or account required.
Is my data safe?
Yes. Everything runs locally in your browser. The data you enter is never sent to a server, stored, or shared.
Does it work on mobile?
Yes. Windows Privilege Escalation Reference works on phones, tablets and desktops — no app download needed.
🔒 Privacy: everything runs in your browser, your data is never sent to a server.