Lab 01 — Windows Local Privilege-Escalation Analyzer

Operation Cedar Lattice, Phase 04. You have your first foothold on a Meridian Freight Windows host as a low-integrity service or standard user. The question every operator asks next is: what on this box turns "a user" into NT AUTHORITY\SYSTEM? This lab is the analyzer that answers it from a synthetic host-enumeration snapshot — the same facts WinPEAS/Seatbelt surface — and, for every finding, names the ATT&CK technique, the path to SYSTEM, and the detection that catches it.

Safety. Authorized-lab only. This is an auditor over host metadata: it reasons about enumeration output (HostFacts), never a live host. There is no exploitation, no service write, no DLL drop, no token theft. Every finding ends in its detection. Same boundary as the security track's offensive-methodology-mastery/ labs.

The problem

Windows privilege escalation is rarely a memory-corruption exploit; far more often it is a misconfiguration that lets a low-privileged principal influence something a SYSTEM-level component trusts: a service binary it launches, a service it can reconfigure, a token privilege it foolishly granted, an autorun key it reads at admin logon, or a scheduled task it runs as SYSTEM. The skill is to read a host snapshot and see the paths, not the individual facts.

What you build (lab.py)

analyze(host_facts) -> [findings], composed from focused helpers:

• unquoted_path_issue(svc) — an unquoted ImagePath with a space and a writable intermediate directory (the SCM resolves prefixes; an interceptor at a higher-precedence prefix runs as the service account). T1574.009.
• writable_service(svc) — a service whose on-disk binary is writable (T1574.010) or whose service DACL grants a low-priv principal SERVICE_CHANGE_CONFIG/WRITE_DAC/… so they can reconfigure binPath (T1543.003).
• dangerous_privileges(facts) — token privileges that are a known primitive: SeImpersonate/ SeAssignPrimaryToken (the potato family, T1134.001/.002), SeDebug, SeBackup/ SeRestore, SeTakeOwnership, SeLoadDriver.
• writable_autorun(reg) — a Run/RunOnce value a low-priv user can rewrite (T1547.001); HKLM is high (runs privileged at logon), HKCU is lower.
• writable_scheduled_task(task) — a task whose action target is user-writable, run as SYSTEM (T1053.005).

Each Finding carries technique, path_to_system, detection, plus runs_as and severity.

Attack cases the tests cover

• Unquoted service path with a writable intermediate dir → hijack as LocalSystem; quoted paths and paths with no writable dir are clean.
• Writable service binary, and a weak service DACL (only when the held right is actually dangerous).
• SeImpersonatePrivilege held at Medium integrity → potato-class path to SYSTEM; skipped when the process is already at System integrity (nothing to escalate to).
• Weak HKLM autorun ACL (high) vs HKCU (medium); writable SYSTEM scheduled task.
• A correctly-configured clean host yields no findings; every finding has an ATT&CK id and a detection; output is deterministic and severity-sorted.

Run

pip install -r requirements.txt
LAB_MODULE=solution python3 -m pytest -q   # reference passes (15 tests)
python3 -m pytest -q                         # your implementation after the TODOs

Hardening / detection (what each finding ships)

Extensions (build in your own isolated range)

• Parse a real Seatbelt/accesschk JSON export and resolve the effective DACL (owner + inherited ACEs), not a pre-labeled writable_by.
• Add DLL search-order hijacking (T1574.001): a writable dir on a service's DLL search path.
• Cross-reference held privileges with the running service account (IIS/MSSQL) to rank potato feasibility, and emit a Sigma rule per finding.
• Re-implement the analyzer's core in C# (the Windows offensive language) as a Seatbelt-style collector over WMI/registry on an owned host — read-only, no exploitation.

Interview / resume

"Built a Windows privilege-escalation path analyzer that ingests host enumeration (services, token privileges, registry autoruns, scheduled tasks, integrity level), reports each misconfiguration's ATT&CK technique and concrete path to SYSTEM, and pairs every finding with the Sysmon/Event-Log detection — encoding the principle that an offensive finding without its detection is half the value."

Limitations: a curated rule set over synthetic facts; "writable by principal X" is given, not resolved from a live effective-DACL; ignores patch level, WOW64 redirection, AppLocker/WDAC, and service triggers that change exploitability. Output is leads to verify on an owned range, not proof.