> For the complete documentation index, see [llms.txt](https://pentest.mxhx.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentest.mxhx.org/07-win-privesc.md).

# 07 Windows PrivEsc

- [1 Windows cmd kungfu](https://pentest.mxhx.org/07-win-privesc/windows-cmd-kungfu.md)
- [2 Enums](https://pentest.mxhx.org/07-win-privesc/win-enum.md)
- [3 PrivEsc](https://pentest.mxhx.org/07-win-privesc/win-privesc.md)
- [4 Kernel Exploits](https://pentest.mxhx.org/07-win-privesc/win-kernelexp.md): Windows PrivEsc Methods
- [5 Looting](https://pentest.mxhx.org/07-win-privesc/5-looting.md)
- [Bloodhound](https://pentest.mxhx.org/07-win-privesc/bloodhound.md)
- [DLL Hijack MSF](https://pentest.mxhx.org/07-win-privesc/06-dll-hijack.md)
- [Kerberos](https://pentest.mxhx.org/07-win-privesc/07-kerberos.md)
- [Memory Analysis](https://pentest.mxhx.org/07-win-privesc/04-memory-analysis.md)
- [NTDS](https://pentest.mxhx.org/07-win-privesc/ntds.md)
- [Powershell](https://pentest.mxhx.org/07-win-privesc/powershell.md)
- [Responder](https://pentest.mxhx.org/07-win-privesc/responder.md)
- [Saved Creds runas](https://pentest.mxhx.org/07-win-privesc/saved-creds-runas.md)