Member-only story
Red Teaming 101: Privilege Escalation on Windows Using LNK Files (Part 3)
In the two previous parts of the Red Teaming 101 series, we showed how to create a malicious LNK file (shortcut) and how to bypass Mark of the Web (MotW) on Windows using the ZIP file trick. In this part, I will demonstrate a tricky method to escalate privileges by running your LNK file as an administrator without alerting AV/EDR. But before we dive in, please clap and follow me to encourage me to keep sharing the best of what I’ve learned!

Disclaimer: This article is intended for educational purposes only. The techniques discussed are meant to increase awareness of potential vulnerabilities and improve security practices. Always seek permission before testing or exploiting any systems.
Privilege Escalation Using LNK Files
Privilege escalation is a key step in red teaming, where attackers or testers aim to gain higher-level permissions on a system, such as administrator rights, to further infiltrate or control a target environment. On Windows, one often-overlooked method for privilege escalation is through manipulating LNK files to run them with elevated privileges. While LNK files are widely used, their inner workings, especially how “Run as Administrator” is stored, are not well-documented.