Privilege Escalation Fundamentals
Why Do We Need This?
Picture this: You've successfully infiltrated a system, but you're stuck with the digital equivalent of a janitor's key card when you really need the CEO's access. That's where privilege escalation comes in - it's your promotion from intern to manager in the world of system compromise.
Real-World Scenarios Where This Matters:
Web Application Pentests: Gained shell access through RCE but only as www-data user
Phishing Campaigns: Compromised employee workstation but need admin rights for lateral movement
Physical Assessments: Plugged in USB and got user shell but need SYSTEM for domain access
Red Team Operations: Initial foothold achieved but objective requires administrative control
CTF/Lab Environments: Learning fundamental escalation techniques before real-world application
Understanding Privilege Escalation
The Big Picture
What It Is: Escalating from low-privilege access to administrative or root access on target systems.
The Journey: You start as "just some user" and end up as "master of the digital universe" (at least on that one system). Think of it as climbing the corporate ladder, except instead of years of brown-nosing, you use technical exploitation.
Why It's Critical: Most initial compromises give you limited access. Without privilege escalation, you're like a burglar who broke into a house but can only access the guest bathroom.
The Privilege Escalation Methodology
Phase 1: Current Situation Assessment
Understanding your starting point is crucial - you can't plan a route if you don't know where you are.
Key Activities:
Identity Check: Determine current user account and its attributes
Privilege Assessment: Catalog available permissions and restrictions
System Overview: Identify operating system, version, and architecture
Environment Analysis: Understand security controls and monitoring
Phase 2: Information Gathering
Systematic enumeration forms the foundation of successful privilege escalation.
Critical Areas to Investigate:
Running services and their configurations
File and folder permissions across the system
Installed software and patch levels
User accounts and their privileges
Network services and internal connections
Scheduled tasks and automated processes
Phase 3: Weakness Identification
Raw enumeration data becomes actionable intelligence through careful analysis.
Common Goldmines:
Services running with excessive privileges
SUID files that shouldn't exist
Weak file permissions on important files
Stored credentials in configuration files
Outdated software with known exploits
Phase 4: Attack Vector Selection
Choose your approach based on multiple factors to maximize success probability.
Decision Factors:
Success probability vs effort required
Stealth level needed for the engagement
Risk of system instability or detection
Your skill level and available tools
Phase 5: Exploitation and Verification
Execute the chosen attack and confirm successful privilege escalation.
Execution Steps:
Execute chosen attack vector
Verify new privilege level
Test administrative capabilities
Document the successful method
Consider persistence if needed
Common Attack Vectors (The Greatest Hits)
The Easy Wins
Service Misconfigurations: Services running with admin privileges but weak security
File Permission Issues: Important files that regular users can modify
Stored Credentials: Passwords hiding in plain sight in config files
The Technical Challenges
Kernel Exploits: Attacking the operating system itself (high risk, high reward)
Token Manipulation: Stealing privileges from other processes
Application Vulnerabilities: Exploiting specific software weaknesses
Platform Differences
Linux Systems: Often focus on SUID binaries, sudo misconfigurations, and cron job abuse
Windows Systems: Typically involve service permissions, registry abuse, and token impersonation
Automated vs Manual: The Eternal Debate
The Automated Approach (The Speed Demon)
Pros: Fast, comprehensive, catches obvious issues
Cons: Noisy, might trigger alarms, generates false positives
Best For: Initial reconnaissance, time-pressured assessments
The Manual Approach (The Ninja)
Pros: Stealthy, thorough understanding, finds unique issues
Cons: Slow, requires expertise, might miss obvious things
Best For: Stealth operations, learning, complex environments
The Hybrid Method (The Best of Both Worlds)
Strategy: Use automated tools for the baseline, then go manual for the interesting stuff
Reality Check: This is what most professionals actually do in real engagements
Target Systems and Use Cases
Linux Servers
Web apps, databases, file servers
SUID abuse, service exploits, sudo misconfig
Windows Workstations
Employee machines, kiosks
Service permissions, registry abuse, scheduled tasks
Windows Servers
Domain controllers, app servers
Service exploits, token manipulation, kernel exploits
Embedded Systems
IoT devices, industrial systems
Default credentials, firmware exploits, service abuse
Success Framework: How to Know You're Winning
Enumeration Completeness Checklist
Current user context fully understood
System architecture and patch level identified
All running services and their configs enumerated
File permission weaknesses mapped
Network services and configurations discovered
Multiple potential attack vectors identified
Escalation Success Indicators
Administrative/root access achieved
New privileges verified and tested
Method documented for reproducibility
System stability maintained
Operational security preserved
The Bottom Line
Privilege escalation is like solving a puzzle where the pieces are scattered across the entire system. Some pieces are obvious (like that SUID binary sitting there begging to be exploited), while others require connecting multiple small findings into a bigger picture.
The key to success isn't memorizing every possible technique - it's developing a systematic methodology that helps you find the puzzle pieces and understand how they fit together. Whether you're dealing with a Windows domain controller or a Linux web server, the fundamental approach remains the same: enumerate thoroughly, analyze carefully, and exploit precisely.
Remember: Every system has weaknesses. Your job is to find them before the defenders do. And if you can't find any? Well, that just means you haven't enumerated hard enough yet.
Last updated
Was this helpful?