Privilege Escalation Detection
Detection Workflow
- Identify privileged operations: Find setuid/setgid binaries, locate privilege checks, identify file operations with elevated privileges, map privilege boundaries
- Analyze permission model: Understand intended permission model, identify all privilege boundaries, map privilege escalation paths, assess access control mechanisms
- Check validation: Verify permission checks are correct, look for race conditions, assess validation completeness, identify TOCTOU issues
- Assess exploitability: Can attacker bypass checks? Is there a usable escalation path? What's the impact of successful escalation?
Key Patterns
- Setuid/setgid binaries: binaries with setuid/setgid bits set, unsafe operations in privileged binaries, environment variable usage, path traversal vulnerabilities
- Insecure permission checks: race conditions in permission checks, missing privilege validation, TOCTOU in file operations, weak access control implementations
- Environment-based escalation: environment variable manipulation, LD_PRELOAD/DT_RPATH abuse, PATH manipulation, IFS exploitation
- Resource manipulation: symlink attacks, hard link manipulation, file descriptor manipulation, /proc filesystem abuse
Output Format
Report with: id, type, subtype, severity, confidence, location, binary_info (path, setuid, setgid, owner), vulnerability, attack_path, exploitable, impact, mitigation.
Severity Guidelines
- CRITICAL: Direct path to root/admin access
- HIGH: Escalation to lower privileged user
- MEDIUM: Limited privilege escalation
- LOW: Information disclosure about privileges
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
1---2name: detecting-privilege-escalation3description: Detects privilege escalation vulnerabilities including setuid/setgid abuse, permission check bypasses, and unsafe privilege management. Use when analyzing setuid binaries, permission checks, or investigating privilege escalation paths.4---5
6# Privilege Escalation Detection
7
8## Detection Workflow
9
101. **Identify privileged operations**: Find setuid/setgid binaries, locate privilege checks, identify file operations with elevated privileges, map privilege boundaries
112. **Analyze permission model**: Understand intended permission model, identify all privilege boundaries, map privilege escalation paths, assess access control mechanisms
123. **Check validation**: Verify permission checks are correct, look for race conditions, assess validation completeness, identify TOCTOU issues
134. **Assess exploitability**: Can attacker bypass checks? Is there a usable escalation path? What's the impact of successful escalation?
14
15## Key Patterns
16
17- Setuid/setgid binaries: binaries with setuid/setgid bits set, unsafe operations in privileged binaries, environment variable usage, path traversal vulnerabilities
18- Insecure permission checks: race conditions in permission checks, missing privilege validation, TOCTOU in file operations, weak access control implementations
19- Environment-based escalation: environment variable manipulation, LD_PRELOAD/DT_RPATH abuse, PATH manipulation, IFS exploitation
20- Resource manipulation: symlink attacks, hard link manipulation, file descriptor manipulation, /proc filesystem abuse
21
22## Output Format
23
24Report with: id, type, subtype, severity, confidence, location, binary_info (path, setuid, setgid, owner), vulnerability, attack_path, exploitable, impact, mitigation.
25
26## Severity Guidelines
27
28- **CRITICAL**: Direct path to root/admin access
29- **HIGH**: Escalation to lower privileged user
30- **MEDIUM**: Limited privilege escalation
31- **LOW**: Information disclosure about privileges
32
33## See Also
34
35- `patterns.md` - Detailed detection patterns and exploitation scenarios
36- `examples.md` - Example analysis cases and code samples
37- `references.md` - CWE references and mitigation strategies
aibot88