Privilege Escalation

Skill: Privilege Escalation

Supplementary Files:

• payloads.md — Complete command reference organized by escalation vector: automated enumeration, SUID/GTFOBins exploitation, sudo abuse, capabilities, kernel exploits, Windows token impersonation, service path hijacking, DLL hijacking, and UAC bypass
• test-cases.md — Structured test case templates (TC-PE-001 to TC-PE-008) covering Linux and Windows privilege escalation scenarios with severity ratings and expected results

Summary

Privilege Escalation skill domain covering post exploitation operations.

Tools: linpeas, winpeas, linux-exploit-suggester, pspy, GTFOBins, lolbas, sudo, capsh

Domain: post-exploitation

MITRE ATT&CK: TA0004-Privilege Escalation

Description

Privilege escalation is the process of elevating access from a low-privileged user context (standard user, service account, or limited shell) to root on Linux or SYSTEM/Administrator on Windows. It is the critical bridge between initial foothold and full system control, determining the depth and impact of a penetration test or red team engagement.

This skill covers the complete escalation workflow: automated enumeration with linpeas/winpeas, manual verification of misconfigurations, exploitation of SUID binaries via GTFOBins, sudo rule abuse, Linux capabilities exploitation, cron job hijacking, kernel exploit identification and safe execution, and Windows-specific vectors including token impersonation, unquoted service paths, DLL hijacking, AlwaysInstallElevated, and UAC bypass techniques.

Core objective: systematically identify and exploit every viable escalation path from the current user context to the highest privilege level on the target system.

Prerequisites

Before executing privilege escalation, ensure the following conditions are met:

1. Established foothold — A low-privilege shell or session on the target system (Linux or Windows)
2. Authorization — Written permission explicitly covering privilege escalation activities and credential harvesting
3. Session stability — A reliable connection (reverse shell, SSH session, or RDP) with reasonable persistence
4. Tool transfer capability — Ability to upload enumeration scripts and exploitation tools to the target
5. Operational awareness — Understanding of the target environment (production vs. test, criticality level, allowed impact)

Use Cases

1. Low-privilege shell on Linux — Escalate from a www-data or standard user shell to root via SUID binaries, sudo misconfigurations, cron abuse, or kernel exploits
2. Low-privilege shell on Windows — Escalate from a standard user to SYSTEM or Administrator via token impersonation, service misconfigurations, or UAC bypass
3. Container escape context — Identify capabilities, SUID binaries, or host-mounted filesystems that enable breakout from a container to the host
4. Domain environment escalation — Leverage local privilege escalation as a stepping stone to domain-level compromise through credential harvesting and lateral movement
5. Red team assessment depth — Demonstrate the full impact of an initial compromise by reaching the highest privilege level, proving that the foothold leads to complete system control

Variants

Core Tools

Methodology

Attack Chain

Enumeration                    Identification                 Exploitation
(linpeas, winpeas,           (sudo -l, SUID find,           (GTFOBins, kernel exploit,
 manual checks)               getcap, pspy)                  token impersonation)
      |                              |                              |
      v                              v                              v
                           Escalation                    Persistence & Documentation
                           (root/SYSTEM shell)           (document path, clean artifacts)

Phase details:

1. Enumerate — Run linpeas (Linux) or winpeas (Windows) for automated enumeration. Collect system information: kernel version, OS release, running processes, installed packages, network configuration, and user context. This phase casts the widest possible net to identify all potential escalation vectors.

2. Identify — Manually verify and prioritize the enumeration findings. Check sudo permissions (sudo -l), locate SUID binaries (find / -perm -4000), enumerate capabilities (getcap -r /), inspect cron jobs (/etc/crontab, crontab -l), and review running services. On Windows, examine token privileges (whoami /priv), service configurations, registry keys, and UAC settings. Prioritize vectors by reliability and impact.

3. Exploit — Apply the appropriate exploitation technique for the identified vector. Use GTFOBins for SUID/sudo binary exploitation, linux-exploit-suggester output for kernel-level attacks, token impersonation for Windows privilege abuse, or lolbas techniques for living-off-the-land escalation. Execute with caution, especially for kernel exploits which can destabilize the target.

4. Escalate — Achieve root (Linux) or SYSTEM/Administrator (Windows) access through the exploited vector. Verify the escalation with id or whoami commands. Harvest credentials from the elevated context for further lateral movement if within scope.

5. Persist — Document the complete escalation path including every command executed, every file modified, and every vulnerability exploited. Record the before/after privilege context. Clean up any artifacts (uploaded tools, temporary files) unless persistence testing is explicitly authorized.

Defense Perspective

Practical Steps

Linux Escalation Workflow

1. Run linpeas.sh -a for automated enumeration
2. Check sudo -l for misconfigured rules
3. Run find / -perm -4000 -type f 2>/dev/null for SUID binaries
4. Run getcap -r / 2>/dev/null for capabilities
5. Inspect /etc/crontab and crontab -l for cron abuse
6. Check cat /proc/version; uname -r for kernel exploits
7. Run linux-exploit-suggester.sh to map kernel CVEs
8. Verify with pspy64 for hidden scheduled processes
9. Exploit highest-reliability vector first
10. Confirm with id showing uid=0(root)

Windows Escalation Workflow

1. Run winPEAS.exe quiet cmd fast for automated enumeration
2. Check whoami /priv for exploitable token privileges
3. Run systeminfo for OS version and patch level
4. Check net user; net localgroup administrators for user context
5. Inspect sc qc <service> for unquoted service paths
6. Check registry for AlwaysInstallElevated and stored credentials
7. Run accesschk.exe for writable service directories
8. Exploit token impersonation if SeImpersonatePrivilege present
9. Attempt UAC bypass if standard user can auto-elevate
10. Confirm with whoami showing SYSTEM or Administrator

Key Decisions

• Kernel exploit as last resort: Kernel exploits carry the highest risk of system instability or crash. Always attempt misconfiguration-based escalation (SUID, sudo, cron, services) before kernel exploits. If a kernel exploit is necessary, verify the target kernel version precisely and test in an identical environment first when possible.
• Enumeration depth vs. stealth: Automated tools like linpeas and winpeas are thorough but noisy. In stealth-sensitive engagements, use manual enumeration commands selectively. In standard penetration tests, run automated tools for comprehensive coverage and document all findings.
• Living-off-the-land vs. uploaded tools: Prefer GTFOBins/lolbas techniques using existing system binaries over uploading custom exploits. System binaries are less likely to trigger antivirus or EDR alerts, and they leave fewer artifacts on disk.

Quality Criteria

• Every escalation path must be documented with step-by-step reproduction instructions
• Before and after privilege levels must be captured (screenshots of id / whoami output)
• All attempted vectors must be reported, including failed attempts — they reveal defense effectiveness
• Kernel exploit usage must include justification for why safer alternatives were insufficient
• Cleanup of all uploaded tools and temporary modifications must be verified before disconnection
• All findings must be mapped to MITRE ATT&CK technique IDs for standardized reporting

Escalation Priority Matrix

Rule: Never attempt a kernel exploit until all misconfiguration vectors have been exhausted and documented.

Common Pitfalls

• Running linpeas/winpeas without reviewing output context: These tools produce hundreds of lines of output flagged with color codes. Blindly following the first highlighted finding without understanding the system context can waste time on false positives. Cross-reference tool findings with manual verification before attempting exploitation.
• Attempting kernel exploits without version verification: A single kernel version digit difference can mean the exploit will crash the target instead of elevating privileges. Always verify the exact kernel version with uname -r and cross-reference with the exploit's supported range.
• Ignoring operational security during escalation: Running privilege escalation tools modifies filesystem timestamps, creates log entries, and may trigger EDR alerts. Maintain a modification log and plan cleanup before executing escalation commands.

Anti-Patterns

• Skipping enumeration: Jumping straight to exploitation without thorough enumeration leads to missed vectors and wasted time. Always complete the full enumeration phase before attempting any exploit.
• Running linpeas as root: Running automated enumeration tools with elevated privileges defeats the purpose of identifying escalation vectors from the current user context.
• Ignoring failed exploits: Failed exploitation attempts provide valuable intelligence about defensive controls. Document every attempt with the exact error or behavior observed.
• Kernel exploit on production: Kernel exploits can cause system panics and reboots. Obtain explicit written authorization and schedule during maintenance windows for production targets.
• Neglecting cleanup: Leaving enumeration scripts, modified SUID binaries, or temporary cron entries on the target creates evidence and potential instability.

Reporting and Documentation

Privilege escalation reports must include: the initial user context and privilege level, the enumeration methodology (automated + manual), every escalation vector identified, the vector successfully exploited, step-by-step reproduction commands, proof of escalation (screenshots), and recommended remediation for each identified vector. Map all techniques to MITRE ATT&CK technique IDs (e.g., T1548.001 — Abuse Elevation Control Mechanism: Setuid and Setgid). Document the risk rating for each finding based on exploitability and impact.

Troubleshooting

Legal and Ethical Considerations

Privilege escalation explicitly accesses resources and data beyond the initial compromise scope. The engagement letter must specifically authorize privilege escalation activities. Kernel exploits carry denial-of-service risk; obtain explicit approval before attempting kernel-level attacks on production systems. Credential harvesting during escalation (e.g., /etc/shadow, SAM database) must be reported and handled according to the engagement's data handling requirements.

Integration with Other Skills

Privilege escalation receives initial access from skills/network-pentest/, skills/web-xss/, skills/web-sqli/, and skills/web-auth-bypass/. Successful escalation feeds into skills/post-exploitation/ for persistence and lateral movement. Credential material harvested during escalation (hashes, SSH keys, tokens) feeds into skills/password-attack/ for cracking. Container escape findings relate to skills/container-security/. Active Directory escalation connects to skills/api-security/ for domain-level attack paths.

Detection Methods

Privilege escalation detection combines endpoint telemetry (EDR), system audit logs, and behavioral baselines. Understanding detection signals helps testers operate more stealthily and helps defenders prioritize monitoring.

Linux Host Indicators

• SUID binary execution: Unusual SUID binaries executed (find / -perm -4000 -type f 2>/dev/null); known privesc tools like linpeas, pspy, linux-smart-enumeration.
• sudo abuse: sudo -l enumeration; sudo rules with NOPASSWD or wildcard commands; sudo invocations outside user's typical pattern.
• Cron job tampering: Modifications to /etc/crontab, /etc/cron.d/*, or user crontabs; root-owned cron entries executing scripts in writable directories.
• Kernel exploit signatures: dirtycow / dirtypipe / DirtyPipe / OverlayFS patterns in process name or memory.
• Capability misuse: Binaries with cap_setuid, cap_dac_override, cap_sys_admin capabilities; setcap invocations.

Windows Host Indicators

• Token impersonation: ImpersonateNamedPipeClient API calls; duplicate token handle operations; whoami /priv queries listing SeImpersonatePrivilege.
• UAC bypass: COM interface hijacking patterns; eventvwr.exe / fodhelper.exe / computerdefaults.exe executed by non-admin users.
• Service exploitation: Service binary path with unquoted spaces; weak service permissions modified by non-admin (accesschk.exe enumeration); sc config modifications.
• LSASS access: Non-system processes accessing LSASS memory; procdump -ma lsass.exe; comsvcs.dll MiniDump calls.
• SAM/NTDS dumping: reg save HKLM\SAM; volume shadow copy of ntds.dit; ntdsutil invocation.

Container-Specific Indicators

• Container escape attempts: Access to /proc/1/root, cgroup manipulation, mount of host filesystem, CAP_SYS_ADMIN capability usage.
• Privileged container abuse: kubectl exec --privileged; docker run --privileged; containers running as --pid=host or --network=host.
• kubelet API access: Requests to https://node:10250/pods; anonymous auth attempts on kubelet.

SIEM Detection Rules

• Sysmon Event ID 1: Process creation; alert on whoami /priv, systeminfo, accesschk.exe, winPEAS.exe.
• Sysmon Event ID 10: Process access; alert on TargetImage: lsass.exe.
• Sysmon Event ID 13: Registry value set; alert on HKLM\\SYSTEM\\CurrentControlSet\\Services\\.*\\ImagePath modifications.
• Auditd rules: acl,/etc/sudoers modification; perm_su events; SUID binary creation.
• Splunk SPL: index=linux sourcetype=auditd type=EXECVE | stats count by a0 | where a0 IN ("linpeas","pspy","unix-privesc-check")

Defense Evasion Techniques

Stealth Enumeration

• Slow scanning: Space enumeration across hours; cache results to avoid repeated find calls.
• LOLBins over custom tools: Use getent, id, groups, ls -la /etc/sudoers instead of dropping linpeas.
• Native binary renaming: Copy find to ~/.local/bin/.cache to avoid process-name detection.
• PowerShell without AMSI: Patch amsi.dll in-memory before enumeration; use pwsh CoreCLR bypass.
• In-memory enumeration: Use Reflective PE loading or .NET Interactive to run tools without disk artifacts.

Service Exploitation Stealth

• Service binary obfuscation: Encode service binary with custom encoder to evade AV signatures.
• DLL hijacking over custom binary: Use legitimate signed binary + malicious DLL sidecar (less suspicious than dropping .exe).
• WMI over PsExec: Use WMI subscription (__EventFilter + CommandLineEventConsumer) instead of PsExec to avoid PSEXESVC.exe service creation event.
• DCOM over RPC: Use DCOM (MMC20.Application) for lateral movement to avoid standard RPC patterns.

Token Impersonation Stealth

• Stolen token over delegation: Use stolen token to access services instead of creating new logon events.
• Process injection into legit process: Inject into explorer.exe or svchost.exe to inherit legitimate token.
• Avoid whoami /priv: Use OpenProcessToken + GetTokenInformation API directly to avoid SIEM-detected whoami invocation.

Kernel Exploit Stealth

• Target isolated hosts: Run kernel exploits on isolated hosts to avoid panic-induced reboots visible to monitoring.
• Match kernel version precisely: Avoid partial-match exploitation (crashes); use uname -r exact match.
• Memory-only exploits: Prefer in-memory kernel exploits (no /tmp/exploit artifacts).
• Use known-good variants: DirtyPipe (CVE-2022-0847) over DirtyCOW (CVE-2016-5195) — newer, less signatured.

Log Manipulation

• Selective clearing: Delete only specific audit logs (/var/log/audit/audit.log lines for our session) instead of full file.
• Time-stomping: Modify file timestamps with timestomp (Meterpreter) to match legitimate binaries.
• Auditd rule abuse: Pause auditd rules via auditctl -e 0 if root; restore after operations.
• Hide processes: Use rootkit-style LD_PRELOAD hook to hide our processes from ps.

Container Escape Stealth

• Sidecar injection over new container: Inject into existing pod rather than spawning new container (visible to kubectl get pods).
• Bypass via mounted Docker socket: Use /var/run/docker.sock mount to spawn sibling container (less visible than escape).
• kubelet over API server: Use kubelet API on worker node (10250) to escape API server monitoring.
• eBPF bypass: Some kernel exploits don't trigger eBPF-based Falco rules (e.g., CVE-2022-0185 before Falco rule update).

Learning Resources

• Skill supplementary files: payloads.md, test-cases.md
• Skill guides: guides/linux-privilege-escalation-enumeration-guide.md, guides/windows-privilege-escalation-attack-guide.md, guides/kernel-exploit-safety-guide.md
• Related Skills: skills/post-exploitation/SKILL.md, skills/container-security/SKILL.md, skills/password-attack/SKILL.md
• External Resources:
  • GTFOBins — https://gtfobins.github.io (Unix binary exploitation reference)
  • LOLBAS — https://lolbas-project.github.io (Windows living-off-the-land reference)
  • HackTricks Privilege Escalation — https://book.hacktricks.wiki (comprehensive privesc techniques)
  • PayloadsAllTheThings — https://github.com/swisskyrepo/PayloadsAllTheThings (escalation payload collection)
  • MITRE ATT&CK Privilege Escalation — https://attack.mitre.org/tactics/TA0004/ (technique taxonomy)

All privilege escalation techniques must be executed only within written authorization scope. Unauthorized system access is illegal.

Last updated: 2026-06-04