Privilege Escalation

Privilege Escalation is the process of obtaining higher permissions than those originally assigned to a user or process. It is one of the most important phases of penetration testing and post-exploitation because it allows an attacker to gain administrative or root-level access, access sensitive information, execute privileged operations, and maintain persistence.

Privilege escalation can occur on both Linux and Windows systems through kernel vulnerabilities, insecure permissions, service misconfigurations, weak credentials, scheduled tasks, registry weaknesses, and many other attack vectors.

What You Will Learn

This learning path covers:

• Linux Privilege Escalation
• Windows Privilege Escalation
• Enumeration techniques
• Password mining
• Sudo and service exploitation
• Registry abuse
• Kernel exploitation
• Token impersonation
• Scheduled task abuse
• DLL hijacking
• Common privilege escalation tools
• Defensive best practices

Types of Privilege Escalation

Vertical Privilege Escalation

Vertical privilege escalation occurs when a user gains a higher level of permissions than originally assigned.

Example

• Standard Linux user → Root
• Standard Windows user → Administrator

Horizontal Privilege Escalation

Horizontal privilege escalation occurs when a user accesses another user’s resources without increasing privilege levels.

Example

• User A accesses User B’s files.
• One employee accesses another employee’s confidential data.

Learning Modules

Linux Privilege Escalation

Learn enumeration, misconfigurations, credential discovery, kernel exploitation, SUID abuse, sudo attacks, and more.

Core Topics

• Linux Privilege Escalation
• Enumeration & Analysis Tools (LinPEAS, LinEnum)
• Applications & Services Enumeration
• System & Kernel Enumeration
• User Enumeration
• Network Enumeration
• Recently Modified Files
• Linux Capabilities
• Dirty COW Kernel Exploitation
• MySQL UDF Exploitation
• NFS Root Squashing
• pspy Process Monitoring

Cron Jobs & Systemd Timers

Learn how scheduled tasks can lead to privilege escalation.

Topics include:

• Cron Job Abuse
• File Overwrite
• PATH Hijacking
• Wildcard Injection
• Cron Log Analysis
• pspy Monitoring
• Systemd Timer Exploitation

Password Mining (Linux)

Discover common locations where credentials are stored.

Topics include:

• Configuration Files
• Shell History
• System Logs
• Backup Files
• Memory Secrets
• SSH Keys
• User Home Directories

Linux Permissions

Understand permission-based privilege escalation.

Topics include:

• Linux Permissions
• Access Control Lists (ACL)
• Critical File Permissions
• SUID & SGID Enumeration
• Special Permissions
• Shared Library Hijacking
• PATH Hijacking

Sudo Privilege Escalation

Learn common sudo misconfigurations.

Topics include:

• Sudo Enumeration
• LD_PRELOAD Exploitation
• Root Shell via Sudo
• Custom Binary Abuse

Windows Privilege Escalation

Master Windows privilege escalation through services, registry abuse, kernel exploits, credentials, and token impersonation.

Core Topics

• Windows Privilege Escalation
• Privilege Escalation Tools
• Windows Version Enumeration
• User Enumeration
• Network Enumeration
• Escalation Walkthrough
• Windows Subsystem for Linux (WSL)
• RunAs Abuse
• WinRM Configuration
• Iperius Backup Exploitation
• Startup Applications
• Shutdown & Reboot Abuse
• Certificate Dialog Elevation

Impersonation & Potato Attacks

Learn Windows token abuse techniques.

Topics include:

• Token Impersonation
• Juicy Potato
• JuicyPotatoNG
• GodPotato
• Lab Setup

Registry Exploitation

Explore Windows Registry privilege escalation techniques.

Topics include:

• AlwaysInstallElevated
• Autorun Registry Keys
• UAC Bypass
• Service Registry Abuse

Services Exploitation

Learn to exploit insecure Windows services.

Topics include:

• Weak Service Permissions
• Writable Service Executables
• Unquoted Service Paths
• DLL Hijacking
• Registry Service Abuse
• Named Pipe Impersonation
• Service Start/Stop Permissions

Windows Kernel Exploits

Study well-known Windows kernel vulnerabilities.

Topics include:

• Windows Kernel Exploits
• HTB Kernel Labs
• MS10-015
• MS10-059
• MS14-058

Password Mining (Windows)

Learn where Windows stores credentials.

Topics include:

• SAM & SYSTEM Hives
• NTDS.dit
• Registry Credentials
• Alternate Data Streams
• PowerShell History
• Service Credentials
• Sticky Notes
• Unattended Install Files
• Stored Logon Credentials
• Web Configuration Files
• Wi-Fi Passwords
• Mounting VHD/VHDX
• File Content Searching
• FileZilla Credentials

General Resources

• Static Standalone Binaries
• Portable Enumeration Utilities

Common Privilege Escalation Techniques

Linux

• Kernel vulnerability exploitation
• SUID/SGID abuse
• Linux capabilities abuse
• Weak file permissions
• Misconfigured sudo rules
• PATH hijacking
• Shared library hijacking
• Cron job exploitation
• Password mining
• Service misconfigurations

Windows

• Kernel exploits
• Token impersonation
• DLL hijacking
• Registry abuse
• Service misconfigurations
• Scheduled task abuse
• Startup application hijacking
• Password extraction
• UAC bypass
• Named pipe impersonation

Popular Privilege Escalation Tools

Linux

Windows

Privilege Escalation Methodology

A typical privilege escalation workflow consists of:

1. Initial Access
   • Gain access as a low-privileged user.
2. Enumeration
   • Collect information about users, groups, services, permissions, scheduled tasks, kernel version, installed software, and network configuration.
3. Identify Weaknesses
   • Locate vulnerabilities or insecure configurations.
4. Exploitation
   • Exploit the identified weakness to obtain elevated privileges.
5. Post-Exploitation
   • Access sensitive resources, perform administrative actions, or continue security assessment.

Why Privilege Escalation Matters

Privilege escalation is a critical objective during penetration testing because it enables security professionals to evaluate the impact of a successful compromise.

It can lead to:

• Full administrative or root access
• Access to sensitive information
• Credential extraction
• Lateral movement
• Persistence
• Complete system takeover
• Network-wide compromise

Defensive Best Practices

Linux

• Apply security updates regularly.
• Use SELinux or AppArmor.
• Enforce the Principle of Least Privilege (PoLP).
• Review SUID and SGID binaries.
• Secure cron jobs and systemd timers.
• Restrict sudo permissions.
• Audit file permissions.
• Monitor system logs and authentication events.

Windows

• Enable User Account Control (UAC).
• Apply operating system and application patches.
• Secure Windows services.
• Remove unnecessary administrator privileges.
• Enable BitLocker and Credential Guard.
• Monitor PowerShell activity.
• Use Microsoft Defender or enterprise endpoint protection.
• Audit registry and scheduled task modifications.

Prerequisites

To get the most from this learning path, you should have:

• Basic Linux administration knowledge
• Basic Windows administration knowledge
• Familiarity with the command line (Bash and PowerShell)
• Understanding of networking fundamentals
• Basic penetration testing methodology
• Experience with virtual labs such as Kali Linux, Windows, or Hack The Box

Who Should Take This Course?

This learning path is suitable for:

• Penetration Testers
• Red Team Operators
• Security Researchers
• SOC Analysts
• System Administrators
• Cybersecurity Students
• Ethical Hackers
• Bug Bounty Hunters
• Anyone preparing for practical security certifications such as PNPT, OSCP, CRTO, CRTP, CPTS, or eCPPT.

Conclusion

Privilege escalation is a fundamental skill in offensive security. Mastering Linux and Windows privilege escalation techniques enables security professionals to identify insecure configurations, validate the real-world impact of vulnerabilities, and strengthen system defenses. This learning path provides comprehensive coverage of modern privilege escalation techniques, practical tools, exploitation methods, and defensive strategies to build a solid foundation in post-exploitation and system security.