What is Privilege Escalation?

Privilege escalation exploits vulnerabilities or misconfigurations to gain higher-level permissions than originally authorized, enabling attackers to access restricted resources.

What is privilege escalation?

Privilege escalation is the exploitation of vulnerabilities, design flaws, or misconfigurations to obtain elevated access beyond what was initially granted. Vertical escalation gains higher privilege levels such as user to administrator. Horizontal escalation accesses resources of other users at the same privilege level. Both types enable attackers to expand their control and access sensitive data or critical system functions.

What are common Linux privilege escalation techniques?

Common Linux techniques include exploiting SUID/SGID binaries with elevated permissions, abusing sudo misconfigurations allowing command execution as root, exploiting writable cron jobs or PATH manipulation, leveraging kernel vulnerabilities for root access, abusing capabilities assigned to binaries, exploiting NFS no_root_squash configurations, finding credentials in configuration files or history, and exploiting Docker group membership for container escape to host.

What are common Windows privilege escalation techniques?

Windows privilege escalation techniques include unquoted service paths allowing DLL hijacking, weak service permissions enabling binary replacement, always-install-elevated MSI exploitation, token impersonation through potato attacks, registry autorun abuse, scheduled task manipulation, exploiting missing patches for kernel exploits, abusing SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege, and leveraging misconfigured Group Policy preferences.

How do attackers escalate privileges in cloud environments?

Cloud privilege escalation exploits overly permissive IAM policies to modify own permissions, abuses role assumption chains to reach administrative roles, leverages instance metadata services to steal attached role credentials, exploits serverless function permissions for cross-service access, manipulates CI/CD pipelines with deployment permissions, and abuses resource-based policies that grant unintended cross-account access.

What tools detect privilege escalation attempts?

Detection tools include LinPEAS and WinPEAS for enumeration, Seatbelt for Windows security posture assessment, and BloodHound for Active Directory attack path analysis. Defensive tools include EDR platforms monitoring for known escalation techniques, SIEM rules correlating privilege changes, file integrity monitoring detecting unauthorized modifications to privileged binaries, and cloud security tools alerting on IAM policy modifications.

How can organizations prevent privilege escalation?

Prevention requires applying security patches promptly to eliminate kernel and application exploits, following least privilege principles for user and service accounts, auditing SUID binaries and sudo configurations regularly, implementing application allowlisting, hardening service configurations and permissions, deploying endpoint detection monitoring for escalation indicators, and conducting regular privilege audits across operating systems and cloud environments.

What is token manipulation in privilege escalation?

Token manipulation exploits Windows security tokens to impersonate higher-privileged users. Techniques include token stealing from processes running as privileged users, creating duplicate tokens from existing sessions, and leveraging SeImpersonatePrivilege through potato family exploits to negotiate NTLM authentication and impersonate the SYSTEM account. These attacks are commonly used after initial access to achieve administrative control.

How does privilege escalation factor into penetration testing?

Privilege escalation is a critical penetration testing phase occurring after initial access. Testers systematically enumerate the target system for escalation vectors using automated tools and manual analysis. Successful escalation validates that defense-in-depth controls are insufficient and demonstrates the potential impact of an initial compromise. Findings drive hardening recommendations for system configurations, patch management, and access controls.