Home > Network Pentesting

Privilege Escalation Paths

Privilege escalation paths allow attackers to move from low-privilege access to full administrator or root control over networked systems. Once initial access is gained, privilege escalation becomes the next major objective. It enables deeper lateral movement, credential extraction, persistence installation, and domain compromise. Understanding escalation paths—both Windows and Linux—is essential for effective post-exploitation.

Understanding Privilege Escalation

Privilege escalation happens in two forms:

  • Vertical Escalation: Low-privileged user → Admin/Root

  • Horizontal Escalation: Move between users at similar privilege levels

Escalation depends on misconfigurations, weak permissions, insecure services, credential reuse, and system vulnerabilities.

Windows Privilege Escalation Paths

Windows systems offer numerous escalation vectors due to their dependency on services, ACLs, registry, scheduled tasks, and domain structures.

1. Credential-Based Escalation

Most Windows privilege escalation begins with credentials.

Local Administrator Reuse

Check if captured user credentials work as local admin on other systems:

crackmapexec smb 10.10.20.0/24 -u user -p pass

Saved Credentials

Check for saved creds:

cmdkey /list

If RDP or admin creds are saved, they can be reused.

2. Vulnerable Services (Unquoted Paths and Weak Permissions)

Inspect service configurations:

wmic service get name,displayname,pathname,startmode

Look for:

  • Unquoted service paths

  • Writable service directories

  • Modifiable binaries

Exploit by placing a malicious binary in the writable path.

3. Privilege Escalation via DLL Hijacking

Identify services loading DLLs from writable directories:

procmon.exe

If you can drop a DLL where a service loads from, the service executes your payload as SYSTEM.

4. Scheduled Tasks (Weak Permissions)

List scheduled tasks:

schtasks /query /fo LIST /v

If the task executable or directory is writable, replace the binary.

5. Insecure Registry Permissions

Check registry key permissions:

accesschk.exe -qwuvc HKLM\

Writable autorun keys enable escalation.

6. Token Impersonation

Use Mimikatz or Meterpreter to list privileged tokens:

token::list

Impersonate tokens:

token::elevate

This grants SYSTEM-level access if privileged tokens exist.

7. UAC Bypass (If User Is Admin But Elevated Prompt Required)

Use known bypass techniques:

fodhelper.exe
eventvwr.exe
computerdefaults.exe

These allow execution without UAC prompts.

8. Exploiting Kernel or Driver Vulnerabilities

Use tools like:

windows-exploit-suggester.py

Kernel vulns (e.g., CVE-2021-36934) provide SYSTEM privileges.

9. Domain Privilege Escalation

If inside Active Directory:

  • Kerberoasting

  • AS-REP Roasting

  • Pass-the-Hash

  • Pass-the-Ticket

  • Delegation abuse

  • Vulnerable GPOs

  • Privileged group membership escalation

Example: Kerberoasting

GetUserSPNs.py domain/user:pass -dc-ip 10.10.10.5 -request

Linux Privilege Escalation Paths

Linux privilege escalation often stems from misconfigurations, writable files, weak sudoers, or credential exposure.

1. Sudo Privileges

Identify sudo permissions:

sudo -l

Common misconfigurations allow root escalation through:

  • Python

  • Vim

  • Nano

  • find

  • tar

  • rsync

  • less/more

Example:

sudo python -c 'import os; os.system("/bin/bash")'

2. SUID Binary Exploits

List SUID binaries:

find / -perm -4000 2>/dev/null

Misconfigured binaries can be abused for root.

3. Writable System Files

Writable scripts or configs running as root provide escalation.

Check writable files:

find / -writable -type f 2>/dev/null

Replace a root-run script to gain elevated access.

4. Cron Job Abuse

List cron jobs:

cat /etc/crontab

If the cron script is writable:

  • Replace contents

  • Gain root at next cron interval

5. Exposed Credentials

Search filesystem for credentials:

grep -Ri "password" /home /var/www /etc

Configuration files often leak database or SSH passwords.

6. Kernel Exploits

When kernel is outdated, escalate via:

uname -a

Exploit with tools like Dirty COW or other CVEs.

7. SSH Key Abuse

Harvest SSH keys:

cat ~/.ssh/id_rsa

Use keys to switch users or escalate through shared access.

8. Docker or LXC Privilege Escalation

If the user is part of docker group:

docker run -v /:/host -it ubuntu chroot /host /bin/bash

This provides root immediately.

9. NFS Root Squashing

If NFS shares are misconfigured:

  • Mount share

  • Create file as root

  • Gain root on target

Check exports:

showmount -e target

Combined Paths for Lateral Movement

Privilege escalation is usually tied to lateral movement:

  • Obtain credentials → reuse across network

  • Dump LSASS → extract domain creds

  • Steal tickets → pivot to servers

  • Escalate on key hosts → dump more creds

Each escalation step expands access across the entire network.

Why Privilege Escalation Paths Matter

Privilege escalation enables attackers to:

  • Gain full control of systems

  • Access and extract sensitive data

  • Install persistent access

  • Execute high-impact post-exploitation

  • Compromise domain controllers

  • Move laterally across segments

Privilege escalation transforms limited access into complete network dominance.

Intel Dump

  • Windows escalation: vulnerable services, tokens, UAC bypass, credentials, Kerberoasting

  • Linux escalation: sudo misconfigs, SUID binaries, cron jobs, writable files, Docker, kernel exploits

  • Escalation feeds lateral movement and domain compromise

  • Credentials and misconfigurations remain the most common paths

HOME LEARN COMMUNITY DASHBOARD