Privilege Escalation

Why It Matters

Initial access rarely lands attackers where they need to be. A phishing victim's machine seldom holds the data or capabilities adversaries seek, so they pivot through privilege escalation to reach administrative control, sensitive systems, or domain-wide compromise. Understanding escalation paths is fundamental for red teamers, pentesters, and SOC analysts building detections.

The 2020 SolarWinds breach pivoted from initial supply chain compromise to forged SAML tokens granting effective Global Admin access. The 2014 Sony Pictures attack used credential theft and Active Directory abuse to move from a single endpoint to enterprise-wide control.

Types of Privilege Escalation

Vertical (Up)

Gaining higher privileges within the same account context:

• Standard user → Local Admin
• Local Admin → SYSTEM/root
• Domain User → Domain Admin
• Cloud user → Cloud Admin/root

Horizontal (Across)

Moving between accounts at the same trust level:

• User A's mailbox → User B's mailbox
• One tenant's data → Another tenant's data (multi-tenant SaaS)
• One workload → Another workload in the same cluster

Linux Techniques

# Quick wins to check
sudo -l                          # Sudo permissions for current user
find / -perm -4000 2>/dev/null   # SUID binaries
find / -writable -type d 2>/dev/null  # Writable directories
cat /etc/crontab                 # Cron jobs
getcap -r / 2>/dev/null          # File capabilities
echo $PATH                       # PATH hijacking opportunities
uname -a                         # Kernel version for exploits

Common Linux escalation paths:

• SUID misuse: Binaries listed in GTFOBins that escalate when SUID is set
• Sudo misconfigurations: NOPASSWD on dangerous commands like vim, find, awk
• Kernel exploits: Dirty Pipe (CVE-2022-0847), OverlayFS, Sequoia
• Writable cron jobs: Replacing scripts run by root
• Container escapes: Privileged containers, Docker socket mounts, capabilities

Windows Techniques

Cloud Privilege Escalation

In cloud environments, escalation often follows different paths:

• IAM role chaining (iam:PassRole, sts:AssumeRole abuse)
• Lambda/function execution role takeover
• Excessive permissions on identity providers
• Misconfigured federation trust
• Compromised CI/CD with overly permissive deploy roles

Detection and Prevention

Defensive priorities:

1. Apply least privilege rigorously and review entitlements regularly.
2. Patch kernels and OS promptly, especially CISA KEV listed CVEs.
3. Use Local Admin Password Solution (LAPS) to prevent lateral admin reuse.
4. Monitor with EDR and Sysmon focused on escalation TTPs.
5. Implement Tier 0 isolation for identity infrastructure.
6. Run BloodHound to identify and prune AD attack paths.
7. Limit cloud blast radius with permission boundaries and SCPs.

Related Concepts

• Exploit
• Identity and Access Management
• Threat Hunting
• Penetration Tester