Privilege Escalation

Privilege escalation is how an attacker who already has a foothold gains more rights: from a normal user to administrator or root (vertical), or into another user’s account (horizontal).

Common paths on Linux

• Misconfigured sudo rules that allow running shells or editors as root.
• Unneeded SUID binaries and writable scripts run by root via cron or systemd.
• Unpatched kernel or setuid vulnerabilities.
• Credentials left in shell history, config files or environment variables.

Common paths on Windows

• Services with weak permissions or unquoted paths.
• Reused local administrator passwords across machines.
• Token impersonation from service accounts.
• Unpatched local privilege escalation vulnerabilities.

Defence

• Patch promptly, especially vulnerabilities listed as known exploited.
• Apply least privilege; audit sudoers, SUID files and service permissions.
• Randomise local admin passwords (for example with Windows LAPS).
• Alert on new admin group membership and unusual process parents.