| name | LPE Detection |
| description | Local Privilege Escalation vulnerability detection — identify kernel exploits, service abuse, SUID/GUID, path hijacking, and cron job vulnerabilities |
| tags | ["lpe","privilege-escalation","kernel","service","security","local-exploit"] |
Task: Local Privilege Escalation (LPE) Vulnerability Detection. You identify and analyze vulnerabilities that allow elevation from user to administrator/root privileges.
Approach
Systematic LPE vulnerability hunting. Identify privilege escalation vectors through service misconfiguration, kernel vulnerabilities, permission issues, and insecure file operations.
Phase 1: Kernel Vulnerability Detection
Kernel Driver Analysis
- Search for: IOCTL handlers, device drivers, kernel modules
- Pattern:
IRP_MJ_DEVICE_CONTROL, DispatchDeviceControl
- Check: Arbitrary read/write primitives in kernel
- Look for: Signed/unsigned driver checks, input validation
Common Kernel LPE Vectors
Windows Kernel LPE:
- IOCTL handler vulnerabilities
- Arbitrary memory read/write
- Token manipulation (steal SYSTEM token)
- Pool overflow in kernel
- Stack overflow in kernel handlers
- Registry key manipulation in kernel context
Linux Kernel LPE:
- Dirty Cow (CVE-2016-5195): Race condition in copy-on-write
- Dirty Pipe (CVE-2022-0847): Pipe buffer overflow
- eBPF abuse (CVE-2018-17182): Arbitrary read/write
- Netfilter abuse (CVE-2021-3763): Bypass SELinux
- Module loading: Load malicious kernel module
Detection Steps
- Find kernel drivers and modules using
search_functions
- Analyze IOCTL handlers for weak validation
- Check for arbitrary memory operations
- Identify token manipulation functions
- Assess exploitability of kernel primitives
Phase 2: Service Privilege Escalation
Windows Service Enumeration
- Search for:
OpenSCManager, CreateService, StartService
- Pattern: Service operations without proper privilege checks
- Check: Service binary path permissions, configuration permissions
- Look for: Unquoted service paths, writable service configs
Windows Service Exploitation
Technique 1: Unquoted Service Path
Service: "C:\Program Files\MyApp\service.exe"
Windows searches:
1. C:\Program.exe (If exists → Execute as SYSTEM)
2. C:\Program Files\MyApp\service.exe
Technique 2: Writable Service Binary
1. Find service with writable binary (user can modify)
2. Replace binary with malicious payload
3. Start service → Execute as SYSTEM
Technique 3: Writable Service Configuration
1. Find service with changeable config
2. Modify binPath to malicious executable
3. Start service → Execute as SYSTEM
Technique 4: DLL Hijacking via Service
1. Service loads DLL from writable location
2. Place malicious DLL in search path
3. Start service → Load malicious DLL as SYSTEM
Linux Service Exploitation
systemd Service Abuse:
1. Find writable service files: /etc/systemd/system/
2. Modify ExecStart= to execute backdoor
3. Reload daemon: systemctl daemon-reload
4. Start service: systemctl start <service>
Init Script Abuse:
1. Find writable /etc/init.d/ scripts
2. Add backdoor to startup script
3. Reboot or trigger service restart
PATH Manipulation:
1. Service calls system() with relative path
2. Place malicious binary in writable PATH location
3. Trigger service execution
Detection Commands
Windows:
- sc query state= all
- sc qc <servicename> (query config)
- accesschk.exe -wsqc <servicename>
- wmic service get name,pathname,displayname,startmode
Linux:
- systemctl list-units --type=service
- service --status-all
- ls -la /etc/init.d/
- find /etc/systemd/system/ -perm -o+w
Phase 3: SUID/SGID Abuse
SUID/SGID Binary Analysis
- Search for:
setuid(), setgid(), seteuid(), chmod()
- Pattern: SUID binaries calling unsafe functions
- Check: Privilege dropping logic, input sanitization
- Look for: Absolute vs relative paths, environment variable usage
Common SUID Exploitation Vectors
Shell Escape:
- vim → :!/bin/sh
- less → !sh
- nmap → --interactive → !sh
- find → -exec /bin/sh \;
- awk → BEGIN {system("/bin/sh")}
Shared Library Injection:
1. SUID binary loads library (ldd <binary>)
2. LD_LIBRARY_PATH or rpath manipulation
3. Create malicious .so with __attribute__((constructor))
4. Execute SUID binary → Load library → Get shell
Environment Variable Injection:
- PATH manipulation: system("prog") uses user PATH
- IFS (Internal Field Separator): Split command arguments
- Various environment variables (TZ, etc.)
Symlink Race:
1. Find SUID that writes to file
2. Create symlink to privileged target
3. Win race between check and write
GTFOBins SUID Exploits
Known vulnerable SUID binaries:
- nmap (older versions): --interactive mode
- vim: :!command
- less: !command
- find: -exec command \;
- awk: system() function
- perl: exec() function
- python: os.system() function
- tcpdump: -z flag
- strace: executable parameter
Bypass techniques:
- Quote escaping: '"'"'
- Command chaining: ; && ||
- Variable substitution: ${IFS}
Detection Steps
- Find SUID/SGID files:
find / -perm -4000 -type f
- Analyze binaries with
strings, readelf, objdump
- Check for unsafe function calls
- Test library search paths (RPATH, RUNPATH)
- Verify environment variable usage
Phase 4: PATH/DLL Hijacking
Windows DLL Search Order
SafeDllSearchMode=1 (default):
1. Application directory
2. System32 directory
3. 16-bit system directory
4. Windows directory
5. Current working directory (CWD)
Hijacking opportunities:
1. Writable application directory
2. DLL missing from System32
3. Relative loading paths
4. CWD in privileged process
Linux Shared Library Loading
Search order:
1. LD_PRELOAD (if set)
2. RPATH/RUNPATH (embedded in binary)
3. LD_LIBRARY_PATH (if set)
4. /etc/ld.so.cache
5. /lib, /usr/lib, etc.
Hijacking opportunities:
1. Writable RPATH: $ORIGIN/../lib
2. Missing library in standard paths
3. dlopen() with relative path
4. Weak library validation
Detection and Enumeration
Windows:
- Process Monitor: Watch DLL loads from writable paths
- autoruns.exe: Check auto-start locations
- List vulnerable unquoted services
Linux:
- readelf -d <binary> | grep RPATH (check RPATH)
- ldd <binary> (show library dependencies)
- strace -e open,openat <binary> (watch library loads)
- strings <binary> | grep -E "(dlopen|LD_LIBRARY)"
Exploitation Techniques
Windows DLL Proxying:
1. Export all legitimate functions (forward to real DLL)
2. Add malicious code in DllMain
3. Place proxy DLL in app directory
4. Trigger application load
Linux LD_PRELOAD:
1. Create malicious .so with constructor function
2. Export LD_PRELOAD=/path/to/malicious.so
3. Run SUID binary → Load library → Execute as owner
Linux RPATH Abuse:
1. Binary has RPATH=$ORIGIN/../lib
2. Place malicious library in relative writable path
3. Execute binary → Load library
Phase 5: Cron Job/Task Scheduler Abuse
Linux Cron Job Analysis
- Search for:
/etc/cron, /var/spool/cron, crontab
- Pattern: Scripts executed by root with weak permissions
- Check: Writable cron scripts, wildcard usage
- Look for: PATH manipulation, symlink race conditions
Linux Cron Exploitation
Vulnerability 1: Writable Cron Script
1. Find script executed by root cron
2. Check permissions: ls -la /etc/cron.d/script.sh
3. If writable: Add backdoor
4. Wait for cron execution
Vulnerability 2: Wildcard Injection
Cron: * * * * * root tar -czf /backup/*.tar.gz /data
Exploit:
touch -- '-checkpoint=1'
touch -- '-checkpoint-action=exec=sh shell.sh'
Creates args: tar -czf /backup/-checkpoint=1.tar.gz ...
Vulnerability 3: PATH Manipulation
Cron: * * * * * root backup.sh
Place malicious backup.sh in writable PATH location
Vulnerability 4: Symlink Race
1. Find cron job that writes to predictable location
2. Create symlink to privileged target
3. Win race condition
Windows Task Scheduler
Enumeration:
- schtasks.exe /query /fo LIST /v
- Get-ScheduledTask (PowerShell)
- AccessChk: check task permissions
Exploitation:
1. Find writable task definitions
2. Modify task action to execute payload
3. Trigger task execution
4. Task runs as specified user (often SYSTEM)
Detection Commands
Linux:
- crontab -l (current user)
- ls -la /etc/cron* /var/spool/cron/
- cat /etc/crontab
- find /etc/cron* -type f -exec ls -la {} \;
Windows:
- schtasks /query /fo LIST /v
- Get-ScheduledTask -TaskPath \*
- powershell "Get-ScheduledTask | select *
Phase 6: Weak File Permission Exploitation
Permission Escalation Vectors
Writable /etc/passwd:
1. Add user with UID 0 (root)
2. Remove root password
3. Modify user UID to 0
Writable /etc/shadow:
1. Change root password hash
2. Add passwordless root access
3. Modify user privileges
Writable sudoers:
1. Add user to sudoers without password
2. Add ALL=(ALL) NOPASSWD: ALL
3. Modify sudo rules
Writable init scripts:
1. Add backdoor to startup sequence
2. Modify service startup
3. Trigger reboot or service restart
Linux Capabilities
Enumerate capabilities:
- getcap -r / 2>/dev/null
- capsh --print
Exploitable capabilities:
- CAP_SETUID: Can change UID (privesc)
- CAP_SETGID: Can change GID
- CAP_SYS_ADMIN: System administrator (root equivalent)
- CAP_NET_ADMIN: Network admin (packet manipulation)
- CAP_DAC_OVERRIDE: Bypass file read/write permissions
Example: Binary with CAP_SETUID
= Can execute setuid(0) to become root
Detection and Enumeration
Linux permission checks:
- ls -la /etc/passwd /etc/shadow /etc/sudoers
- find /etc/ -perm -o+w -type f
- find /var/ -perm -o+w -type f
- getcap -r / 2>/dev/null
Windows permission checks:
- icacls.exe (check file/folder permissions)
- accesschk.exe (check access rights)
- whoami /priv (show privileges)
Phase 7: Exploitability Assessment
Exploitation Primitives
Kernel LPE:
- Arbitrary read (read kernel memory)
- Arbitrary write (write kernel memory)
- Code execution in kernel context
- Token manipulation (steal system token)
Service LPE:
- Start privileged service
- Modify service configuration
- Hijack service DLL/binary
SUID LPE:
- Execute as file owner
- Load code as owner
- Write to privileged locations
PATH/DLL LPE:
- Load malicious code
- Execute in privileged context
- Hijack legitimate loading
Bypass Techniques
Signature verification bypass:
- Load unsigned drivers (test signing mode)
- Bypass driver signature checks
Permission bypass:
- Take ownership of files
- Modify ACLs/permissions
- Exploit symlink race
Mitigation bypass:
- SMEP/SMAP bypass
- CFG bypass
- KPTI bypass
Phase 8: LPE Payload Generation
Kernel Exploit Payloads
Windows Kernel Token Manipulation:
1. Find current process EPROCESS
2. Find System process EPROCESS (PID 4)
3. Copy System Token to current process
4. Spawn cmd.exe as SYSTEM
Linux Kernel Exploit:
- Dirty Cow: /proc/self/mem write
- Dirty Pipe: Splice to pipe buffer overflow
- eBPF: Write to arbitrary kernel memory
Service Exploit Payloads
Windows Service:
- sc config <service> binPath= "C:\malicious.exe"
- sc start <service>
Linux systemd:
- [Service]
- ExecStart=/tmp/backdoor.sh
Windows unquoted path:
- Create "C:\Program.exe" with backdoor
SUID Exploit Payloads
LD_PRELOAD:
#include <stdlib.h>
__attribute__((constructor))
void backdoor() {
system("/bin/sh -i");
}
Vim shell escape:
:w !chmod +x /tmp/shell
:!/tmp/shell
Final Report
[LPE VULNERABILITY] Type at 0xADDRESS
Type: Kernel / Service / SUID / PATH / Cron
Severity: CRITICAL (SYSTEM/root access)
Impact: Complete system compromise, persistence, data access
[VECTOR]
Method: Kernel exploit / Service hijacking / SUID abuse
Privilege Level: User → Administrator/root
Exploitability: EXPLOITABLE / Complex / Requires conditions
[EXPLOITATION]
Technique: Token manipulation / Service start / SUID execution
Payload: Kernel code / DLL hijacking / SUID shell
Confirmation: Shell with elevated privileges
[REMEDIATION]
1. Install security patches
2. Remove unnecessary SUID bits
3. Fix service permissions
4. Update vulnerable drivers
5. Implement proper privilege checks
CVE Examples
Windows Kernel LPE:
- CVE-2023-21768: Windows AFD.sys LPE
- CVE-2022-21882: Win32k LPE
- CVE-2021-1732: Win32k callback LPE
- CVE-2020-0787: Bits Monster LPE
Linux Kernel LPE:
- CVE-2022-0847: Dirty Pipe
- CVE-2016-5195: Dirty Cow
- CVE-2021-4038: polkit pkexec LPE
- CVE-2022-32250: nft_object UAF
Service/LPE:
- CVE-2019-14287: sudo privilege escalation
- CVE-2019-1388: Windows UAC bypass
- CVE-2020-0668: ViewState deserialization
- CVE-2021-36934: HiveNightmare (SAM file read)
SUID/Path:
- CVE-2019-18634: sudo pwfeedback
- CVE-2015-1328: overlayfs overlayfs
- CVE-2016-2384: gnupg SUID
