Pearson's OSCP Notebook

Privilege Escalation

Properties1
tagsprivilege-escalation, privesc, linux, windows

3 min read

Privilege Escalation — Hub

Move from low-priv shell to root / SYSTEM / Domain Admin.

Always enumerate fully before complex exploits — easy wins are almost always there.

📌 Notes in This Folder

NotePlatformPurpose
Windows Privileges - OSCP Priority HubWindowswhoami /priv star table — SeImpersonate, SeBackup, SeDebug, etc.
SeBackupPrivilegeBackup Operators — nxc, diskshadow, robocopy, DLLs, wbadmin — start here
SeRestorePrivilegeSeRestore — wbadmin recovery, write abuse (pairs with SeBackup)
SeManageVolumePrivilegeVolume DACL abuse → write System32 → DLL privesc
SeManageVolumeExploitSeManageVolumeExploit.exe (CsEnox) — FSCTL DACL rewrite
DLL InjectionReplace DLL (tzres.dll + systeminfo, msfvenom)
DLL HijackingDLL search order / missing DLL / writable PATH
LinuxLinuxSUID, sudo, cron, capabilities, kernel
pkexec - CVE-2021-4034 PwnKitLinuxpkexec / polkit local root (CVE-2021-4034)
lxc - LXD Privilege Escalation - EDB 46978Linuxlxc / lxd group — privileged container → host / at /mnt/root
systemd - Writable Service Privilege EscalationLinuxWritable .service in /etc/systemd/system → edit ExecStart → root
disk Group - debugfs Privilege EscalationLinuxdisk group (GID 6) → debugfs read /etc/shadow → crack → root
7zip -snl Symlink Read - usage_management Privilege EscalationLinuxWritable web dir + sudo 7za -snl backup → read root id_rsa via @listfile
Dirty COW - CVE-2016-5195LinuxKernel COW race — old kernels (< 4.8.3)
Dirty Pipe - CVE-2022-0847LinuxKernel pipe bug — overwrite /etc/passwd (5.8–5.16)
Baron Samedit - CVE-2021-3156Linuxsudo heap overflow — no sudoers needed
sudo CVE-2019-14287 - User ID -1 BypassLinuxsudo < 1.8.28 + (ALL,!root) → sudo -u#-1 /bin/bash
OverlayFS - Privilege EscalationLinuxOverlayFS LPEs — CVE-2023-0386, CVE-2021-3493
DirtyCred - CVE-2022-2588LinuxDirtyCred technique — route4 double-free (LES hit)
sudoLinuxFull sudo ref — flags, sudoers syntax, visudo, NOPASSWD privesc
Windows PrivEscWindowsServices, tokens, AlwaysInstallElevated
Potato AttacksWindowsToken impersonation — GodPotato, PrintSpoofer, SigmaPotato
PrintSpooferWindowsSeImpersonate → spooler coercion → SYSTEM (second after GodPotato)
XAMPP - CVE-2020-11107 Privilege EscalationWindowsWritable xampp-control.ini → replace editor → EDB-50337 / searchsploit
AlwaysInstallElevated - MSI Privilege EscalationWindowsHKLM + HKCU AlwaysInstallElevated=1 → msfvenom MSI → SYSTEM
ChurrascoWindowsLegacy privesc — -d elevated command; SMB transfer via smbserver
winExploitSuggesterWindowsMissing-patch suggester — systeminfo → exploit list
linux-exploit-suggesterLinuxKernel exploit suggester — uname → LES
Privesc ToolsBothLinPEAS, WinPEAS — automated enum
PowerUpWindowsPowerShell local privesc (PowerSploit)
pspyLinuxHidden cron / process monitor (no root)
Process - EveryRunsBothQuick checklist / THM-style enum

📌 First Commands After Shell

Linux:

sudo -l
alias                       # sudo shortcuts, root command aliases
id; whoami; uname -a
id | grep -E 'docker|lxd'    # → [[lxc - LXD Privilege Escalation - EDB 46978]]
find / -perm -4000 -type f 2>/dev/null

Windows:

whoami /priv          # → [[Windows Privileges - OSCP Priority Hub]]
                      # SeBackupPrivilege? → [[SeBackupPrivilege]]
                      # SeRestorePrivilege? → [[SeRestorePrivilege]]
                      # SeManageVolumePrivilege? → [[SeManageVolumePrivilege]]
systeminfo

Full methodology → Privilege escalation · Every Box - Manual Workflow

Backup Operators: SeBackupPrivilege (all dump methods) · SeRestorePrivilege (restore/write)

See full checklists in Linux and Windows PrivEsc.

Linux vs Windows user/hash storage: Registry Hives and Linux Equivalents (/etc/passwd · SAM · SYSTEM · SECURITY · SOFTWARE)

19 items under this folder.