Privilege Escalation & Post-Exploitation

Land, breathe, document. whoami, id, hostname, uname -a, ip/ifconfig, ss/netstat, env, and process list establish who you are and where. Are you in a container? A restricted shell? A shared hosting user? Escalation options differ completely. Blindly running exploit-suggesters without context wastes time and can crash fragile lab kernels — or production, if you are careless on a scoped test.

Define the objective: root on this box, specific file read, lateral credentials, or proof for a report. Post-exploitation is goal-directed. Dumping every secret on a production host without need violates proportionality even when technically allowed.

Authorized lab only framing applies doubly here: many privesc actions modify services, cron, or binaries. Prefer disposable VMs and snapshots. On client hosts, use least invasive proofs.

Order of operations that experts still use: (1) sudo -l for allowed commands and env options; (2) find SUID/SGID binaries and compare to GTFOBins; (3) file capabilities (getcap -r); (4) writable paths in scripts run by root (cron, timers, init); (5) world-writable or user-writable service files; (6) interesting mounts and NFS no_root_squash; (7) kernel/container escapes only when relevant and in scope; (8) credentials in files, histories, .ssh, web configs, connection strings.

sudo is frequently the shortest path. NOPASSWD entries for editors, interpreters, package managers, or custom scripts can yield root via intended or GTFOBins-documented abuse. Always read the full sudoers effect — including env_keep and wildcards.

SUID shells are rare on modern systems; SUID utility abuse is common. Confirm binary path authenticity (not a user-writable fake). Capabilities like cap_setuid on python can be equivalent to SUID root depending on version and constraints.

Cron and systemd timers often run as root with scripts in writable locations or calling relative paths. Enumerate /etc/cron*, user crontabs, and systemctl list-timers. Read scripts for unsafe PATH usage, writable includes, and open output files.

pspy helps detect transient cron jobs and commands that do not leave permanent crontab artifacts — especially useful on shared or CTF boxes where root periodically runs secret jobs. Run it long enough to catch intervals; note noise from your own activity.

When you find a writable root-executed script, prefer a minimal proof (create a marker file in /root or print id) over destructive changes. Restore script contents after proof if you modified them and policy requires clean state.

LinPEAS accelerates coverage: kernel CVEs, sudo, SUID, writable files, network, containers, cloud metadata hints. Download or transfer only through authorized channels; some environments block outbound fetches — plan offline copies.

Triage: read the color/heuristic highlights first, then validate manually. PEAS false positives and low-value noise exist. Cross-check each promising lead with the manual checklist so you understand the root cause for the report.

Linux Exploit Suggester and similar tools point at kernel issues. Exploit reliability varies; crashes are possible. Prefer misconfig-based privesc on client engagements unless kernel exploits are explicitly in scope and risk-accepted. CTFs may encourage kernel paths — still snapshot first.

GTFOBins documents how legitimate binaries can break out of restricted shells, escalate via sudo/SUID, or do file read/write. Match the exact binary and sudo rule; copy-paste without context fails. Note version differences.

Secrets: config files under web roots, .env, Docker compose, history files, world-readable backups, Ansible vault mistakes, and SSH private keys. Keys may unlock other hosts — update your lateral plan. Never exfiltrate more key material than needed; protect loot folders.

If you add SSH keys or users for persistence in a lab, remove them later. On client tests, persistence usually requires explicit RoE and is often out of scope for standard vulnerability assessments.

A professional Linux privesc writeup lists: initial user privileges, enumeration highlights, the exact misconfiguration, commands for reproduction, proof of root, and remediation (sudo least privilege, remove SUID, fix cron permissions, patch, secrets management, hardening benchmarks).

Map techniques to detection: unusual sudo, new SUID files, cron modifications, PEAS-like find noise. Purple-minded operators recommend controls that would have stopped them.

Containers: escaping is advanced and environment-specific. First ask whether 'root in container' already meets objectives or whether host escape is authorized. amicontained-style checks inform context; do not assume Docker socket access exists.

whoami /all, hostname, systeminfo, ipconfig, net user, net localgroup, and network shares establish context. Are you a service account, IIS app pool, or interactive user? Is UAC filtering your token? Is the host domain-joined? Domain-joined workstation privesc may matter less than stealing a domain admin session — connect to objectives from Module 7.

Architecture notes: integrity levels, UAC, privileged services, and scheduled tasks differ from Linux sudo/SUID but rhyme conceptually. Always-install-elevated, autologon registry secrets, and saved credentials are Windows-flavored secret stores.

Authorized environments only. Many Windows privesc actions require writing to service paths or creating tasks — noisy and potentially destabilizing. Prefer labs (vulnerable Windows VMs, HTB, custom misconfig boxes) before client hosts.

Unquoted service paths with spaces allow placement of an executable earlier in the parsed path when directories are writable. Insecure service binary or folder ACLs let a low-priv user replace a binary that a privileged service executes. Weak service permissions may allow reconfiguration of binPath via sc.exe or similar — classic privesc.

Enumerate services, their paths, and ACLs carefully. Tools help; manual confirmation with icacls and sc qc prevents PEAS cargo-culting. Proof: get a high-integrity or SYSTEM shell via the service, then document the ACL fix (restrict write, quote paths, run as least privilege accounts).

DLL hijacking and writable PATH directories appear in application-specific contexts. Confirm load order and write access before claiming impact. Stability risk is real — snapshot lab VMs first.

Scheduled tasks running as SYSTEM with writable scripts or binaries mirror Linux cron issues. Check task XML, actions, and file ACLs. Autorun registry keys and startup folders can escalate or persist depending on who executes them.

AlwaysInstallElevated registry settings, if enabled, let MSI packages run elevated — high-impact misconfig when present. Autologon passwords in registry are credential findings even before full privesc.

LOLBAS documents living-off-the-land binaries and scripts that can download, execute, or bypass application controls. Use them for constrained environments and detection-aware learning — not as a default to avoid thinking about primary misconfigs.

SeImpersonatePrivilege and related privileges enable potato-style and other token abuses in many lab and historical environments; patch levels and service hardening change reliability. Understand why service accounts with impersonation rights are dangerous rather than only memorizing one exploit name.

UAC means your elevated split token may not have full admin rights until elevation. Some techniques target auto-elevating binaries or GUI paths; others need a different vector entirely. whoami /priv is mandatory reading after every new shell.

On domain hosts, local admin may immediately enable lateral movement via admin shares if password reuse or stolen domain creds exist. Escalate with the domain graph in mind, not only local SYSTEM vanity.

LSASS dumps, SAM/SECURITY hives, DPAPI secrets, Credential Manager, and browser stores teach why Credential Guard, LSA protection, and app control matter. On real engagements, credential dumping is often restricted, heavily logged, and ethically sensitive. Prefer proving access another way when possible; when dumping is authorized, minimize retention and never reuse client credentials outside the engagement.

Mimikatz-class tooling is heavily signatured. Lab practice builds conceptual understanding for defender recommendations. Production red teams may use alternate tradecraft; assessments may stop at 'local admin achieved' without full dump demos.

Any plaintext password found in scripts, web.config, unattend files, or VSS shadows is both a privesc/lateral lead and a finding about secrets management. Record source paths carefully for developers.

WinPEAS, Seatbelt, SharpUp, PowerUp, and WesNG provide broad coverage and CVE hints. Transfer methods must match the foothold (HTTP, SMB, clipboard in lab). Read outputs critically; validate before exploit.

Writeups should include integrity level start/end, exact misconfig, reproduction steps, ATT&CK technique IDs, and remediations (service ACL hardening, quoted paths, remove AlwaysInstallElevated, LAPS, reduce privileges, application allowlisting).

Cleanup: remove test services, tasks, binaries, and local accounts you created. Confirm with the client whether ephemeral artifacts should remain for blue-team training — default is clean.