Privilege Escalation Techniques on Linux and Windows

What Is Privilege Escalation?

Privilege escalation is a critical security vulnerability that allows an attacker to gain elevated access to resources that are normally protected from regular users. When a standard user account obtains administrative or root-level privileges, the entire system becomes compromised. This technique is often the second stage of a cyberattack, occurring after initial access has been established.

Understanding privilege escalation is essential for both penetration testers conducting security assessments and system administrators defending their infrastructure. Whether you’re learning through hands-on labs or structured training programs like those available on Coursera, mastering these concepts strengthens your cybersecurity knowledge base.

Types of Privilege Escalation

There are two primary types of privilege escalation:

Vertical Privilege Escalation: This involves gaining higher-level permissions than currently possessed. For example, a standard user obtaining administrator or root access. This is the most dangerous form and the focus of most security concerns.

Horizontal Privilege Escalation: This occurs when an attacker accesses resources or functionality of another user with similar privilege levels. While less severe than vertical escalation, it still poses significant security risks.

Linux Privilege Escalation Techniques

Linux systems present unique opportunities for privilege escalation due to their permission models and configuration flexibility. Here are the most common techniques attackers exploit.

Kernel Exploits

Kernel exploits target vulnerabilities in the Linux kernel itself. When successful, they provide direct root access to the system. Attackers typically identify kernel versions using commands like:

uname -a
cat /proc/version

Once the kernel version is identified, attackers search for known exploits that match the specific version. The Dirty COW vulnerability (CVE-2016-5195) is a famous example that affected numerous Linux distributions for years.

SUID Binaries

SUID (Set User ID) binaries run with the permissions of their owner rather than the user executing them. Misconfigured SUID binaries are goldmines for privilege escalation. To find SUID binaries, use:

find / -perm -u=s -type f 2>/dev/null

Common exploitable SUID binaries include nmap (older versions), find, vim, and bash. For example, if find has SUID permissions, an attacker can execute:

find . -exec /bin/sh -p \; -quit

This spawns a shell with elevated privileges.

Sudo Misconfigurations

The sudo command allows users to execute commands with elevated privileges. Misconfigurations in /etc/sudoers can be exploited. Check sudo permissions with:

sudo -l

If a user can run certain commands without a password or with full permissions, this creates an attack vector. For instance, if vim is allowed via sudo, an attacker can escape to a shell:

sudo vim -c ':!/bin/sh'

Cron Jobs and Scheduled Tasks

Cron jobs running with root privileges but with world-writable script files present excellent escalation opportunities. Examine cron jobs by checking:

crontab -l
cat /etc/crontab
ls -la /etc/cron.*

If a cron script is writable, inserting a reverse shell or adding a privileged user becomes trivial.

Windows Privilege Escalation Techniques

Windows environments offer different attack surfaces compared to Linux systems. Understanding these specific techniques is crucial for comprehensive security testing.

Unquoted Service Paths

When Windows service paths contain spaces but aren’t enclosed in quotes, the system may execute unintended binaries. For example, if a service path is:

C:\Program Files\Some Folder\service.exe

Windows will search for executables in this order:

• C:\Program.exe
• C:\Program Files\Some.exe
• C:\Program Files\Some Folder\service.exe

Attackers can place malicious executables in these earlier paths to gain elevated privileges. Query services for unquoted paths using:

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

Registry Autorun Keys

Windows registry keys control which programs run automatically at startup. If these registry entries point to user-writable locations, attackers can replace legitimate executables with malicious ones. Key locations include:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

When testing from various network environments or using services like Proxy-cheap for anonymous reconnaissance, understanding these registry vulnerabilities becomes essential for thorough security assessments.

DLL Hijacking

Windows applications load Dynamic Link Libraries (DLLs) following a specific search order. If an application searches for a DLL in a user-controllable directory before system directories, attackers can place malicious DLLs that execute with the application’s privileges.

Tools like Process Monitor can identify missing DLLs that applications attempt to load, revealing potential hijacking opportunities.

Token Manipulation

Windows uses access tokens to determine process privileges. With sufficient permissions, attackers can steal tokens from higher-privileged processes and impersonate them. Tools like Incognito and Mimikatz facilitate token manipulation attacks.

The SeImpersonatePrivilege permission, often granted to service accounts, enables powerful attacks like the Potato family of exploits (Hot Potato, Rotten Potato, Juicy Potato).

Defense Strategies and Mitigation

Protecting against privilege escalation requires a multi-layered approach:

Regular Patching: Keep operating systems and applications updated to eliminate known vulnerabilities. Kernel exploits and software vulnerabilities are constantly discovered and patched.

Principle of Least Privilege: Grant users and processes only the minimum permissions necessary to perform their functions. Regularly audit permissions and remove unnecessary privileges.

Proper Configuration Management: Eliminate SUID binaries that don’t require elevated permissions. Quote all service paths. Restrict write permissions on system directories and scheduled task scripts.

Security Monitoring: Implement robust logging and monitoring to detect unusual privilege escalation attempts. Monitor sudo usage, service installations, and registry modifications.

Application Whitelisting: Control which applications can execute on systems, preventing unauthorized binaries from running.

Regular Security Audits: Conduct periodic penetration tests and vulnerability assessments to identify and remediate potential escalation vectors before attackers discover them.

Conclusion

Privilege escalation remains one of the most critical stages in successful cyberattacks. Both Linux and Windows systems present unique opportunities for attackers to elevate their access through misconfigurations, unpatched vulnerabilities, and inherent system features.

For security professionals, understanding these techniques is fundamental to defending infrastructure effectively. By recognizing common escalation vectors and implementing comprehensive defense strategies, organizations can significantly reduce their attack surface and protect sensitive resources from unauthorized access.

Whether you’re a system administrator hardening servers, a penetration tester evaluating security posture, or a cybersecurity student building foundational knowledge, mastering privilege escalation techniques is essential for modern IT security practices. Continuous learning, regular practice in controlled lab environments, and staying updated on emerging threats will ensure your skills remain relevant in this ever-evolving field.