📖 What is Privilege Escalation?
Privilege Escalation is the act of exploiting a bug or configuration flaw to gain a higher level of access than originally intended. This can be vertical, moving from a user to an admin, or horizontal, moving between accounts with similar privilege levels.
"Look for outdated kernels, misconfigured SUID permissions on Linux, or unquoted service paths on Windows as common vectors for vertical escalation."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Privilege Escalation?
- ▸ Vertical escalation occurs when an attacker moves from a low-privileged user account to a high-privileged account, such as root or SYSTEM.
- ▸ Horizontal escalation involves gaining access to another user account with similar privilege levels to access different data or restricted resources.
- ▸ Linux escalation vectors often include exploiting SUID binaries, outdated kernels, or misconfigured sudoers files to gain root access.
- ▸ Windows escalation vectors frequently involve unquoted service paths, DLL hijacking, or exploiting insecure service permissions to reach SYSTEM privileges.
- ▸ Post-exploitation enumeration is the critical first step, using tools like LinPEAS or WinPEAS to identify system vulnerabilities that allow escalation.
🎯 How does Privilege Escalation appear on the PT0-002 Exam?
You may be asked to identify the type of escalation occurring when an attacker uses a stolen session cookie to access another standard user's profile.
A scenario might describe finding a binary with the SUID bit set on a Linux system; you will need to determine how to exploit this for root access.
Expect questions where you must identify an unquoted service path in a Windows environment as the primary vulnerability for gaining SYSTEM privileges.
❓ Frequently Asked Questions
How do I distinguish between vertical and horizontal escalation in a multiple-choice question?
Focus on the privilege level change. If the attacker gains administrative or root rights, it is vertical. If they move to a different account with the same level of authority, it is horizontal.
What is the difference between a kernel exploit and a misconfiguration for escalation?
Kernel exploits target flaws in the OS core code (like Dirty COW), whereas misconfigurations target human errors, such as overly permissive SUID bits or unquoted paths in service configurations.