📖 What is Vertical Privilege Escalation?
Vertical Privilege Escalation occurs when a user with low-level permissions successfully gains access to functions or data reserved for higher-privileged users. A common example is a standard user gaining administrative or root-level access to a system through a kernel exploit.
"Focus on misconfigured services, unpatched kernels, or stored credentials to achieve vertical escalation during your post-exploitation phase."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Vertical Privilege Escalation?
- ▸ Kernel Exploits target vulnerabilities in the operating system core to bypass security controls and execute code with the highest possible system privileges.
- ▸ Misconfigured SUID/SGID binaries allow low-privileged users to execute specific files with the permissions of the file owner, often leading to root access.
- ▸ Credential Hunting involves searching configuration files, environment variables, and scripts for cleartext passwords used by administrative accounts or system services.
- ▸ Service Exploitation targets applications running with SYSTEM or root privileges that are vulnerable to buffer overflows or insecure command injection attacks.
- ▸ Token Manipulation involves stealing or impersonating the access tokens of a higher-privileged user currently logged into the system to assume their identity.
🎯 How does Vertical Privilege Escalation appear on the PT0-002 Exam?
You may be asked to identify the next logical step after gaining a low-privilege shell, such as searching for SUID binaries to escalate to root.
A scenario might describe a system with an outdated kernel version; you must determine if a known exploit can be used for vertical escalation.
Expect questions where you discover a configuration file containing administrative credentials and must decide how to use them to gain full system control.
❓ Frequently Asked Questions
How does vertical privilege escalation differ from horizontal privilege escalation?
Vertical escalation involves moving 'up' to a higher privilege level, such as a standard user becoming an administrator. Horizontal escalation involves moving 'sideways' to another user account that possesses similar privilege levels.
What are the most common indicators that vertical escalation is possible during an engagement?
Look for outdated OS kernels, files with the SUID bit set, writable system configuration files, and third-party services running as root or SYSTEM with known vulnerabilities.