Privilege Escalation Paths

Privilege escalation is the process by which an attacker who has gained a foothold in a system (with limited privileges) obtains higher-level privileges — typically administrator or root access. Understanding how privilege escalation works is essential for IAM professionals because PAM controls are specifically designed to prevent and detect these techniques.

The MITRE ATT&CK framework categorises privilege escalation as a distinct tactic (TA0004), with 40+ documented techniques.

The Privilege Escalation Mindset

Attackers follow a predictable pattern once they gain initial access:

Initial Foothold ──→ Reconnaissance ──→ Escalation Technique ──→ Higher Privileges ──→ Lateral Movement ──→ Repeat
(Low privilege)    (Find escalation     (Exploit weakness)     (Admin/root)         (Find new targets)   (Escalate again)
                     opportunities)

Every escalation technique exploits one of three fundamental weaknesses:

1. Misconfiguration — A system is configured with excessive privileges or insecure defaults
2. Vulnerability — A software bug allows privilege elevation
3. Credential exposure — Higher-privilege credentials are accessible from a lower-privilege context

Windows Privilege Escalation

Token Manipulation

Windows access tokens determine the privileges of a process or thread. Attackers manipulate tokens to gain elevated privileges.

Unquoted Service Paths

When a Windows service path contains spaces and is not enclosed in quotes, Windows may execute a differently-named executable:

Service: C:\Program Files\My App\service.exe (unquoted)
Attacker plants: C:\Program.exe
Result: Windows executes C:\Program.exe instead of C:\Program Files\My App\service.exe

Mitigation: Ensure all service paths are quoted in registry; audit for unquoted paths with wmic service get name,pathname.

Weak Service Permissions

A service where the lower-privilege user has WRITE_DAC or SERVICE_CHANGE_CONFIG permission can be escalated:

Current user: Limited user with SERVICE_CHANGE_CONFIG on "VulnerableSvc"
Attack: Change service binary to attacker's executable
       → Attacker starts service
       → Service runs as LOCAL_SYSTEM
       → Privilege escalation complete

Mitigation: Audit service permissions with tools like Process Explorer or AccessChk. Apply least-privilege to service ACLs.

DLL Hijacking

Applications that load DLLs without specifying a full path can be forced to load a malicious DLL placed in a directory the attacker controls.

Mitigation: Application allowlisting, safe DLL search mode, DLL redirects.

Windows Privilege Escalation Tools

Popular tools used for Windows privilege escalation:

Linux Privilege Escalation

SUID/SGID Binaries

Executables with the SUID (Set User ID) bit set run with the privileges of the file owner, not the executing user:

# Find all SUID binaries
find / -perm -4000 -type f 2>/dev/null

# If a binary owned by root has SUID set:
# CVE-2021-3156 (sudo) — buffer overflow in sudo allows privilege escalation
# CVE-2023-2640 (OverlayFS) — Ubuntu privilege escalation via OverlayFS

Mitigation: Minimise SUID binaries, audit regularly, use capabilities instead of SUID where possible.

Sudo Misconfiguration

The /etc/sudoers file defines which users can run which commands as which users. Misconfigurations are common:

# Risky sudoers entries
user ALL=(ALL) ALL           # User has full sudo access
user ALL=(ALL) NOPASSWD: ALL # User has passwordless sudo (extreme risk)
user ALL=(ALL) /bin/vi       # User can run vi as root → :!bash to get root shell

Mitigation: Follow the principle of least privilege for sudo — specify exact commands and arguments, require password, log all sudo usage.

Kernel Exploits

Linux Capabilities

Linux capabilities break root privileges into granular units. Misconfigured capabilities can lead to escalation:

Mitigation: Audit running processes and binaries for dangerous capabilities. Remove capabilities from processes that do not need them.

Active Directory Privilege Escalation

Kerberoasting

An attacker requests Ticket-Granting Service (TGS) tickets for any AD service account using SPN lookup. These tickets are encrypted with the service account’s NTLM hash, which can be cracked offline.

# Request TGS for all SPNs (PowerView)
Get-DomainUser * -SPN | Get-DomainSPNTicket -Format Hashcat

# Crack the hash offline
hashcat -m 13100 kerberos_hashes.txt rockyou.txt

Mitigation: Use strong (30+ character) random passwords for service accounts, use Group Managed Service Accounts (gMSAs) where possible, monitor for kerberoasting tool usage.

AS-REP Roasting

Users without Kerberos pre-authentication enabled allow attackers to request an AS-REP response that can be cracked offline.

Mitigation: Enable Kerberos pre-authentication for all user accounts, audit for accounts with DONT_REQ_PREAUTH flag set.

ACL Abuse

Active Directory ACLs allow fine-grained permissions. Misconfigured ACLs create escalation paths:

Mitigation: Use tools like BloodHound to map AD attack paths, audit AD ACLs, remove excessive permissions.

Cloud Privilege Escalation

Defensive Mitigations Summary

Key Takeaways

• Privilege escalation exploits three fundamental weaknesses: misconfiguration, vulnerability, and credential exposure — all three must be addressed
• Windows escalation includes token manipulation, unquoted service paths, weak service permissions, DLL hijacking, and credential extraction from LSASS
• Linux escalation includes SUID binaries, sudo misconfiguration, kernel exploits, and dangerous Linux capabilities
• Active Directory escalation includes Kerberoasting, AS-REP roasting, ACL abuse, and delegation abuse — mapped by BloodHound as attack paths
• Cloud privilege escalation varies by provider but commonly involves IAM privilege escalation and role chaining
• Most privilege escalation is prevented by patch management and least privilege — deploy PAM/JIT to reduce standing privileges, and continuous monitoring to detect escalation attempts