Privilege Escalation (Windows and Linux)
Linux
Enumerate before exploiting: kernel and distribution version, SUID/SGID binaries, sudo -l output including allowed arguments, file capabilities, cron and systemd timers, writable service unit files, PATH abuse, NFS exports with no_root_squash, group memberships such as docker or lxd, readable credential files, and exposed SSH keys. GTFOBins classifies binaries that can break out of their intended function - but presence alone is not a finding; you need a path to execution in the current context.
Windows
Focus on service and task misconfiguration: unquoted service paths containing spaces, weak service ACLs allowing binPath rewrite, writable directories in a service's execution path (DLL search order), scheduled tasks running as SYSTEM in writable locations, AlwaysInstallElevated, stored credentials, and registry autoruns. Token privileges matter enormously: SeImpersonate/SeAssignPrimaryToken enables potato-style attacks, SeBackup/SeRestore enables file-level access to protected hives, SeDebug enables process memory access. Remember that an administrative shell is not SYSTEM - UAC separates the two.
Traps in exam questions
- Running a kernel exploit on a production host: it can panic the machine and breach the ROE.
- Assuming SUID bit or file capability equals escalation without a command that actually invokes it.
- Confusing local administrator with SYSTEM or with domain privilege.
- Ignoring that a writable path only matters if the privileged process resolves a binary there.
Rule of thumb
Prove the new privilege level by doing something that was previously denied - read /etc/shadow, or dump a protected registry hive - rather than relying on whoami output alone.