Privilege Escalation to Root or SYSTEM
Domain 7 tests the step between a low-privilege foothold and full control. The discipline is verification: every candidate escalation path must be confirmed manually before you exploit it, because automated enumeration scripts generate far more false positives than real paths.
Linux escalation paths
Run an enumeration script for breadth, then verify each candidate by hand. The core checklist: kernel and distribution version against known local exploits; sudo -l output for NOPASSWD entries and abusable binaries mapped through GTFOBins; SUID and SGID binaries, especially custom ones and known abusers like find, vim, nmap with old --interactive; file capabilities from getcap -r / such as cap_setuid+ep; writable cron scripts, cron PATH entries and wildcard injection in tar or rsync jobs; LD_PRELOAD retained in sudo env_keep; writable /etc/passwd or /etc/shadow; NFS exports without root_squash; and membership of the docker group, which is root-equivalent through a mounted host filesystem.
Windows escalation paths
Enumerate token privileges with whoami /priv: SeImpersonatePrivilege enables PrintSpoofer, RoguePotato or GodPotato; SeBackupPrivilege allows registry hive and SAM extraction; SeTakeOwnershipPrivilege allows file replacement. Then check unquoted service paths, service ACLs via accesschk, writable service binaries, scheduled tasks, AlwaysInstallElevated, and credential material in unattended files, Group Policy Preferences cpassword, LSASS memory, and DPAPI blobs. In Active Directory, Kerberoasting, AS-REP roasting, ACL abuse and ADCS misconfigurations such as ESC1 extend the same logic across the domain.
Worked example
sudo -l returns (ALL) NOPASSWD: /usr/bin/find. GTFOBins documents that find can spawn a shell, so the tester runs sudo find . -exec /bin/sh \; -quit and receives a root prompt. The finding is written as: sudoers entry grants unrestricted find execution to the low-privilege account, permitting root shell without a password; remediation is to remove the entry or restrict it to a wrapper script with fixed arguments.
Traps that cost marks
- Running an enumeration script's suggested exploit blindly and crashing the host.
- Escalating on a host outside the agreed scope or on a system the client did not list.
- Ignoring EDR behaviour and losing the foothold before capturing evidence.
- Forgetting that escalated access still carries data-handling obligations: do not read customer records to prove root.