Privilege Escalation (Linux and Windows)
Privilege Escalation (Linux and Windows)
This domain tests local enumeration and reliable escalation on both platforms. CPTS values manual checks and a clear chain from low-privileged shell to administrative control.
Core rules
- Stabilize and identify: id, sudo -l, uname -a, getcap -r /, cron jobs, SUID/SGID, writable service files, NFS exports, and Docker group membership on Linux. On Windows: whoami /priv, whoami /groups, service permissions, unquoted paths, registry ACLs, AlwaysInstallElevated, and stored credentials.
- Prefer misconfigurations over kernel exploits. A sudo rule for find, a writable systemd unit, or SeImpersonatePrivilege is more reliable than a kernel CVE that may crash the host.
- Check both user and machine context: local admin does not mean SYSTEM; domain user does not mean local admin.
- Keep payloads architecture- and version-appropriate. Verify exploit prerequisites before running.
- Record the exact escalation path and any new credentials.
Worked example
On Linux, sudo -l shows (ALL) NOPASSWD: /usr/bin/find. GTFOBins gives sudo find . -exec /bin/sh ; -quit. You run it and get a root shell. You do not stop there: you check id, read /etc/shadow only to prove impact, and record the sudoers line. The reasoning is: enumerate delegated rights, map to a known safe technique, execute, then document. On Windows, an analogous case is a service binary in a world-writable directory: you replace it, restart the service, and verify the new context with whoami.
Traps
Running LinPEAS or WinPEAS and ignoring output, assuming SUID always means root, missing sudo rules that require a password, not checking 32-bit vs 64-bit, and using a kernel exploit without confirming the kernel build. On Windows, forgetting that SeImpersonate requires a suitable token and that UAC can block admin tools.