I85PREP
⌘ K
OSC study materials
OSC study resources

OSC: Privilege Escalation (Linux and Windows)

OSC · Work through your exam, one topic at a time.

All guide sections

Privilege Escalation (Linux and Windows)

This domain tests whether you can go from a low-privilege foothold to root or SYSTEM using misconfiguration rather than luck. Enumeration is the whole game: run automated collectors, then confirm every lead manually.

Core rules: Linux

  • sudo -l first: NOPASSWD, (ALL), or any allowed binary you can escape via GTFOBins.
  • SUID/SGID: find / -perm -4000 -type f 2>/dev/null; remember the -p flag preserves privileges.
  • Capabilities: getcap -r / 2>/dev/null - cap_setuid and cap_dac_read_search are gold.
  • Cron: writable scripts, PATH hijack, wildcard injection in tar or rsync jobs.
  • NFS exports with no_root_squash, writable /etc/passwd, and loose permissions on backups and configs.
  • Kernel exploits last: they can panic the box and cost you the exam.

Core rules: Windows

  • whoami /priv, whoami /groups, systeminfo, net user, net localgroup administrators.
  • Service ACLs via accesschk or PowerUp Invoke-AllChecks, unquoted service paths, writable service binaries.
  • AlwaysInstallElevated set in both HKLM and HKCU.
  • SeImpersonatePrivilege leads to the Potato family or PrintSpoofer.
  • Stored credentials: cmdkey /list, runas /savecred, unattended install files, registry autologon.

Worked example

sudo -l shows (root) NOPASSWD: /usr/bin/find. GTFOBins gives sudo find . -exec /bin/sh \; -quit. You get a root shell. Reasoning: sudo runs the binary as root and -exec inherits that context, so no SUID bit is needed.

Traps that cost marks

Firing a kernel exploit before checking sudo; forgetting -p with SUID shells; running WinPEAS without reading its output; assuming an unquoted service path is exploitable without checking directory write permissions; and not recording the escalation path for the report.