PECB Certified Lead Ethical Hacker: Privilege Escalation

Privilege escalation

This domain tests post-exploitation escalation on Linux and Windows: enumeration, misconfiguration abuse, credential access, and validation. The exam emphasizes authorized scope, minimal impact, and evidence.

Core rules

• Enumerate before exploiting: OS and patch level, users and groups, sudo rights, SUID/SGID, capabilities, cron, services, scheduled tasks, registry permissions, and credentials in files.
• Prefer configuration abuse over kernel exploits; it is usually safer and more reliable. Validate the exact version and prerequisites.
• Document the before/after context: who you were, what you ran, what privilege you obtained, and what changed.
• Do not create persistence, disable controls, or dump more credentials than needed for the objective.

Worked example

On an authorized Linux host, sudo -l shows (ALL) NOPASSWD: /usr/bin/find. Reasoning: find can execute commands through -exec, so the sudo rule grants root command execution even though it looks limited. You validate with a benign command that prints the effective UID, not a destructive action: sudo find . -maxdepth 0 -exec id \;. The output shows uid=0(root). You record the sudoers line, the command, and the output, then revert any test file. Remediation: remove unnecessary sudo rules, use NOEXEC where appropriate, and review GTFOBins-style abuses.

Traps

• Assuming escalation requires a kernel exploit.
• Running a public exploit without checking version and side effects.
• Missing sudo version issues, PATH hijacks, and writable service binaries.
• Dumping LSASS or /etc/shadow beyond the proof needed.
• Forgetting that domain escalation may affect other systems.
• Leaving new admin accounts, scheduled tasks, or SUID binaries behind.