Posts on: Privilege-Escalation

---

Windows privilege escalation is usually a configuration flaw, not a missing patch. The highest-value paths are token-impersonation privileges, weak service ACLs, credential material left on disk, and Active Directory misconfigurations. Kernel exploits exist but are secondary. This file is organized by payoff-per-minute, not by category. Helpful Tools Miscellaneous Ghostpack Compiled Binaries UACME — UAC bypass techniques Impacket NetCat for Windows Exploit Suggesters winPEAS — broad automated enumeration Seatbelt — C# host-survey tool PowerUp / SharpUp — PowerShell/C# privilege-escalation checks JAWS — PowerShell 2.0 enumeration Watson — missing-KB enumeration WES-NG — Windows Exploit Suggester Next Generation Metasploit — use post/multi/recon/local_exploit_suggester on a backgrounded meterpreter session Credentials and Token Abuse LaZagne — credential recovery from many sources Mimikatz — LSASS dumping, PtH, PtT, golden tickets SessionGopher — saved remote-access session information SharpDPAPI — DPAPI triage and decryption (triage, rdg, credentials, masterkeys, machinetriage) SharpChrome — Chrome credential extraction Current 2026 tooling Tool What it adds Install Certipy AD CS enumeration and exploitation (certipy find -u … -p … -dc-ip … -stdout -vulnerable) — covers ESC1 through ESC17 as of 2026 pip install certipy-ad Certify C# AD CS enumeration — often more reliable in restricted PowerShell environments Ghostpack binaries SharpWSUS Fake-update injection via WSUS to push a signed binary with malicious arguments GitHub: netero1010/SharpWSUS Rubeus Kerberos abuse — unconstrained delegation capture, S4U, ticket extraction Ghostpack binaries FullPowers Recovers the default privilege set on LOCAL SERVICE / NETWORK SERVICE tokens that have been filtered GitHub: itm4n/FullPowers SigmaPotato / PrintNotifyPotato Modern Potato variants with reflection/in-memory execution; the latter abuses PrintNotify COM when the Spooler is disabled GitHub forks Nanodump / lsassy Stealthy LSASS dumping and remote parsing pip install lsassy DonPwner / nxcspray Safe password spraying respecting AD lockout policy pipx install nxc Priority Execution Order — Stop at the First Root-Equivalent Primitive Run this before the detailed sections. Most HTB/OSCP hosts fall in the first four checks.

A consolidated reference for enumerating attack vectors on Linux targets, from first shell to root. Commands are grouped by category; exploitation primitives follow each enumeration section where relevant. Table of Contents Helpful Tools Processes and Jobs Kernel and OS User-Related Network Related Finding Interesting Files and Directories Process Memory and Sudo Token Reuse Systemd Unit Abuse Logrotate ld.so.preload — Universal Linker Hijack SUID / SGID / Capabilities Sudo Abuse Kernel and Userland Exploits Container and Namespace Escape D-Bus, Screen, and Tmux Session Abuse SUID Shared-Library and Linker Abuse Writable /etc/passwd / /etc/shadow Credential Hunting Open File Descriptors Consolidated Enumeration One-Liners Priority Quick Actions Field Notes from the HTB List Helpful Tools Tool Notes LinPEAS Broad automated enumeration; default first pass LinEnum Lighter-weight shell alternative pspy Watches process spawns without root — exposes cron and systemd timer execution paths unix-privesc-check Legacy file-permission auditing linux-exploit-suggester Kernel exploit correlation lse.sh Linux smart enumeration CDK Container-specific enumeration and escape primitives deepce Docker/container enumeration from inside a container uptux Single-file Python script specialized in systemd, D-Bus, socket units, and writable unit paths SUDO_KILLER Focused on sudo misconfigurations, CVE detection, and token reuse privmap Graph-based path modeling — traces www-data → writable logrotate config → root cron → root, reporting paths rather than isolated findings # uptux wget https://raw.githubusercontent.com/initstring/uptux/master/uptux.py python3 uptux.py # SUDO_KILLER wget https://raw.githubusercontent.com/TH3xACE/SUDO_KILLER/master/SUDO_KILLER.sh bash SUDO_KILLER.sh # privmap pip install privmap sudo privmap Processes and Jobs Command Description ps aux | grep root See processes running as root ./pspy64 -pf -i 1000 View running processes with pspy cat /etc/crontab System-wide cron table ls -la /etc/cron.daily Check for daily Cron jobs ls -la /etc/cron.* /etc/at* /var/spool/cron/crontabs/ 2>/dev/null Enumerate all cron locations crontab -l Current user’s cron grep -i cron /var/log/syslog /var/log/cron 2>/dev/null Enumerate cron jobs (second file on RHEL/CentOS) journalctl -u cron --no-pager Cron activity on journald-only hosts systemctl list-timers --all systemd timers — frequently missed because they are not cron atq List queued at jobs ls -la /var/spool/cron/atjobs/ 2>/dev/null at job files busctl --system list D-Bus services that may expose privileged methods lpstat Active or queued print jobs (sensitive information) Cron exploitation notes: If a cron job runs a script that calls another binary by relative name, the job’s PATH or the script’s writable directory becomes the target. pspy is the fastest way to confirm a job is firing and to observe its exact command line and working directory. at/batch jobs are cron-adjacent and less scrutinized — a root-scheduled at job running a script in a writable directory is exploitable exactly like a writable cron script:

Windows token privileges are the most direct path to SYSTEM on a compromised host. A web shell on an IIS server or a SQL Server xp_cmdshell almost always lands in a context holding SeImpersonatePrivilege — and a single command turns that into NT AUTHORITY\SYSTEM. This file covers each high-value privilege, the tools to abuse it, and the defenses you must bypass on modern Windows (2025–2026). 0. Triage — Which Privilege Do I Have? Run this immediately after landing a shell:

Group membership is often the shortest path to root — shorter than any kernel exploit and far less risky. The critical first command after landing a shell is id or groups, because a single membership in docker, lxd, or disk is functionally equivalent to root. This file covers every group that grants a meaningful escalation primitive, ordered roughly by how directly it leads to root. 1. Docker Group Placing a user in the docker group is essentially equivalent to root-level access to the file system without requiring a password. Members can spawn new containers, and the Docker daemon runs as root.

Windows ships with privileged built-in groups whose membership grants powerful rights short of full administrator — and several are a direct path to SYSTEM or Domain Admin. Treat every group below as Tier-0 on a Domain Controller; membership changes should be monitored, and any foothold account that lands in one of them should be treated as a domain-compromise primitive. Triage — Which Group Do I Have? Run this immediately after landing a shell:

Environment variables are the configuration plane that every process inherits. When a privileged process — a root cron job, a systemd unit, a sudo-allowed command — trusts its inherited environment, a low-privileged user can often turn that trust into root. The critical question is always whether the variable survives into the privileged process, which depends on sudo’s environment handling, the scheduler’s reset behaviour, and the binary’s own sanitisation. Why These Attacks Work (and Often Fail) The single most common reason an environment-variable attack fails is that the privileged process does not actually inherit the attacker’s environment:

What are Capabilities? Linux capabilities are a security feature that allows specific privileges to be granted to processes, enabling actions that would otherwise be restricted to root. Capabilities break up the monolithic root privilege into smaller, independently grantable units. Each unit can be assigned to a process or binary without granting full root. One common vulnerability is using capabilities to grant privileges to processes that are not adequately sandboxed or isolated, allowing privilege escalation and access to sensitive information. Another vulnerability is misuse or overuse: a process may hold more capabilities than it actually needs, widening the attack surface. Capabilities are stored as extended attributes (security.capability) and are not visible in ls -l — unlike SUID, they must be enumerated with getcap.

Windows services are one of the most common privilege escalation paths because they often run as LocalSystem while pointing to files, service objects, or registry keys that normal users can influence. Three separate misconfigurations can grant SYSTEM, and they are often confused: Attack surface You control Exploitation Primary check Writable binary The .exe on disk Replace the file, restart the service icacls on the binary Modifiable service DACL The service object Change binPath=, restart the service accesschk -uwcqv Writable registry key The service’s registry entry Edit ImagePath, restart the service accesschk -kvuqsw on HKLM\...\Services Key distinction: A writable binary is a file-system problem. A modifiable service DACL is a service-object problem — you do not need write access to the binary’s directory, only permission to reconfigure the service itself.