Privilege Escalation Concepts

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand Privilege Escalation Concepts well enough that it stops being intimidating
Get hands-on running the tools yourself in an authorized lab environment
Be able to apply this concept immediately in a real assessment or report

Let's think about it this way for a second

Privilege escalation is the process of an attacker taking their initial low-privilege access and trying to escalate to higher privilege (admin/root). There are two types: vertical escalation (low-privilege user → admin/root, e.g. exploiting a misconfigured sudo permission) and horizontal escalation (moving from one user's privileges to another's — same privilege level, but broader access). Misconfigurations (weak file permissions, unnecessary sudo access, outdated software) are the common cause of privilege escalation — defenders can only reduce this risk by following the least privilege principle (giving users only the permissions they actually need).

Let's connect it to a real-world scenario

After logging into a lab VM with a low-privilege user account, run the `sudo -l` command — this shows you which commands the user is allowed to run with root permission. If you find a misconfigured entry (say, a text editor that's been given root permission), you can use that text editor to escalate to a root shell. You can consult GTFOBins (a public reference site) to learn which commands can be used for escalation.

Privilege Escalation = attempting to go from low-privilege access to higher privilege
Vertical (user → admin/root) vs. horizontal (user → another user) escalation
Least Privilege principle = the core defense for defenders against this risk

Let's look at it together

bash

# Check what commands your current user can run as root
# (a common early step after gaining a low-privilege shell)
sudo -l

# Example misconfiguration:
# (ALL) NOPASSWD: /usr/bin/vim
# -> vim can be used to spawn a root shell, since it can
#    execute OS commands from within the editor

You should see

User user1 may run the following commands on this host:
    (ALL) NOPASSWD: /usr/bin/vim

Try it in 5 minutes

Run `sudo -l` on a lab VM (your own lab only) and check out the GTFOBins website — read up on how a misconfigured command (vim, find, less, and the like) can be used for privilege escalation.

A quick word of caution

Only practice GTFOBins and other privilege escalation techniques in an authorized lab — even on your own production systems (even if you're the system admin), follow proper change management processes before making any permission changes.

Easy traps

Granting sudo permissions more broadly than necessary in the name of 'developer productivity' — this violates the least privilege principle
Assuming privilege escalation requires writing complex exploit code — in most real-world cases, it just comes down to finding and exploiting a misconfiguration (weak permissions)

Now try it yourself

Run `sudo -l` on a lab VM (your own lab only) and check out the GTFOBins website — read up on how a misconfigured command (vim, find, less, and the like) can be used for privilege escalation.

You'll know it worked when: User user1 may run the following commands on this host: (ALL) NOPASSWD: /usr/bin/vim