Privilege Escalation Methods

What it does

This skill provides detailed techniques for escalating privileges on compromised Linux and Windows systems, moving from a low-privileged user to root or administrator access. It focuses on methods used in penetration testing post-exploitation phases and red team operations, covering both Linux and Active Directory environments. The skill details specific exploits of misconfigured binaries, scheduled tasks (cron), and capabilities.

When to use it

• During a penetration test after initial system compromise to gain higher privileges.
• In red team exercises to simulate advanced persistent threat (APT) activities.
• To understand potential vulnerabilities in systems with existing low-privilege access.
• When investigating suspicious activity or unauthorized access on a system.

Key capabilities

• Linux Privilege Escalation: Exploiting sudo binaries, abusing scheduled tasks (cron), and leveraging file capabilities.
• GTFOBins exploitation: Provides examples of using common Linux binaries to escalate privileges.
• Active Directory Attacks: Offers techniques for domain compromise when appropriate prerequisites are met.
• Tool Integration: Requires tools like Mimikatz, PowerView, Responder, Impacket, and Rubeus (though the skill itself doesn't directly use them).

Example prompts

• "Show me examples of how to escalate privileges on Linux using sudo binaries."
• "What are some techniques for abusing cron jobs to gain root access?"
• "Describe methods for privilege escalation in an Active Directory environment."
• “Explain how I can use file capabilities to elevate my privileges.”

Tips & gotchas

• Prerequisites: This skill requires initial low-privilege shell access on a target system and familiarity with Linux/Windows privilege models.
• Tool Dependency: While the skill describes techniques, it relies on external tools like Mimikatz and PowerView for execution; these are not included within the skill itself.
• Environment Specificity: The effectiveness of these methods depends heavily on the specific system configuration and installed software.