Privilege Escalation Explained: Linux and Windows Basics

Getting a foothold on a machine usually gives an attacker the rights of an ordinary user or service. Privilege escalation is turning that into administrator or root access. In real assessments it rarely needs an exotic exploit: it usually comes from a misconfiguration someone left behind. Here are the common causes and their fixes.

Enumeration Comes First

Escalation is mostly careful looking: who you are, what groups you are in, what runs on the machine, what is scheduled, which files you can write, what software and patches are installed. Testers use scripts to collect this quickly, but must understand every finding they report.

Common Linux Causes

• Sudo rules that let a user run a program as root that can open a shell or edit files
• SUID binaries that run with the owner's rights and can be abused
• Writable scripts run by cron as root
• Credentials in files: configuration files, history files and backups
• Weak file permissions on sensitive files
• Outdated kernels with known local exploits, used carefully because they can crash systems

Common Windows Causes

• Service misconfigurations: services whose files or settings ordinary users can change, or unquoted service paths with spaces
• Stored credentials: in files, scripts, saved sessions or the registry
• Powerful token privileges held by service accounts, such as the impersonate privilege, which several known techniques abuse
• Policies that install software with elevated rights for any user
• Missing patches for known local privilege escalation flaws
• Reused local administrator passwords across machines

In Active Directory

On a domain, escalation often continues beyond one machine: from local administrator to domain user credentials, and along attack paths to domain admin. See Active Directory attacks explained.

How Defenders Prevent It

• Grant the least privilege needed to users, services and sudo rules
• Review SUID files, scheduled tasks and service permissions regularly
• Keep credentials out of files; use a secrets manager
• Patch operating systems promptly
• Use Windows LAPS for unique local administrator passwords
• Alert on new services, scheduled tasks and additions to administrator groups; see Windows event IDs for SOC analysts

Reporting It

A good finding names the exact misconfiguration, shows the evidence, explains the impact, and gives a fix the administrator can apply. See how to write a penetration testing report.