Privilege Escalation: Vertical & Horizontal

When you first break into a system you almost never land as the all-powerful root/Administrator. You get a foothold, a low-privilege account like www-data (the web server user). Privilege escalation is turning that limited access into more.

Think of the machine like an office building. Your foothold is a visitor's badge, it opens the lobby and one meeting room. Privilege escalation is finding the master key. You don't pick every lock; you look for the one door someone left propped open, and walk through it.

Vertical vs horizontal

There are two directions you can move:

Vertical is the headline goal (root owns the whole machine). Horizontal often comes first: you hop to another user who happens to have the sudo right or file access you need, then go vertical from there.

Rule #1: enumerate before you exploit

Privesc is 90% looking. Start by answering three questions:

whoami          # who am I?
id              # what groups am I in? (sudo? docker? adm?)
sudo -l         # what may I run as root?
find / -perm -4000 2>/dev/null   # what runs as its owner (SUID)?

Run those in the terminal beside you. On this box, sudo -l and find / -perm -4000 both reveal a way up.

The special permission bits

Normal permissions are read/write/execute for owner/group/other. Three special bits sit on top, and they are the classic privesc fuel:

• SUID (Set User ID, 4000) , the file runs as its owner, not as you. A root-owned SUID program runs as root. In ls -l it shows an s in the owner-execute slot: -rws r-x r-x.
• SGID (Set Group ID, 2000) , runs with the file's group. Shows s in the group slot.
• Sticky bit (1000) , on a directory (like /tmp), means only the owner of a file may delete it. Shows t on the directory: drwxrwxrwt.

Find every SUID binary , this is muscle memory for a tester:

find / -perm -4000 -type f 2>/dev/null

Most results are normal (/usr/bin/sudo, /usr/bin/passwd). You hunt for the odd one out, a binary that has no business being SUID (an editor, find, python). That is your ticket up, which the next lesson (GTFOBins) turns into a root shell.

Where to look (the directory map)

• /etc , config and the user database (/etc/passwd, /etc/shadow, /etc/crontab).
• /home and /root , user files, SSH keys, .bash_history (leaked passwords!).
• /var , web roots (/var/www), logs, mail, spool. App secrets hide here.
• /tmp and /dev/shm , world-writable scratch space, where you drop tools.
• /opt , third-party software, often run by cron as root.

The common vectors

Once enumerated, escalation usually comes from one of these:

1. SUID/SGID binaries , an abusable program that runs as root (see GTFOBins).
2. sudo rights , sudo -l lets you run something as root that can shell out.
3. Cron jobs , a root cron running a script you can edit.
4. Writable files / PATH , overwrite something root executes.
5. Capabilities , getcap -r / finds binaries with extra powers.
6. Kernel exploits , an old kernel with a public local-root bug.
7. Leaked credentials , passwords in history, configs, .env, scripts.

Each of these has its own lesson later in this milestone. The whole journey looks like this:

Vector #2 has the most detail of its own: how sudo works, how to read every sudo -l line, which rules hand you root, and the sneaky wildcard injection trick all live in the sudo & sudoers lesson.

Try it (terminal)

1. whoami and id , you are learner (uid 1000), in the sudo group.
2. sudo -l , notice you may run one program as root.
3. find / -perm -4000 , spot the unusual SUID binary in the list.
4. cat .bash_history and cat /var/www/html/.env , find leaked secrets.
5. Try cat /etc/shadow , denied for now. The next lesson gets you root so you can.

Common questions

"Do I need to be root to run these enumeration commands?" No, that's the point. whoami, id, sudo -l, and find all work as a normal user. You're looking for a way up, not using one yet.

"Is privilege escalation the same as hacking in?" No. Getting in (exploiting a web app, a password) gives you the foothold. Privilege escalation happens after you're already inside, to turn a weak account into a powerful one. Different phase, different techniques.

"Why not just try a kernel exploit every time?" Because misconfigurations (a stray SUID binary, a loose sudo rule) are quiet, reliable, and won't crash the box. Kernel exploits are the loud last resort, more on that in the kernel lesson.

"There are seven vectors, do I check all of them?" Yes, but you automate it. You'll learn each one by hand first so you understand it, then let LinPEAS run all the checks in seconds.

Stay in scope

Escalation is only legal on systems you own or are authorised to test. On a real engagement, document every step, you are proving the impact, not causing damage.

Why this matters

A foothold is just the front door. Privilege escalation is how a small bug becomes full control of the machine, and it almost always starts with patient enumeration, not a flashy exploit.