Escalate Privileges on Linux and Windows Systems

Provides comprehensive privilege escalation techniques for escalating from low-privileged user to root/administrator access on compromised Linux and Windows systems, for the post-exploitation phase of authorized penetration testing and red team operations.

Use this skill after gaining initial low-privilege shell access on an authorized target, to escalate to root/administrator, extract credentials, establish persistence, or compromise an Active Directory domain during a sanctioned engagement. Requires domain user credentials and network access to the DC for AD-specific attacks. Explicitly must not be used on production systems without authorization, must not leave persistence mechanisms without client approval, and must not ignore detection mechanisms like EDR/SIEM.

Linux privilege escalation techniques include abusing misconfigured sudo binaries via GTFOBins patterns (vim, find, awk, python, perl, less, man, env spawning a root shell), abusing writable cron scripts by injecting a setuid payload, abusing Linux capabilities (getcap -r /) with Python/Perl setuid or tar with cap_dac_read_search to read arbitrary files, exploiting NFS no_root_squash misconfigurations by mounting and setting the setuid bit on a copied bash binary, and exploiting MySQL running as root via its shell-out command.

Windows privilege escalation techniques include token impersonation (SweetPotato exploiting SeImpersonatePrivilege, SharpImpersonation), service abuse via PowerUp's Invoke-ServiceAbuse, abusing SeBackupPrivilege to copy the NTDS.dit database, abusing SeLoadDriverPrivilege by loading a vulnerable signed driver (Capcom) for kernel-level exploitation, and abusing Group Policy Objects via SharpGPOAbuse to push a malicious scheduled task through a GPO.

Active Directory attack techniques include Kerberoasting (requesting and cracking service account TGS tickets via Impacket's GetUserSPNs or CrackMapExec), AS-REP Roasting via Rubeus, Golden Ticket creation (DCSync to extract the krbtgt hash via Mimikatz, then forging a ticket for domain-wide access), Pass-the-Ticket via Rubeus, and a combined Golden Ticket plus scheduled task persistence chain. Credential harvesting techniques include LLMNR poisoning via Responder with a malicious shortcut file, NTLM relay via Responder plus ntlmrelayx.py, and dumping NTDS.dit/SYSTEM hive via Volume Shadow Copy Service.

A quick-reference table maps twelve techniques to OS, domain requirement, and tool. Two worked examples show a full sudo-to-root exploitation via vim and a Kerberoasting-to-hashcat cracking workflow. A troubleshooting table addresses password-protected sudo -l, AV-blocked Mimikatz (use Invoke-Mimikatz or SafetyKatz), Kerberoasting returning no hashes, failed token impersonation, and NFS mount version mismatches. Points to LinPEAS/WinPEAS for enumeration, BloodHound for AD attack path mapping, and GTFOBins as a Unix binary exploitation reference.

Uses Mimikatz, PowerView, PowerUpSQL, Responder, Impacket (GetUserSPNs, ntlmrelayx), Rubeus, SweetPotato, SharpImpersonation, SharpGPOAbuse, CrackMapExec, and hashcat within a Kali Linux-style pentest toolchain.

Authorized penetration testers and red team operators in the post-exploitation phase who need concrete Linux/Windows/AD privilege escalation techniques with matching tools rather than a conceptual security overview.

sudo -l
sudo vim -c ':!/bin/bash'