Offensive methodology

Privilege escalation

Going from a limited foothold to full control of the machine, on Linux and Windows alike. The rule is the same everywhere: enumerate methodically before acting. Practise on authorised lab machines.

CPTSOffensiveAuthorised lab / HTB

Common approach

LocateWho am I, what rights, which machine, which network?
EnumerateProcesses, services, tasks, rights, files, software.
Spot a vectorA misconfiguration or excessive right that can be abused.
Escalate then stabiliseGain the rights, keep a record, document.

Enumerate firstScripts like linPEAS and winPEAS automate the collection, but understand what they report: a vector is recognised by hand. Never run an unknown tool on a machine that is not yours.

Linux: classic vectors

Vector	Idea
sudo rights	`sudo -l`: a binary runnable as root that can be abused (see GTFOBins).
SUID binary	An executable that runs with its owner's rights, often root.
Cron job	A root script run periodically and writable, or an unprotected path.
Credentials	Cleartext passwords in configuration files, history, backups.
Capabilities	Overly broad Linux capabilities on a binary (e.g. cap_setuid).
Group or kernel	Membership of the docker, lxd, disk groups; outdated kernel or service.

id ; sudo -l                       # who am I, what can I run as root
find / -perm -4000 2>/dev/null     # SUID binaries
getcap -r / 2>/dev/null            # capabilities
cat /etc/crontab ; ls -la /etc/cron.*
grep -ri password /etc /var/www 2>/dev/null

Windows: classic vectors

Vector	Idea
Token privileges	`SeImpersonatePrivilege`, `SeBackupPrivilege`, `SeDebugPrivilege` that can be abused.
Misconfigured services	Unquoted service path, writable binary or folder, overly broad rights.
Scheduled tasks	A task running a writable script or binary.
Stored credentials	Unattend files, PowerShell history, Credential Manager, shares.
Always keep in mind	Vulnerable software installed, writable AutoRun key, AlwaysInstallElevated policy.

whoami /priv ; whoami /groups
systeminfo                         # version and patches
Get-Service ; schtasks /query /fo LIST /v
Get-ChildItem -Recurse env:        # variables, sometimes secrets

Defensive side

Apply least privilege, patch quickly, remove unnecessary sudo rights and SUID bits.
Monitor process creation (4688, Sysmon 1) and privilege assignment (4672).
See Windows logs and Sysmon and the Linux essentials sheet.