What is the difference between vertical and horizontal privilege escalation?

Vertical privilege escalation moves upward to a higher privilege level, such as a standard user becoming root on Linux or SYSTEM on Windows. Horizontal privilege escalation moves sideways to another account at the same privilege level, gaining access to resources that were not theirs. Real attacks often chain both, moving horizontally to an account that happens to have a path upward.

What are common privilege escalation techniques?

Common vectors include misconfigurations like overly permissive file permissions or weak service settings, vulnerable kernel and privileged software, credentials exposed in scripts or configuration files, and abusing legitimate features in unintended ways. On Linux these include misconfigured sudo rules and SUID binaries, while on Windows they include unquoted service paths and writable service binaries. Escalation almost always exploits something the system's owner overlooked.

Why is enumeration important in privilege escalation?

Enumeration, the methodical inventorying of a system to find the one weakness that provides a path upward, is the single most important skill in privilege escalation. Attackers who rush to run exploits usually fail, while those who patiently map the environment succeed. It answers questions like what runs as root, which files are writable, and what credentials are lying around.

How can organizations defend against privilege escalation?

Because escalation exploits oversights, defense is largely disciplined system hygiene: apply least privilege, patch the kernel and privileged software promptly, and harden configurations against secure baselines. Protect credentials with secret managers, monitor and alert on privilege-related events, and segment access to limit how far one compromised account can reach. Reviewing permission grants regularly closes paths before they can be abused.

How can I practice privilege escalation legally?

Practice only in environments designed for it, such as intentionally vulnerable virtual machines, capture the flag challenges, and dedicated home labs where you control every host. Using these techniques against systems you do not own or lack permission to test is illegal. When privilege escalation is part of a real engagement, it must fall inside a signed scope and feed a responsible disclosure process.

⚔ Offensive Security

Privilege Escalation Explained

Q: What is privilege escalation?

Privilege escalation is the process by which an attacker or authorized tester with limited access to a system elevates that access to a higher level of control. Since an initial foothold rarely lands on an administrator or root account directly, they exploit misconfigurations, software flaws, or design weaknesses to climb toward full control. It is a defining step in the post-exploitation phase of ethical hacking.

Privilege escalation is the process by which an attacker or authorized tester who has gained limited access to a system elevates that access to a higher level of control. Rarely does an initial foothold land directly on an administrator or root account; instead, attackers exploit misconfigurations, software flaws, or design weaknesses to climb from a low-privilege user toward full control. Understanding privilege escalation, often abbreviated "privesc," is essential for anyone studying post-exploitation in ethical hacking.

What Is Privilege Escalation?

Operating systems enforce access control by assigning each user, process, and file a level of privilege. A standard user cannot read another user's private files or change system settings; only privileged accounts can. Privilege escalation defeats these boundaries, letting a low-level account perform actions it should not be able to.

In an authorized penetration test, privesc is what turns a minor foothold into a demonstration of serious impact. Proving that a single compromised web-server account can become domain administrator is far more compelling to stakeholders than the initial entry alone. It is a defining step in the post-exploitation phase and in the later stages of the cyber kill chain.

Vertical vs Horizontal Privilege Escalation

Privilege escalation comes in two fundamental directions:

Vertical privilege escalation moves *upward* to a higher privilege level, such as a standard user becoming root on Linux or SYSTEM on Windows. This is the classic "get admin" scenario and usually the most impactful.
Horizontal privilege escalation moves *sideways* to another account at the same privilege level, such as accessing a different user's data or session. While the privilege tier does not increase, the attacker gains access to resources that were not theirs, which can be equally damaging.

Real attacks often chain both: an attacker might move horizontally to an account that happens to have a path to vertical escalation.

Common Privilege Escalation Vectors

Escalation almost always exploits something the system's owner overlooked. Broad categories include:

Misconfigurations — overly permissive file permissions, weak service settings, or accounts granted more rights than they need.
Vulnerable software — flaws in the kernel or in privileged programs that allow arbitrary code execution at a higher level.
Credential exposure — passwords, tokens, or keys left in scripts, configuration files, memory, or command history.
Abusing legitimate features — using intended functionality in unintended ways to run commands as a privileged account.

Linux Vectors

On Linux, common paths include misconfigured sudo rules that let a user run a program as root, SUID binaries that execute with owner privileges, writable files in privileged paths, exposed credentials, and outdated kernels susceptible to known local exploits. Scheduled cron jobs running as root with insecure permissions are another frequent finding.

Windows Vectors

On Windows, testers examine unquoted service paths, services whose binaries or registry keys are writable by low-privilege users, stored credentials, excessive token privileges, and vulnerable drivers. Misconfigured access controls on scheduled tasks and services are recurring themes.

Enumeration Comes First

The single most important skill in privilege escalation is enumeration — methodically inventorying the system to find the one weakness that provides a path upward. Attackers who rush to run exploits usually fail; those who patiently map the environment succeed. Enumeration answers questions like: What privileges does this account already hold? What runs as root or SYSTEM? What files are writable? What credentials are lying around?

In an authorized lab, a tester's first step is often to review their own permissions:

# On an authorized lab machine, list your available sudo rights
sudo -l

Automated enumeration scripts accelerate this discovery, but they only surface candidates. A human still has to interpret the output and decide which path is safe and viable.

Defending Against Privilege Escalation

Because escalation exploits oversights, strong defense is largely about disciplined system hygiene:

Apply least privilege. Give every user and service only the rights they genuinely need, and review those grants regularly.
Patch promptly. Keep the kernel and privileged software updated to close known local-exploit paths.
Harden configurations. Audit sudo rules, service permissions, SUID binaries, and file access controls against secure baselines.
Protect credentials. Never store plaintext secrets in scripts or config files; use secret managers and rotate keys.
Monitor and alert. Log privilege-related events and watch for anomalies such as unexpected use of administrative rights.
Segment access. Limit how far a single compromised account can reach across the environment.

Practicing Legally

Privilege escalation techniques are powerful and, used against systems you do not own or lack permission to test, illegal. The ethical way to build these skills is in environments designed for it: intentionally vulnerable virtual machines, capture the flag challenges, and dedicated home labs where you control every host. These give you unlimited freedom to experiment, break things, and learn without legal or ethical risk.

Whenever privesc is part of a real engagement, it must fall inside a signed scope, avoid causing damage, and feed into a responsible disclosure process that helps the owner fix the underlying weaknesses.

Key Takeaways

Privilege escalation elevates limited access into higher control, turning a minor foothold into serious demonstrated impact.
Vertical escalation moves up to a higher privilege level, while horizontal escalation moves sideways to another account.
Common vectors include misconfigurations, vulnerable kernel and privileged software, and exposed credentials on both Linux and Windows.
Enumeration is the core skill — patiently mapping the system reveals the one path upward.
Defenders rely on least privilege, patching, hardening, credential protection, and monitoring, and learners should practice only in labs and CTFs.

privilege-escalationpost-exploitationprivescaccess-controllocal-exploitation