Advanced Privilege Escalation Techniques 101

From Operating System Internals to Enterprise and Cloud Compromise

Table of Contents

1. Part I: Foundations
2. Part II: Linux Privilege Escalation
3. Part III: Windows Privilege Escalation
4. Part IV: Mobile and Application Privilege Escalation
5. Part V: Container, Orchestration and Virtualization
6. Part VI: Identity and Cloud Privilege Escalation
7. Part VII: Defense and Synthesis
8. Conclusion
9. Back Matter

Introduction: The Art and Architecture of Privilege Escalation

1. The Book’s Promise
2. Scope and Assumptions
3. How This Book Is Structured
4. A Note on Technical Depth
5. Ethics and Authorization

Chapter 1: Foundations of Privilege Escalation

1. Defining Privilege: Users, Processes and Security Contexts
2. Classifications: Vertical, Horizontal, Local, Remote, Direct, Indirect
3. The Trust Boundary Model: Why Privilege Escalation Is Possible
4. Historical Context: From Unix to the Cloud Era
5. Privilege Escalation in the Red Team Lifecycle

Chapter 2: Systems Architecture and Trust Mechanisms

1. Process Security Contexts: UID, GID, Tokens, Capabilities, ACLs
2. Authentication vs Authorization: Identity Systems and Access Control Models
3. Mandatory vs Discretionary Access Control: SELinux, AppArmor, Mandatory Integrity Control
4. Kernel vs User Space: Ring Levels and System Calls
5. The Principle of Least Privilege: Theory vs Practice

Chapter 3: Methodology: Enumeration and Discovery

1. The Enumeration Mindset: What to Look For and How to Reason About Findings
2. System-Level Enumeration: Users, Groups, Processes, Services and Filesystems
3. Configuration and Policy Enumeration: Scheduled Tasks, Service Configs, Access Controls
4. Network and Trust Enumeration: Adjacent Systems, Credentials and Lateral Vectors
5. Automated vs Manual Enumeration: When to Use Each

Chapter 4: Linux Architecture and Local Privilege Escalation

1. The Linux Privilege Model: User, Group, Root and the init Process
2. SUID/SGID Abuse: Mechanics, Search Strategies and Abusable Binaries
3. Linux Capabilities: Design, Inheritance and Abuse Patterns
4. PATH Manipulation and Environment Variable Exploitation
5. Writable Files, Directories and Configuration Abuse

Chapter 5: Linux: Cron, Systemd and Daemon Exploitation

1. Cron Jobs: Misconfiguration Patterns and Exploitation
2. Systemd Services: Unit Files, Privilege Dropping Failures and Abuse
3. Logrotate and Daemon Config Abuse
4. Wildcard and Globbing Exploitation in Automated Scripts
5. TTY and Pseudo-Terminal Exploitation in Daemon Contexts

Chapter 6: Linux Kernel Vulnerabilities and Advanced Techniques

1. Kernel Memory and Privilege: The Significance of Ring 0
2. Use-After-Free and Heap Corruption in Kernel Context
3. Dirty COW, Dirty Pipe and Other Notable Kernel Exploits
4. Exploitation Constraints: KASLR, SMEP/SMAP and Kernel Hardening
5. Namespace and Cgroup Abuse as Non-Exploit Escalation

Chapter 7: Windows Architecture and Local Privilege Escalation

1. Windows Security Model: Users, Groups, Tokens and Integrity Levels
2. Local Administrator vs SYSTEM: The Highest Privilege Contexts
3. Writable Permissions and Path Vulnerabilities in Windows
4. Weak Registry Permissions and Privilege Escalation
5. DLL Hijacking and Search Order Hijacking: Mechanics and Variants

Chapter 8: Windows: Services, Scheduled Tasks and Token Abuse

1. Windows Service Misconfigurations: Start Permissions and Binary Paths
2. Impersonation Privileges: SeImpersonatePrivilege and Named Pipes
3. Scheduled Tasks: Misconfigurations and Privilege Escalation Paths
4. Token Manipulation: DuplicateToken, AdjustTokenPrivileges and Token Theft
5. AlwaysInstallElevated and MSI Installation Abuse

Chapter 9: Windows: UAC Bypass and Advanced Techniques

1. UAC Architecture: Why It Exists and How It Can Be Circumvented
2. Classic UAC Bypass Techniques: Fodhelper, CMSTP and Eventvwr
3. Token Manipulation for UAC Elevation
4. Kernel Driver Exploitation: Vulnerable Drivers and Signed Binary Abuse
5. Print Spooler and Named Pipe Exploitation in Modern Windows

Chapter 10: Android Architecture and Privilege Escalation

1. Android Security Architecture: Linux Kernel, UID Isolation and App Sandboxing
2. SELinux in Android: Enforcing Mode and Escalation Implications
3. Bootloader, Boot Image and Recovery Exploitation
4. Framework-Level Vulnerabilities and IPC Escalation
5. Zygote Process and Native Code Escalation

Chapter 11: Web Application Privilege Escalation

1. Web Application Access Control Models: RBAC, ABAC and Implementation Flaws
2. IDOR and Horizontal Privilege Escalation
3. Vertical Escalation: Broken Function-Level Authorization
4. Mass Assignment and Parameter Tampering for Role Elevation
5. Server-Side Execution Contexts and Application-to-System Escalation

Chapter 12: Database Privilege Escalation

1. Database Privilege Models: Roles, Grants and Ownership Chains
2. SQL Injection as a Privilege Escalation Path
3. Stored Procedure and Function Escalation
4. Database-Hosted Code Execution: xp_cmdshell, UDFs and Similar
5. Escalation from Database to Host Operating System

Chapter 13: Container Privilege Escalation and Escape

1. Container Security Model: Namespaces, cgroups and Shared Kernel
2. Privileged Containers: What They Mean and How to Exploit Them
3. Capabilities and Seccomp in Container Context
4. Volume Mount and Host Filesystem Escape
5. Container Runtime Exploitation: Docker, Containerd and CRI-O

Chapter 14: Kubernetes Privilege Escalation

1. Kubernetes Security Model: RBAC, ServiceAccounts and Pod Security
2. RBAC Misconfiguration: Over-Permissive Roles and ClusterRoles
3. ServiceAccount Token Abuse and Workload Identity Exploitation
4. Pod Escalation: Escaping to the Node and Beyond
5. Admission Controllers and Their Bypass Potential

Chapter 15: Virtualization and Hypervisor Escalation

1. Virtualization Architecture: Hypervisors, Guests and the Management Plane
2. VM Escape: The Ultimate Privilege Escalation
3. Device Emulation and VirtIO Exploitation
4. Hyper-V and KVM Escape Techniques
5. Escalation Through the Management Plane and APIs

Chapter 16: Active Directory: Trust, Identity and Domain Escalation

1. Active Directory Architecture: Domains, Trusts and Kerberos
2. Local Admin to Domain Admin: The Classic Escalation Path
3. Kerberos Exploitation: Golden Tickets, Silver Tickets and DCSync
4. GPO Abuse and Group Policy Privilege Escalation
5. Trust Relationships: From Child Domain to Forest Compromise

Chapter 17: Advanced AD Techniques: LAPS, ADFS and Enterprise Patterns

1. LAPS and Local Admin Password Management: Escalation Implications
2. ADFS and Claims-Based Authentication Escalation
3. Azure AD Connect and Hybrid Identity Escalation
4. Group Membership Escalation and ACL Abuse
5. Certificate Services and PKI Escalation Paths

Chapter 18: Cloud Foundations: IAM and Trust Models

1. Cloud IAM Fundamentals: Roles, Policies and Least Privilege
2. The Instance Metadata Service: Architecture and Abuse
3. Cross-Account and Cross-Service Trust: How Clouds Enable Escalation
4. Cloud-Native Identity: Workload Identity, Federated Identity and SPIFFE
5. Common Misconfiguration Patterns Across Cloud Platforms

Chapter 19: AWS Privilege Escalation

1. IAM Policy Evaluation Logic: How Permissions Are Calculated
2. Role Assumption Escalation: Passing Roles and Creating Roles
3. Service-Specific Escalation: EC2, S3, Lambda and IAM Actions
4. Instance Metadata Service Exploitation: IMDSv1 vs IMDSv2
5. Cross-Account Escalation and Organization-Level Compromise

Chapter 20: Azure and GCP Privilege Escalation

1. Azure RBAC: Role Definitions, Scope and Escalation Paths
2. Azure AD Privilege Escalation: Global Admin and Privileged Roles
3. Azure Managed Identities and VM Access Control
4. GCP IAM: Roles, Service Accounts and Escalation
5. Cross-Cloud and Hybrid Infrastructure Escalation

Chapter 21: Defense, Detection and Hardening

1. Detection Engineering: What Privilege Escalation Looks Like in Logs and SIEM
2. Behavioral Detection: Anomalies in Process Trees, Tokens and Permission Changes
3. Hardening Linux: CIS Benchmarks, Kernel Hardening and Capability Management
4. Hardening Windows: Constrained Language Mode, AMSI, Attack Surface Reduction
5. Cloud Hardening: IAM Policy Analysis, Least Privilege and Continuous Monitoring

Conclusion

The Evolving Landscape of Privilege Escalation

Integrating Privilege Escalation Expertise into Professional Practice

Responsible Use: Ethics, Authorization and Defensive Validation

Looking Ahead: Ephemeral Infrastructures, Post-Quantum and Zero Trust

Glossary

References