Privilege Escalation category

blog
68+ Note
Focus
OSCP · Red Team
Structure
Recon → Exploit

Privilege Escalation blog

Filters

  • Linux
    Recon & mapping

    Linux

    Basic commands, enumeration checklists, SUID, capabilities, and misconfig—all designed to help you find your way to root as quickly as possible.

    Discover more Discover more
  • Windows
    Recon & mapping

    Windows

    Abuse of services, registries, tokens, scheduled tasks and basic Active Directory knowledge to help you navigate enterprise environments.

    Discover more Discover more
  • Linux Persistence: Post-Exploitation Persistence Techniques
    linux

    Linux Persistence: Post-Exploitation Persistence Techniques

    A Guide to Linux Post-Exploitation Persistence: Systemd, Cron, SSH, Udev, LKM, Capabilities, and Other Persistence Mechanisms on Linux.

    Discover more Discover more
  • Kubernetes Pentesting: RBAC, Secrets, PrivEsc and Kubectl
    linux

    Kubernetes Pentesting: RBAC, Secrets, PrivEsc and Kubectl

    Kubernetes pentest: How a stolen token in a Pod leads, via RBAC and nodes/proxies, to privilege escalation and root shell on the node, with kubectl and cheatsheet.

    Discover more Discover more
  • Linux Enumeration: commands and tools for Privilege Escalation
    linux

    Linux Enumeration: commands and tools for Privilege Escalation

    Linux enumeration step-by-step: Use manual commands, SUID, sudo, capabilities, cron, LinPEAS, LinEnum, and LSE to detect privilege escalation vectors.

    Discover more Discover more
  • Linux Groups for Privilege Escalation: Docker, LXD, and Disk
    linux

    Linux Groups for Privilege Escalation: Docker, LXD, and Disk

    Linux privilege escalation via 40+ Linux groups: disk, Docker, LXD, Incus, MicroK8s, libvirt, shadow, video, adm, input, ssl-cert, KVM, sudo/wheel, lpadmin.

    Discover more Discover more
  • ESC17 ADCS: MITM attack on WSUS clients over HTTPS
    windows

    ESC17 ADCS: MITM attack on WSUS clients over HTTPS

    ESC17 ADCS uses controllable SANs to impersonate WSUS over HTTPS. Learn about certificate request with Certipy, MITM with wsuks, privesc, and detection.

    Discover more Discover more
  • HasSession BloodHound: Session Enumeration and Abuse
    web hacking

    HasSession BloodHound: Session Enumeration and Abuse

    HasSession BloodHound: Learn how to enumerate sessions with SharpHound and leverage tokens, credentials, and RDP, with Active Directory detection and mitigations.

    Discover more Discover more
  • SeEnableDelegationPrivilege: Privisce AD, S4U and delegation
    windows

    SeEnableDelegationPrivilege: Privisce AD, S4U and delegation

    What is SeEnableDelegationPrivilege, privilege escalation, unconstrained/constrained/RBCD variants, S4U2Self-S4U2Proxy, errors, detection and defense.

    Discover more Discover more
  • RBCD Attack : Resource-Based Constrained Delegation PrivEsc
    windows

    RBCD Attack : Resource-Based Constrained Delegation PrivEsc

    RBCD leverages write access on msDS-AllowedToActOnBehalfOfOtherIdentity for privilege escalation on active directory. Drive with Impacket, Rubeus and NTLM relay.

    Discover more Discover more
  • Shadow Credentials AD: PrivEsc msDS-KeyCredentialLink
    windows

    Shadow Credentials AD: PrivEsc msDS-KeyCredentialLink

    Shadow Credentials: Leverage msDS-KeyCredentialLink for passwordless AD account takeover. A practical guide with Whisker, pyWhisker, and Certipy for AD pentesting.

    Discover more Discover more
  • Windows Privilege Escalation 2026: A Complete Guide to Privilege Tokens (SE*)
    web hacking

    Windows Privilege Escalation 2026: A Complete Guide to Privilege Tokens (SE*)

    A comprehensive map of exploitable Windows privilege tokens in a pentest. From whoami /priv to SYSTEM: cheat sheets, tables, workflows, and links to how-to guides.

    Discover more Discover more
  • SeSystemEnvironmentPrivilege: PATH Hijacking and UEFI Persistence
    web hacking

    SeSystemEnvironmentPrivilege: PATH Hijacking and UEFI Persistence

    Leverages SeSystemEnvironmentPrivilege for PATH hijacking and SYSTEM shell. UEFI persistence that survives disk wipes. Red Team guidance with registry, Process Monitor, and Chipsec.

    Discover more Discover more
  • SeMachineAccountQuota and RBCD: Privilege a Domain Admin in 5 Commands
    windows

    SeMachineAccountQuota and RBCD: Privilege a Domain Admin in 5 Commands

    From standard domain user to Domain Admin using MachineAccountQuota=10 and RBCD. Create computer account, S4U tickets, DCSync. Red Team AD guidance and privilege escalation.

    Discover more Discover more
  • SeRelabelPrivilege: Bypass MIC and Write to File SYSTEM
    windows

    SeRelabelPrivilege: Bypass MIC and Write to File SYSTEM

    Learn how to use SeRelabelPrivilege to lower the integrity level of files and directories, bypass Mandatory Integrity Control, and gain a SYSTEM shell.

    Discover more Discover more
  • SeSecurityPrivilege: Clear Logs, SACLs, and SIEM Evasion
    windows

    SeSecurityPrivilege: Clear Logs, SACLs, and SIEM Evasion

    How to use SeSecurityPrivilege to read and delete the Security Log, remove SACLs, and operate invisibly on Windows. Red Team OpSec guide with SIEM verification.

    Discover more Discover more
  • SeTrustedCredManAccessPrivilege: RDP Dump and Vault with Mimikatz
    web hacking

    SeTrustedCredManAccessPrivilege: RDP Dump and Vault with Mimikatz

    Extract RDP passwords and credentials from Credential Manager with SeTrustedCredManAccessPrivilege. Use cmdkey, mimikatz, and SharpDPAPI. Step-by-step Red Team guide.

    Discover more Discover more
  • LinPEAS: Automated Linux Privilege Escalation and Enumeration
    linux

    LinPEAS: Automated Linux Privilege Escalation and Enumeration

    Learn how to use LinPEAS for Linux privilege escalation enumeration: SUID, sudo, cron, capabilities, kernel exploits, PATH hijacking, and CTF scenarios with real command examples.

    Discover more Discover more
  • SeTcbPrivilege: Arbitrary LSA Logon Session to SYSTEM
    windows

    SeTcbPrivilege: Arbitrary LSA Logon Session to SYSTEM

    Found SeTcbPrivilege on a non-system account? Create LSA sessions with SID Domain Admins and get SYSTEM without external conditions. Red Team Technique.

    Discover more Discover more
  • SeCreateTokenPrivilege: Token Forgery from Zero to SYSTEM
    windows

    SeCreateTokenPrivilege: Token Forgery from Zero to SYSTEM

    Found SeCreateTokenPrivilege on a non-system account? Create tokens with SID SYSTEM and Domain Admins from scratch. NtCreateToken for SYSTEM shell. Red Team technique.

    Discover more Discover more
  • SeDelegateSessionUserImpersonatePrivilege: Cross-Session Token Stealing on RDS and Citrix
    web hacking

    SeDelegateSessionUserImpersonatePrivilege: Cross-Session Token Stealing on RDS and Citrix

    How to exploit SeDelegateSessionUserImpersonatePrivilege to impersonate users in active RDS sessions. Cross-session token stealing with NtObjectManager. Privesc and Red Team techniques.

    Discover more Discover more
  • SeManageVolumePrivilege: Raw Disk for SAM and NTDS.dit without lock
    windows

    SeManageVolumePrivilege: Raw Disk for SAM and NTDS.dit without lock

    How to use SeManageVolumePrivilege and RawCopy to extract SAM, SYSTEM, and NTDS.dit from the physical disk, bypassing locks and ACLs. Red Team technique with raw device access.

    Discover more Discover more
  • SeCreateSymbolicLinkPrivilege: Symlink Attack on Windows from Shell
    windows

    SeCreateSymbolicLinkPrivilege: Symlink Attack on Windows from Shell

    From simple user to SYSTEM by replacing system files with a symlink: what you can do with SeCreateSymbolicLinkPrivilege and mklink. Privilege escalation and the Red Team technique.

    Discover more Discover more
  • SeTakeOwnershipPrivilege: From Admin to SYSTEM with 3 Commands
    windows

    SeTakeOwnershipPrivilege: From Admin to SYSTEM with 3 Commands

    How to abuse SeTakeOwnershipPrivilege to take ownership of system binaries and gain the SYSTEM shell. takeown + icacls + binary replacement. Red Team technique.

    Discover more Discover more
  • SeDebugPrivilege: Privilege Escalation with Dump LSASS with LOLBins
    web hacking

    SeDebugPrivilege: Privilege Escalation with Dump LSASS with LOLBins

    SeDebugPrivilege Enabled? Two commands to dump LSASS and get NTLM hashes. All with Windows' built-in comsvcs.dll, no disk mimikatz. Red Team technical guide.

    Discover more Discover more
  • SeRestorePrivilege: From Backup Operator to SYSTEM in 3 Steps
    windows

    SeRestorePrivilege: From Backup Operator to SYSTEM in 3 Steps

    How to abuse SeRestorePrivilege to overwrite system binaries and gain SYSTEM shell. ImagePath hijacking, DLL sideloading, persistent backdoor. Red Team technique.

    Discover more Discover more
  • SeBackupPrivilege: Hash dump and full domain with SAM, SYSTEM and NTDS.dit
    windows

    SeBackupPrivilege: Hash dump and full domain with SAM, SYSTEM and NTDS.dit

    PrivEsc with SeBackupPrivilege on Windows and Active Directory: SAM, SYSTEM, and SECURITY extraction, offline dump with secretsdump, access to NTDS.dit, and real-world impact on compromised domains.

    Discover more Discover more
  • SeAssignPrimaryTokenPrivilege: Bypassing Potato Attacks Even Without SeImpersonatePrivilege
    windows

    SeAssignPrimaryTokenPrivilege: Bypassing Potato Attacks Even Without SeImpersonatePrivilege

    Privilege escalation with SeAssignPrimaryTokenPrivilege and potato attack bypass on Windows: privilege verification, exploits with GodPotato, JuicyPotato, and SweetPotato, real-world scenarios, common pitfalls, and mitigations.

    Discover more Discover more
  • SeImpersonatePrivilege: Privesc and Potato Attack up to SYSTEM
    web hacking

    SeImpersonatePrivilege: Privesc and Potato Attack up to SYSTEM

    SeImpersonatePrivilege explained with Potato attacks: from IIS or SQL Server to SYSTEM, privilege escalation windows with modern tools used in labs.

    Discover more Discover more
  • SeLoadDriverPrivilege: Kernel Ring-0 with BYOVD in 3 Steps
    windows

    SeLoadDriverPrivilege: Kernel Ring-0 with BYOVD in 3 Steps

    SeLoadDriverPrivilege Enabled? Loads a vulnerable driver into the kernel, executes ring-0 code, disables EDR, and bypasses LSASS PPL. Help BYOVD with Capcom.sys and EDRSandBlast.

    Discover more Discover more
  • Fail2Ban Privilege Escalation: Linux Exploit to Gain Root
    linux

    Fail2Ban Privilege Escalation: Linux Exploit to Gain Root

    Learn how to exploit a Fail2Ban misconfiguration, what it is, and how to gain root on Linux: enumeration, exploit, ban triggers, detection, and hardening.

    Discover more Discover more
  • ESC15 ADCS (CVE-2024-49019): EKUwu and Injection of Application Policies
    windows

    ESC15 ADCS (CVE-2024-49019): EKUwu and Injection of Application Policies

    ESC15 (CVE-2024-49019) allows Application Policies to be injected into unpatched AD CS V1 templates. An attacker can obtain Client Authentication or Enrollment Agent.

    Discover more Discover more
  • ESC16 ADCS: CA with SID Security Extension Disabled
    windows

    ESC16 ADCS: CA with SID Security Extension Disabled

    ESC16 exploits a CA configured not to include the SID Security Extension in certificates. This weakens the certificate mapping and may allow impersonation.

    Discover more Discover more
  • ESC10 ADCS: Privilege Escalation via Weak Certificate Mapping Schannel
    windows

    ESC10 ADCS: Privilege Escalation via Weak Certificate Mapping Schannel

    ESC10 uses weak certificate mapping in Schannel to impersonate AD accounts via LDAPS. A practical guide with Certipy and UPN manipulation.

    Discover more Discover more
  • ESC11 ADCS: NTLM Relay to Certificate Authority RPC Enrollment
    windows

    ESC11 ADCS: NTLM Relay to Certificate Authority RPC Enrollment

    ESC11 uses NTLM relay to the AD CS RPC interface when the CA doesn't require encryption. A practical guide to obtaining privileged certificates using Certipy.

    Discover more Discover more
  • ESC12 ADCS: CA Compromised via YubiHSM2
    windows

    ESC12 ADCS: CA Compromised via YubiHSM2

    ESC12 concerns vulnerabilities in the YubiHSM2 stack used by AD CS. If the CA's private key is compromised, an attacker can forge Golden Certificates.

    Discover more Discover more
  • ESC13 ADCS: Privilege Escalation via Issuance Policy OID
    windows

    ESC13 ADCS: Privilege Escalation via Issuance Policy OID

    ESC13 leverages Issuance Policy OIDs linked to Active Directory groups. A certificate can add privileged SIDs to the Kerberos TGT and lead to Domain Admin.

    Discover more Discover more
  • ESC14 ADCS: Weak Explicit Certificate Mapping via altSecurityIdentities
    windows

    ESC14 ADCS: Weak Explicit Certificate Mapping via altSecurityIdentities

    ESC14 exploits weak altSecurityIdentities configurations in Active Directory. A certificate can be mapped to a privileged account and allow impersonation.

    Discover more Discover more
  • ESC8 ADCS: NTLM Relay versus Web Enrollment for Domain Admin
    windows

    ESC8 ADCS: NTLM Relay versus Web Enrollment for Domain Admin

    ESC8 privilege escalation, leverages NTLM Relay against AD CS /certsrv/ endpoints to obtain privileged certificates. A practical guide with Certipy and NTLM coercion.

    Discover more Discover more
  • ESC9 ADCS: Privilege Escalation via Template without SID Security Extension
    windows

    ESC9 ADCS: Privilege Escalation via Template without SID Security Extension

    ESC9 uses AD CS templates without the SID Security Extension to impersonate privileged users. A practical guide with Certipy and UPN manipulation.

    Discover more Discover more
  • ESC3 ADCS Privilege Escalation: Exploit Active Directory with Certipy
    windows

    ESC3 ADCS Privilege Escalation: Exploit Active Directory with Certipy

    ESC3 ADCS Privilege Escalation: Leverage templates with EKU Certificate Request Agent to request on-behalf-of certificates and get Domain Admin with Certipy.

    Discover more Discover more
  • ESC4 ADCS Privilege Escalation: Template Hijacking with Certipy
    windows

    ESC4 ADCS Privilege Escalation: Template Hijacking with Certipy

    ESC4 ADCS Privilege Escalation: Exploit weak ACLs on Active Directory certificate templates to transform them into ESC1 and gain Domain Admin with Certipy.

    Discover more Discover more
  • ESC5 ADCS Privilege Escalation: Golden Certificate and CA Compromise with Certipy
    windows

    ESC5 ADCS Privilege Escalation: Golden Certificate and CA Compromise with Certipy

    ESC5 ADCS Privilege Escalation: Compromising Active Directory PKI and forging Golden Certificate via CA private key using Certipy.

    Discover more Discover more
  • ESC6 ADCS Privilege Escalation: SAN Injection via CA Flag (Certipy Exploit)
    windows

    ESC6 ADCS Privilege Escalation: SAN Injection via CA Flag (Certipy Exploit)

    ESC6 ADCS Privilege Escalation: Exploiting the EDITF_ATTRIBUTESUBJECTALTNAME2 flag on the CA to inject arbitrary SANs and impersonate Active Directory users with Certipy.

    Discover more Discover more
  • ESC7 ADCS: Privilege Escalation Via Manage CA on Active Directory
    windows

    ESC7 ADCS: Privilege Escalation Via Manage CA on Active Directory

    ESC7 on AD CS allows privilege escalation by abusing the Manage CA and Manage Certificates permissions. A practical guide with Certipy for obtaining Administrator certificates.

    Discover more Discover more
  • AD CS Privilege Escalation: All ESC1–ESC16 Techniques with Certipy (Active Directory Attack Guide)
    windows

    AD CS Privilege Escalation: All ESC1–ESC16 Techniques with Certipy (Active Directory Attack Guide)

    AD CS Privilege Escalation on Active Directory: A Complete Guide to ESC1–ESC16 Techniques with Certipy. Learn how to gain Domain Admin by exploiting misconfigured certificate templates and CAs.

    Discover more Discover more
  • ESC1 ADCS Privilege Escalation: Exploit Active Directory with Certipy
    windows

    ESC1 ADCS Privilege Escalation: Exploit Active Directory with Certipy

    ESC1 ADCS Privilege Escalation: How to Exploit Vulnerable Certificate Templates in Active Directory with Certipy. A practical step-by-step guide to gaining Domain Admin.

    Discover more Discover more
  • ESC2 ADCS Privilege Escalation: Exploit Active Directory with Certipy
    windows

    ESC2 ADCS Privilege Escalation: Exploit Active Directory with Certipy

    ESC2 ADCS Privilege Escalation: Leverage templates with EKU Any Purpose or without EKU to get Enrollment Agent and Domain Admin with Certipy.

    Discover more Discover more
  • linux

    Linux PrivEsc: Real root escalation techniques

    Linux PrivEsc: Real-world privilege escalation techniques for gaining root. Practical workflow from real-world CTFs and pentests.

    Discover more Discover more
  • Container Escape: Privilege Escalation Docker and Kubernetes
    linux

    Container Escape: Privilege Escalation Docker and Kubernetes

    Container Escape: Docker sockets, privileged containers, Linux capabilities, Kubernetes, kernel exploits, and IMDS. Privilege escape techniques, detection, and defense.

    Discover more Discover more
  • Kernel Exploits: Real Privesc on Linux and Windows
    linux

    Kernel Exploits: Real Privesc on Linux and Windows

    Kernel exploits: real-world privilege escalation techniques on Linux and Windows. From theory to practical lab exploits.

    Discover more Discover more
  • Seatbelt: Windows Enumeration for Post-Exploitation and Situational Awareness
    windows

    Seatbelt: Windows Enumeration for Post-Exploitation and Situational Awareness

    Seatbelt is a Windows enumeration tool that collects system, user, privilege, and configuration information useful for privilege escalation.

    Discover more Discover more
  • SharpChrome: Dump Browser Credentials from Windows (DPAPI Abuse)
    windows

    SharpChrome: Dump Browser Credentials from Windows (DPAPI Abuse)

    SharpChrome: Dump Browser Credentials from Windows (DPAPI Abuse)

    Discover more Discover more
  • SharpDPAPI: DPAPI Abuse to Decrypt Credentials on Windows
    windows

    SharpDPAPI: DPAPI Abuse to Decrypt Credentials on Windows

    SharpDPAPI allows you to extract and decrypt DPAPI-protected credentials on Windows. This advanced tool is for credential access and lateral movement.

    Discover more Discover more
  • SharpUp: Commands and Checks for Windows Privilege Escalation
    windows

    SharpUp: Commands and Checks for Windows Privilege Escalation

    SharpUp (GhostPack) Guide: Commands, real-world checks (ModifiableServices, AlwaysInstallElevated, DLL hijacking), and how to exploit them for privilege escalation on Windows.

    Discover more Discover more
  • Sherlock: Automated Windows Privilege Escalation Checker
    windows

    Sherlock: Automated Windows Privilege Escalation Checker

    Sherlock identifies privilege escalation vulnerabilities on Windows by comparing installed patches and known CVEs. A quick tool for local privilege discovery.

    Discover more Discover more
  • Pspy: Monitor Linux Processes Without Root Privileges
    linux

    Pspy: Monitor Linux Processes Without Root Privileges

    Pspy is a tool for observing processes and cron jobs running on Linux without root privileges. It's ideal for identifying privilege escalation vectors.

    Discover more Discover more
  • LSE (Linux Smart Enumeration): Automated Linux Privilege Escalation Checklist
    tools

    LSE (Linux Smart Enumeration): Automated Linux Privilege Escalation Checklist

    LSE (Linux Smart Enumeration): Automated Linux Privilege Escalation Checklist

    Discover more Discover more
  • Lynis: Linux Security Auditing and Hardening Tool
    linux

    Lynis: Linux Security Auditing and Hardening Tool

    Lynis is an auditing tool for Unix/Linux systems that analyzes configurations, permissions, patches, and hardening. Ideal for penetration testers and blue teams.

    Discover more Discover more
  • Mimipenguin: Dump Linux Credentials from Memory (Post-Exploitation)
    linux

    Mimipenguin: Dump Linux Credentials from Memory (Post-Exploitation)

    Mimipenguin is a post-exploitation script for Linux that extracts cleartext passwords from the memory of processes such as SSH, sudo, and display managers.

    Discover more Discover more
  • JAWS: Windows Post-Exploitation Enumeration for Privilege Escalation
    windows

    JAWS: Windows Post-Exploitation Enumeration for Privilege Escalation

    JAWS is a PowerShell script for automatic enumeration on compromised Windows hosts, useful for identifying misconfigurations and privilege escalation vectors.

    Discover more Discover more
  • LinEnum: Linux Enumeration Script for Privilege Escalation
    linux

    LinEnum: Linux Enumeration Script for Privilege Escalation

    LinEnum is a Bash script for automatic enumeration on Linux systems, useful for identifying privilege escalation vectors post-exploitation.

    Discover more Discover more
  • LinPEAS: Linux Privilege Escalation Enumeration Script
    linux

    LinPEAS: Linux Privilege Escalation Enumeration Script

    LinPEAS is an automatic enumeration script for Linux that identifies SUIDs, capabilities, exposed credentials, and privilege escalation vectors.

    Discover more Discover more
  • GTFOBins: Linux Binary Abuse for Privilege Escalation
    linux

    GTFOBins: Linux Binary Abuse for Privilege Escalation

    GTFOBins is the definitive database for exploiting legitimate Linux binaries to escalate privilege, bypass sudo, and escape shells in authorized labs.

    Discover more Discover more
  • Getcap: Linux Capabilities for Privilege Escalation
    linux

    Getcap: Linux Capabilities for Privilege Escalation

    Getcap allows you to detect files with Linux capabilities to identify privilege escalation vectors without SUID. This is a key post-exploitation technique.

    Discover more Discover more
  • Chkrootkit: Rootkit Detection on Linux for Incident Response and Post-Exploitation Analysis
    linux

    Chkrootkit: Rootkit Detection on Linux for Incident Response and Post-Exploitation Analysis

    Chkrootkit is a Linux tool for detecting rootkits and indicators of compromise on Unix-like systems. It is used in incident response and post-exploitation analysis to verify persistence and backdoors.

    Discover more Discover more
  • Scheduled Task Backdoor: Windows Persistence with Scheduled Tasks in Pentest
    windows

    Scheduled Task Backdoor: Windows Persistence with Scheduled Tasks in Pentest

    Scheduled Task Backdoor: Persistence on Windows via Task Scheduler with schtasks and PowerShell. Stealth techniques, EDR evasion, log detection, and real-world Red Team scenarios.

    Discover more Discover more
  • Crontab Backdoor: Linux Persistence with Cron Jobs in Penetration Testing
    linux

    Crontab Backdoor: Linux Persistence with Cron Jobs in Penetration Testing

    Crontab Backdoor: A practical guide to creating Linux persistence with cron jobs in penetration testing. Complete setup, evasion, and cleanup.

    Discover more Discover more