166 terms · 75/46/45
Threat № 020 · class: identity

Privilege Escalation

Privilege escalation is the attempt by an attacker who already holds some level of access to widen their rights in order to move through the network. Escalation is rarely the first stage — it comes after entry through, say, an ordinary user account or a compromised service. It takes the attacker from the crack they slipped through to control of the whole system. There are two directions: vertical escalation, from an ordinary user to domain administrator, and horizontal, moving from one account to another user's resources at the same level of rights.

Term

description · examples · notes

Privilege escalation is the attempt by an attacker who already holds some level of access to widen their rights in order to move through the network. Escalation is rarely the first stage — it comes after entry through, say, an ordinary user account or a compromised service. It takes the attacker from the crack they slipped through to control of the whole system. There are two directions: vertical escalation, from an ordinary user to domain administrator, and horizontal, moving from one account to another user's resources at the same level of rights.

Description

The way up is found wherever the protection gives way. Most often it is vulnerabilities in the operating system or in software, wrong configurations, overly broad file permissions, and services running with more rights than they need. Leftover credentials and forgotten administrator accounts are frequent prizes. Each of those mistakes is a shortcut from a lower level of authority to a higher one.

The defense is built on least privilege: every account and every service gets exactly the rights the work requires, not a crumb more. With it go regular updates that close known vulnerabilities, hardened configurations, separate handling of administrator accounts, and monitoring of privileged actions. The point is to limit the reach of the break-in — if an account has limited rights, an attacker holding it has limited effect.

Examples

  • Exploiting a vulnerability in the operating system kernel to go from an ordinary user account to full control of the machine.
  • Abusing a misconfigured application that runs under the SYSTEM account, where the attacker inherits the rights of the corrupted service.
  • Editing a service startup script which, through a mistake in the permissions, an unprivileged user can also change.

Notes

  • Escalation is the attacker's magic potion — every account taken brings them closer to full control of the network, which is why the compromise of an ordinary user account is not a case to underestimate.
  • A least-privilege policy is the most effective defense: what an account cannot do, an attacker cannot do either.

Mentioned in the news

tags
privilege escalation post exploitation
◳Composite
↗Wikipedia

Techniques

carried out with 8

Techniques used to carry it out. Select one to open its page.

Defenses

countered by 4

How it is defended against. Select one to open its page.