After the shell: privilege escalation
A shell is the middle of the challenge. Enumerate systematically, recognise the misconfiguration classes, and know what a Windows token actually grants.
By the end you can
- Enumerate a Linux host in a fixed order and explain what each step rules out
- Exploit SUID binaries, sudo rules and capabilities, and say which of the three is present from the evidence
- Escape a restricted shell and a limited PATH
- Read a Windows access token - user, groups, privileges, integrity level - and name what it permits
- Explain how impersonation converts one privilege into another account's authority
- Find persistence and scheduled execution as an attacker would, and as a defender would
1. Read
Linux privilege escalation: the shell is the middle of the challenge
A CTF that drops you on a box as a low-privileged user has only started. The enumeration order that finds the way up fast - SUID binaries, sudo rules, cron, capabilities, writable PATH - and how each one becomes root.
Windows privilege escalation: tokens, SIDs, and the impersonation shortcut
Windows boot2root boxes escalate differently from Linux. The access-token model that decides what you can do, the privileges worth having, and the service-account impersonation trick that turns SeImpersonate into SYSTEM.
2. Use the tools
In the order they come up while solving. Read what each one does, or go straight to the workspace tab that runs it.
- Reverse shell generator
Generate reverse shell one-liners for bash, nc, Python, Perl, Ruby, PHP, Node, and PowerShell, plus listeners and TTY stabilisation commands.
Open it in the workspace - Web attack payload catalog
Curated payloads for SQL injection, XSS, SSTI, SSRF, GraphQL, and deserialization, organised by what you are trying to establish.
Open it in the workspace - PowerShell deobfuscator
Peel -EncodedCommand, FromBase64String, [char] codes, format operators and backtick escapes off an obfuscated PowerShell command, and see what it actually does.
Open it in the workspace - Strings extractor for binaries and blobs
Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.
Open it in the workspace - ELF, PE and Mach-O binary analyzer
Parse headers, sections, imports, and symbols from Linux, Windows, and macOS binaries, with C++ symbol demangling and gadget discovery.
Open it in the workspace
3. Try one now
Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.
4. Practise on the real thing
Real picoCTF challenges that use these techniques, easiest first. 32 match in total - see the full index.
Common mistakes
The wrong turns this topic reliably produces. Written as the mistake rather than the rule, because the rule is easy to agree with and easy to walk straight past.
- Running an enumeration script and reading only the highlighted lines. The tool ranks by generic likelihood; the challenge's intended path is usually the odd entry it did not colour.
- Reading Administrator membership as authority on Windows. Privileges are per-token and can be disabled, and integrity level constrains what the token can touch regardless of groups.
- Assuming a writable file is a win. It matters only if something privileged reads it, and finding that reader is the actual work.
- Reading a sudo rule as safe because the binary looks harmless. Anything that writes a file, loads a plugin or spawns an editor is a shell, so the question about each entry is what it can be made to run, not what it is for.
- Escalating before establishing what the current shell already is. A container namespace, a restricted shell and a reduced capability set each change what root would even mean here, and escaping is a different problem from escalating.
Checkpoint
From an unprivileged shell, escalate to root or SYSTEM and write the path as a chain: what you found, why it was privileged, and what it let you do next.
Teaching note
Enumeration is boring and students skip it, then spend an hour on a guess. Make the first pass entirely enumeration with no exploitation allowed, and have them hand in the list before touching anything - the intended path is almost always already on the list.
Go deeper
The lessons above are written to get you through a challenge. These go after the subject instead. Each one opens our notes on that chapter - what it argues, what to take from it and where it stops - so this is somewhere to read now rather than a book to buy first. Nothing here is affiliate-linked or sold by us.
Chapter 8, Local Information Gathering
Black Hat Bash - Dolev Farhi and Nick Aleks
The enumeration checklist as shell code, which makes the order explicit rather than tribal.
Chapter 9, Privilege Escalation
Black Hat Bash - Dolev Farhi and Nick Aleks
The Linux misconfiguration classes, each with the check that detects it.
Chapter 4, Security Access Tokens
Windows Security Internals - James Forshaw
The authoritative account of what a token is, which is the object every Windows escalation manipulates.
Chapter 7, The Access Check Process
Windows Security Internals - James Forshaw
The algorithm that decides every allow or deny, so escalation stops being a list of tricks.
Every book the curriculum cites has a page in the library.