After the shell: privilege escalation

Before the session

• Nothing to install. Students need a browser and https://ctfpal.com. Confirm the room can reach it once; after that it works offline.
• Read the lesson yourself first - about 11 minutes.
• Have one worked example ready to paste. The classroom link builder on the instructor page turns it into a URL that opens preloaded.

Objectives

Written as things a student can do afterwards, so they can be assessed rather than asserted.

1. Enumerate a Linux host in a fixed order and explain what each step rules out
2. Exploit SUID binaries, sudo rules and capabilities, and say which of the three is present from the evidence
3. Escape a restricted shell and a limited PATH
4. Read a Windows access token - user, groups, privileges, integrity level - and name what it permits
5. Explain how impersonation converts one privilege into another account's authority
6. Find persistence and scheduled execution as an attacker would, and as a defender would

Running order (90 min)

Tools used

• Reverse shell generator - Generate reverse shell one-liners for bash, nc, Python, Perl, Ruby, PHP, Node, and PowerShell, plus listeners and TTY stabilisation commands.https://ctfpal.com/?tool=reverse-shell-generator
• Web attack payload catalog - Curated payloads for SQL injection, XSS, SSTI, SSRF, GraphQL, and deserialization, organised by what you are trying to establish.https://ctfpal.com/?tool=payload-catalog
• PowerShell deobfuscator - Peel -EncodedCommand, FromBase64String, [char] codes, format operators and backtick escapes off an obfuscated PowerShell command, and see what it actually does.https://ctfpal.com/?tool=powershell-deobfuscator
• Strings extractor for binaries and blobs - Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.https://ctfpal.com/?tool=strings-extractor
• ELF, PE and Mach-O binary analyzer - Parse headers, sections, imports, and symbols from Linux, Windows, and macOS binaries, with C++ symbol demangling and gadget discovery.https://ctfpal.com/?tool=elf-pe-analyzer

Reading

• Linux privilege escalation: the shell is the middle of the challenge - 6 min. A CTF that drops you on a box as a low-privileged user has only started. The enumeration order that finds the way up fast - SUID binaries, sudo rules, cron, capabilities, writable PATH - and how each one becomes root.
• Windows privilege escalation: tokens, SIDs, and the impersonation shortcut - 5 min. Windows boot2root boxes escalate differently from Linux. The access-token model that decides what you can do, the privileges worth having, and the service-account impersonation trick that turns SeImpersonate into SYSTEM.

Practice set

Real picoCTF challenges tagged with this module’s techniques, easiest first. Assign the first three in class and the rest as homework.

1. FANTASY CTF - picoCTF 2025, easy
2. First Find - picoGym Exclusive, easy
3. Log Hunt - picoMini by CMU-Africa, easy
4. Magikarp Ground Mission - picoCTF 2021, easy
5. Piece by Piece - picoCTF 2026, easy
6. SUDO MAKE ME A SANDWICH - picoCTF 2026, easy
7. Super SSH - picoCTF 2024, easy
8. Tab, Tab, Attack - picoCTF 2021, easy
9. ABSOLUTE NANO - picoCTF 2026, medium
10. chrono - picoCTF 2023, medium
11. CVE-XXXX-XXXX - picoCTF 2022, medium
12. Powershelly - picoCTF 2021, hard

Checkpoint (gradeable)

From an unprivileged shell, escalate to root or SYSTEM and write the path as a chain: what you found, why it was privileged, and what it let you do next.

Deliberately a produced artefact rather than a quiz question: it is either there or it is not, which makes it fast to mark and hard to bluff. Every tool in ctfpal is deterministic, so two students who did the work correctly hand in the same value.

Where the room gets stuck

Enumeration is boring and students skip it, then spend an hour on a guess. Make the first pass entirely enumeration with no exploitation allowed, and have them hand in the list before touching anything - the intended path is almost always already on the list.

• Running an enumeration script and reading only the highlighted lines. The tool ranks by generic likelihood; the challenge's intended path is usually the odd entry it did not colour.
• Reading Administrator membership as authority on Windows. Privileges are per-token and can be disabled, and integrity level constrains what the token can touch regardless of groups.
• Assuming a writable file is a win. It matters only if something privileged reads it, and finding that reader is the actual work.
• Reading a sudo rule as safe because the binary looks harmless. Anything that writes a file, loads a plugin or spawns an editor is a shell, so the question about each entry is what it can be made to run, not what it is for.
• Escalating before establishing what the current shell already is. A container namespace, a restricted shell and a reduced capability set each change what root would even mean here, and escaping is a different problem from escalating.

If a student wants the subject, not the answer

Chapter-level references, so a student can be pointed at twenty pages rather than at a book. Nothing here is required to complete the module.

• Black Hat Bash, Dolev Farhi and Nick Aleks. Chapter 8, Local Information Gathering. The enumeration checklist as shell code, which makes the order explicit rather than tribal.
• Black Hat Bash, Dolev Farhi and Nick Aleks. Chapter 9, Privilege Escalation. The Linux misconfiguration classes, each with the check that detects it.
• Windows Security Internals, James Forshaw. Chapter 4, Security Access Tokens. The authoritative account of what a token is, which is the object every Windows escalation manipulates.
• Windows Security Internals, James Forshaw. Chapter 7, The Access Check Process. The algorithm that decides every allow or deny, so escalation stops being a list of tricks.

If you finish early

• Hand out a challenge from the cross-CTF index in this category - each one has published solutions to compare afterwards.
• Run the same input through Identify and let the class argue with the ranking. Disagreeing with a confidence score is where the technique actually lands.
• Ask a student to break their own example - construct an input that defeats the tool, and explain why.