EMZETT.
Login

Emzett Wiki

Privilege escalation and system hardening: understanding privilege escalation

Properties1
tagsglossar, systemsicherheit, härtung

2 min read

Privilege escalation and system hardening: understanding privilege escalation

In short: In privilege escalation an attacker with low rights gains higher rights (e.g. root or administrator); hardening reduces attack surface and wrong permissions so that this fails.

In more detail: An attacker often lands first as an unprivileged user (hacked web service, phishing). The next step is privilege escalation (PrivEsc). This article names typical causes and above all countermeasures for your own systems.

In Depth

Types

  • Vertical: normal user → administrator/root.
  • Horizontal: access to other users’ data at the same level (IDOR, broken access control).
  • Typical causes (Linux): insecure sudo rules, SUID files, writable scripts/cron jobs run as root, kernel flaws, container escape (privileged containers, Docker socket mounted), capabilities, weak file permissions (SSH keys, backups), passwords in config files/history.
  • Windows: unquoted service paths, weak service/registry permissions, AlwaysInstallElevated, token abuse, driver flaws, stored credentials, weak Active Directory delegation.
  • Cloud: overly broad IAM roles, metadata service (SSRF), secrets in environment variables.

Hardening Linux

  • Least privilege: services under own users without shell, sudoers narrow (no shell-escape programs), avoid NOPASSWD.
  • Updates/patches (kernel, packages), remove unneeded services and packages.
  • Check file permissions (find / -perm -4000 -type f SUID list, -perm -o+w), umask 027.
  • SSH: keys, no root login, Fail2ban.
  • Mandatory access control: AppArmor/SELinux, seccomp, namespaces.
  • Containers: unprivileged, rootless, read-only root FS, no Docker socket, no-new-privileges.
  • Auditing (auditd), logs, integrity checking (AIDE).
  • Keep secrets out of configs/history.

Hardening Windows and cloud

  • Standard user instead of admin in daily use, UAC, LAPS (unique local admin passwords), Credential Guard, Defender/ASR rules, AppLocker/WDAC.
  • Services/tasks with minimal rights, quote paths, check rights on program/service folders.
  • Active Directory: tiering (separate admin accounts), check delegation, Kerberoasting protection (long service account passwords, gMSA).
  • Patch management.
  • Cloud: minimal IAM, roles per service, IMDSv2, no keys in code, MFA, access reviews.
  • Benchmarks: CIS Benchmarks, BSI baseline protection (SYS.1), Microsoft security baselines.

Checking and learning

  • Audit your own systems: Lynis (Linux), linPEAS/winPEAS-like checkers only on your own systems, vulnerability scanners (OpenVAS), configuration checks.
  • Logs/alarms for suspicious sudo/su, new SUID files, new accounts.
  • Practise legally: TryHackMe/HackTheBox PrivEsc rooms, own VM labs (Metasploitable) – never third-party systems.
  • Legal: unauthorised spying/obtaining rights is punishable (§ 202a ff. StGB).
  • Related: sudoers, least privilege, access control, hardening checklists, container security.

See also: sudoers and visudo, Least privilege, Zero trust

Backlinks