After initial compromise, attackers exploit system weaknesses, misconfigurations, and stolen credentials to climb from low-privilege access to full system or domain control.
HOVER EACH TIER TO INSPECT
ESCALATION PATHS
KEY INSIGHT
Attackers rarely need a zero-day. Over 80% of real-world escalations exploit misconfigurations, excessive permissions, or credential reuse - not software vulnerabilities.
Privilege escalation begins after the attacker gains any access to a system - a phishing payload, an exploited service, or a stolen credential. The initial shell is typically unprivileged, and the race to escalate begins immediately.
Before exploiting, the attacker maps every escalation surface on the system. Automated tools like WinPEAS and LinPEAS scan hundreds of misconfiguration categories in seconds, revealing attack paths invisible to manual inspection.
Windows offers a vast attack surface for privilege escalation. Misconfigurations in services, registry keys, and installation policies frequently allow an attacker to gain Administrator or SYSTEM privileges without a kernel exploit.
Linux escalation commonly exploits SUID binaries, misconfigured sudo rules, writable cron jobs, and abusable Linux capabilities. GTFOBins documents hundreds of legitimate tools that can be abused for privilege escalation.
Windows access tokens are the OS objects that define a process's security context. With SeImpersonatePrivilege, attackers can steal or forge high-privilege tokens and attach them to new processes - bypassing all credential-based controls.
Active Directory escalation abuses Kerberos, ACL misconfigurations, and delegation settings to elevate domain privileges. These attacks rarely trigger traditional security tools because they use legitimate protocol features.
Domain Admin privilege means complete organizational compromise. The attacker can create persistent backdoor accounts, forge Kerberos tickets, replicate all password hashes, and access every system across the domain indefinitely.