Privilege escalation cheat sheet: Linux and Windows
Escalation is an enumeration problem, not an exploit problem. Enumerate the whole host — your own privileges, services, scheduled jobs, file permissions and stored credentials — before reaching for a kernel exploit. The way up is almost always a misconfiguration someone left behind, and the automated enumeration scripts surface most of it if you actually read their output.
The instinct after landing a shell is to find a kernel exploit and fire it. That is usually the slowest, riskiest route and the one most likely to crash the box you just worked to get onto. Escalation is nearly always a misconfiguration — a sudo rule, a writable service, a credential left in a file — not a CVE. Enumerate first, exploit last.
The rule
Enumerate the host fully before you try to escalate, and read the output. The enumeration scripts — linPEAS on Linux, winPEAS on Windows — find almost every path listed below. People fail to escalate not because the script missed the issue but because they ran it and never read past the first screen. The script finds it; you still have to see it.
Linux
Your sudo rights. sudo -l first, every time. A misconfigured entry, or a
binary you are allowed to run as root that can spawn a shell or read a file, is
the most common path up. GTFOBins lists the abusable ones.
SUID and SGID binaries. Find files that run as their owner. Known binaries with the SUID bit set are frequently the intended route.
Scheduled jobs. A cron job running as root that calls a script you can write, or uses a wildcard you can hijack, hands you execution as root on a timer.
Capabilities. Check for file capabilities — cap_setuid on the wrong
binary is a direct escalation.
Writable files and PATH. A world-writable /etc/passwd, a writable service
unit, or a root script that calls a binary by relative name in a PATH you
control.
Stored credentials. Config files, shell history, .ssh keys, backups and
database connection strings. A password reused for root is faster than any
exploit.
Kernel — last. Match the kernel version to a known local exploit only after the above are exhausted. It can panic the host, so treat it as the last resort.
Windows
Your privileges. whoami /priv. Token privileges are the fast path:
SeImpersonatePrivilege or SeAssignPrimaryToken open the Potato family;
SeBackupPrivilege, SeRestorePrivilege and SeDebugPrivilege each have their
own route.
Services. Unquoted service paths, service binaries you can overwrite, and services whose configuration you can change all lead to execution as the service account — often SYSTEM.
Registry and stored credentials. AlwaysInstallElevated set, autologon
passwords, PowerShell history, the Credential Manager, and unattend.xml or
sysprep files left behind on the disk.
Scheduled tasks. A task running as a privileged user whose binary or script you can modify.
Kernel — last. systeminfo against the patch list points at missing
patches, but as on Linux it is the last resort, not the first move.
Read the tool output
Both linPEAS and winPEAS colour-code what matters and surface nearly everything above. The discipline is not running them — it is reading all of it. A “stuck” escalation is almost always a finding already sitting in output the operator scrolled past.
When to move to the kernel
Only when host enumeration is genuinely exhausted: you have checked your privileges, services and scheduled jobs, every writable path, and every place a credential could hide, and none of them moved you. The kernel exploit is where you go when the misconfigurations run out — not before.