Ravindra BagaleCourses & study guides मराठी Track your progress

26. Privilege Escalation

26.1 What Privilege Escalation Is

By Last updated:

In short: Privilege escalation means gaining more rights than you were given.

Privilege escalation means gaining more rights than you were given.

Type Meaning Example
Vertical A low user becomes a higher one A normal user becomes root/admin
Horizontal Same level, but another user's access One customer reads another customer's data

An attacker's usual flow: get in as a limited user (a web shell, a cracked SSH login), then escalate to root, because root can read every file, install anything, and cover tracks. Defensively, if you enforce least privilege, even a foothold stays limited.

Ravindra Bagale's Tip

Students think "I got in, so the job is done." No! Most of the time the first shell belongs to a limited user. The real danger comes when it becomes root. That is exactly why least privilege (giving every user/service only the rights it needs) is such an important defence.

Practice task

In your notes, write the difference between vertical and horizontal escalation with one real-world example of each (one from a Linux server, one from a web app like your reels app).

Privilege escalation from a defender's seat

Privilege escalation means moving from a low-privilege user to a more powerful one. Attackers look for weak sudo rules, old kernels, writable service files and saved credentials. Defenders remove those paths.

  1. Audit sudo with sudo -l and remove NOPASSWD where it is not needed.
  2. Patch kernels and restart when required.
  3. Make service files root-owned and not world-writable.
  4. Scan for secrets in home folders and scripts.

Real examples

Global: many ransomware strains escalate locally before encrypting files. Indian company (sample): a server where every developer had passwordless sudo was cleaned after an authorised review; tickets now require ticket IDs for privilege use.

Recap

  • Least privilege on every account.
  • Patch and audit regularly.

Defender's worksheet (do this today)

  1. Write the lesson title and date in your notebook.
  2. List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
  3. Run one safe command or checklist item from the lesson on a lab system only.
  4. Paste the command and its output under an Evidence heading.
  5. Write one fix you would give a teammate in two sentences.
  6. Write one mistake students make with this topic and how to avoid it.

More real-world pictures

Indian workplace (sample data)

Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.

Global practice

Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.

Home and family

Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.

Connect to earlier chapters

Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.

Common mistakes

  • Skipping written permission just for a quick scan.
  • Practising on hostel or office Wi-Fi targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Teach one other person the warning from this lesson.