Skip to main content

Week 10 — Privilege escalation

Learning objectives​

  • Recognize the most frequent escalation paths on Linux and Windows.
  • Use John the Ripper and Hashcat to crack hashes offline.
  • Understand Mimikatz without turning it into a magic tool.

Linux — What we look at first​

  • sudo -l: the command that tells the truth about elevated rights.

  • Mispositioned SUID bits:

    find / -perm -4000 -type f 2>/dev/null

  • Cron: tasks executed as root with relative paths, editable scripts.

  • Readable configuration files containing secrets.

  • Unpatched kernel or distribution — cross-check with the CVE database first.

Practical tool for the rough pass: LinPEAS. Never trust it blindly: it lists, it does not qualify.

Windows — Key points​

  • Service accounts with weak passwords (Kerberoasting attack).
  • Active sessions whose access token can be stolen.
  • Poorly ACL'd services, writable service folders.
  • Local password policies, reuse.

Equivalent tool: WinPEAS. Here too, filter the false positives.

Cracking hashes offline​

The value of John and Hashcat: the target sees nothing. No account gets locked out, no service complains.

# Hashcat, NTLM hash, dictionary + rules.
hashcat -m 1000 -a 0 hashes.txt rockyou.txt -r rules/best64.rule

# John, incremental mode on short passwords.
john --format=sha256crypt --incremental=Alpha hashes.txt

Mimikatz — Framing it properly​

  • Runs locally, as administrator of the targeted machine.
  • Extracts credentials and Kerberos tickets held in memory by LSASS.
  • Authorized pentest use only, isolated VM, logs preserved.

What a good finding contains​

  • Starting account (standard user).
  • Escalation step (SUID, cron task, Kerberoast...).
  • Final account reached (root, SYSTEM, domain admin).
  • Business impact: access to what, next?
  • Tested remediation (e.g. removing the SUID, fixing the ACL).