Explore Privilege Escalation

Privilege escalation is what turns a low-level foothold into a real breach, and most of the time it has nothing to do with a zero-day. Sudoers misconfigurations, unquoted service paths, a world-writable directory left over from a rushed deployment years ago — these are the actual attack surface far more often than any CVE. Your tutor starts you there, because that's where most students' assumptions need correcting first.

You'll work through the terrain in the order it actually builds: Linux SUID and kernel-level bugs, then Windows token abuse and DLL hijacking, then the credential attacks that make Active Directory fall over — Pass-the-Hash, Kerberoasting, Golden Tickets — where a strong password turns out not to matter at all once a hash is in someone's hands. Your tutor lays out the diagram or the sudoers file or the token chain on the whiteboard first, then asks what a given permission actually allows before you touch a terminal.

The horizontal-to-vertical pattern is the spine underneath all of it — a compromised low-privilege account is frequently the stepping stone to root or Domain Admin, not a dead end. Your tutor keeps steering you back to that chain logic until you stop treating escalation techniques as a list to memorize and start asking what an identity can reach next.