Privilege escalation — the idea

In a nutshell You rarely break in as the boss. You get in as someone small — a low-privileged user or service — and then look for a way to become someone big — admin, root, SYSTEM. That climb is privilege escalation, and it's where most of the real work of an attack happens.

Vertical escalation climbs to more power; horizontal moves sideways to another account first.

Why the first foothold is never enough

An exploited web app might drop you in as www-data, who can't read other users' files or change the system. To actually own the machine — read secrets, install persistence, reach further — you need higher privileges. The pattern is almost always: get in low, climb high.

Analogy — a hotel. You talk your way into a staff hallway as a cleaner (foothold). Useful, but you want the master keycard. So you hunt for one left in a drawer, or trick a manager into swiping you through (escalation).

Two directions of climbing

Vertical ↑

gain more rights
user → admin / root / SYSTEM
what people usually mean by "privesc"

Horizontal →

move to another account, same level
e.g. read another user's mailbox
often a stepping stone to a vertical climb

Where escalation comes from

It's almost always misconfiguration or something forgotten, not magic:

a root program you may run/influence   →  SUID binary, loose sudo (Linux)
a writable file/service run as root    →  swap its contents for yours
a stored credential lying around       →  password in a config, script, history
an out-of-date kernel or service       →  a known public exploit
"temporary" excess permissions         →  granted once, never revoked

The method — enumerate, don't guess

Privesc is 90% careful enumeration. You run down a checklist of "what am I allowed to do, what's misconfigured, what's lying around," and the escalation reveals itself. Tools like linpeas/winpeas automate the checklist — but understanding why each item matters is what makes you dangerous, not the tool.

You are	You want	You look for
low user (Linux)	root	SUID, sudo rights, cron, writable paths, creds
low user (Windows)	Administrator / SYSTEM	services, scheduled tasks, registry, stored creds, UAC bypass

Loud and risky Kernel exploits can crash the machine, and privesc tools are noisy in logs. On real work you check the quiet misconfigurations (sudo, SUID, stored creds) first, and reach for a kernel exploit last.

The defender's flip side

Every escalation path is a hardening item: least privilege (grant the minimum needed), no secrets in files, patch known bugs, audit sudo and service accounts. Remove the misconfigurations and the foothold stays small — which is the whole point. The detailed checklists live in Linux privilege escalation and Windows privilege escalation.