46. Privilege Escalation

Gaining more access than you're supposed to have — from a normal user up toward root/admin/kernel access.

• Horizontal: accessing another user's resources at the same privilege level (User A reading User B's files).
• Vertical (more dangerous): climbing from a lower privilege ring to a higher one — e.g., Ring 3 (user space) to Ring 0 (kernel).

Common techniques:

1. SUID exploitation — a SUID binary runs as its owner, not its caller (passwd runs as root even for normal users); attackers hunt for exploitable SUID binaries (find / -perm -4000).
2. Kernel exploits — a bug in the kernel itself lets a user process execute code with kernel-level access.
3. Sudo misconfiguration — e.g., NOPASSWD access to an editor that can shell out (:!bash inside vim) effectively grants a root shell.
4. Weak file permissions — a world-writable /etc/passwd lets an attacker add a root user directly.
5. PATH hijacking — a root script calling a command without its full path (system("ls")) can be tricked into running an attacker's malicious binary placed earlier in PATH.

Defense: principle of least privilege, regular SUID audits, keeping the kernel patched (kernel exploits are the most dangerous class), mandatory access control (SELinux/AppArmor), and careful sudo configuration.

---