# Privilege escalation

> Going from limited access to more power than you were given, usually by exploiting a flaw.

- Level: Advanced
- Topics: Security
- URL: https://tidbit.legios.com.ar/privilege-escalation/
- In Spanish: [Escalada de privilegios](https://tidbit.legios.com.ar/es/privilege-escalation/)

Every system hands out **privileges**: a normal user can read their own files, an administrator can install software, and `root` on Linux or `SYSTEM` on Windows can do anything. **Privilege escalation** is when someone who got in with limited rights manages to obtain higher ones they were never granted. It is rarely how an attack starts; it is what turns a small foothold, such as a phished employee account or a hacked web app running as a low-privilege service, into control of the whole machine or network.

**Vertical** escalation climbs up: from user to admin, from a container to the host, from a read-only cloud role to one that can create new credentials. **Horizontal** escalation moves sideways to another account at the same level, for example changing an ID in a URL to see someone else's invoices. The usual routes are an unpatched kernel or driver vulnerability, a program that runs with high privileges and can be tricked into running the attacker's commands, misconfigured permissions, passwords or keys left in scripts, and in the cloud, IAM policies that let a role grant itself more.

That is why defenders treat it as a separate stage to block, not just the initial break-in. The core ideas are least privilege, so each account and service has only what it needs; prompt patching, since many escalation bugs are public within days; separating admin accounts from everyday ones; and monitoring for the telltale moves, such as a web server process suddenly spawning a root shell. Frameworks like MITRE ATT&CK catalog the known techniques so teams can test their defenses against each one.

## An analogy

A visitor with a lobby pass who finds a master key left in a utility closet. The visit itself was legitimate; the problem is what that pass let them reach once inside.

## Keep in mind

- It turns limited initial access into admin or root control.
- Vertical means climbing to higher rights; horizontal means taking over a peer's account.
- Common routes: unpatched bugs, misconfigured permissions, exposed secrets, over-broad cloud roles.
- Least privilege, fast patching and monitoring limit the damage.

## Go deeper

- [Privilege escalation on Wikipedia](https://en.wikipedia.org/wiki/Privilege_escalation)
- [MITRE ATT&CK: Privilege Escalation tactic (TA0004)](https://attack.mitre.org/tactics/TA0004/)
- [CWE-269: Improper Privilege Management](https://cwe.mitre.org/data/definitions/269.html)

## Related terms

- [Linux](https://tidbit.legios.com.ar/linux/): A free, open source operating system that runs most of the internet's servers.
- [Container](https://tidbit.legios.com.ar/container/): A sealed box with a program and everything it needs to run anywhere.
- [Cloud computing](https://tidbit.legios.com.ar/cloud-computing/): Renting computers over the internet instead of buying your own.
- [URL](https://tidbit.legios.com.ar/url/): The full address of something on the web: protocol, site and path.
- [Vulnerability and CVE](https://tidbit.legios.com.ar/vulnerability-and-cve/): A flaw that lets an attacker misuse software, and the public id that names it.
- [IAM](https://tidbit.legios.com.ar/iam/): The rulebook that says who can do what in your AWS account.
- [Zero trust](https://tidbit.legios.com.ar/zero-trust/): Security that checks every request, instead of trusting whatever is inside the network.
- [Prompt](https://tidbit.legios.com.ar/prompt/): Everything you send to an AI model: the question, the instructions, the context.