Escalate from low-privilege user to root or SYSTEM.
Privilege escalation involves exploiting misconfigurations, vulnerabilities, or weak permissions to elevate access from a limited user to a privileged one.
Linux PrivEsc
SUID, sudo misconfigs, cron jobs, capabilities, and kernel exploits.
Windows PrivEsc
Token impersonation, service exploits, registry, and AlwaysInstallElevated.
⌘I
{"docsConfig":{"theme":"linden","$schema":"https://mintlify.com/docs.json","name":"Dudji's Docs","colors":{"primary":"#d5363e","light":"#e05560","dark":"#b02a32"},"logo":{"light":"https://mintcdn.com/dudji/eqP9RDjskrXV_bQE/logo/light.svg?fit=max\u0026auto=format\u0026n=eqP9RDjskrXV_bQE\u0026q=85\u0026s=a1a4d80894ccf5e2c85d642954915ca9","dark":"https://mintcdn.com/dudji/eqP9RDjskrXV_bQE/logo/dark.svg?fit=max\u0026auto=format\u0026n=eqP9RDjskrXV_bQE\u0026q=85\u0026s=bff1777fd1e6944bd0228d85b85b0b6f","href":"https://dudji.com"},"favicon":{"light":"https://mintcdn.com/dudji/eqP9RDjskrXV_bQE/logo/light.svg?fit=max\u0026auto=format\u0026n=eqP9RDjskrXV_bQE\u0026q=85\u0026s=a1a4d80894ccf5e2c85d642954915ca9","dark":"https://mintcdn.com/dudji/eqP9RDjskrXV_bQE/logo/dark.svg?fit=max\u0026auto=format\u0026n=eqP9RDjskrXV_bQE\u0026q=85\u0026s=bff1777fd1e6944bd0228d85b85b0b6f"},"appearance":{"default":"dark"},"background":{"decoration":"windows","color":{"light":"#fef9f9","dark":"#060606"}},"navbar":{"primary":{"type":"button","label":"Home","href":"https://dudji.com"}},"footer":{"socials":{"x":"https://x.com/dudji","linkedin":"https://linkedin.com/in/dudji","instagram":"https://instagram.com/dudji","github":"https://github.com/0xDudji"},"links":[{"header":"Dudji","items":[{"label":"Home","href":"https://Dudji.com"},{"label":"Contact","href":"https://Dudji.com/contact"},{"label":"Writeups","href":"https://Writeups.Dudji.com"},{"label":"Academy","href":"https://Academy.Dudji.com"}]},{"header":"Hackbook","items":[{"label":"Playbook","href":"/playbook"},{"label":"Attacks","href":"/attacks"},{"label":"Tech","href":"/tech"},{"label":"Payloads","href":"/payloads"},{"label":"Tools","href":"/tools"}]}]},"seo":{},"fonts":{"heading":{"family":"JetBrains Mono"},"body":{"family":"JetBrains Mono"}},"styling":{"codeblocks":{"theme":{"light":"github-light","dark":"tokyo-night"}},"latex":false},"navigation":{"global":{"anchors":[]},"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"dudji","hasAudioNarration":false,"actualSubdomain":"dudji","customDomains":["hackbook.dudji.com"],"gitSource":{"type":"github","owner":"0xdudji","repo":"docs-hackbook","deployBranch":"main","contentDirectory":"","isPrivate":false,"mountPath":"","label":""},"chroma":{"liveDeploymentHistoryId":"6a23381c6fd6897f2c896933","collectionId":"25364ee0-3568-44a1-978b-bb73ac584e92","schemaVersion":"v2"},"entitlements":{},"buildId":"6a23381c6fd6897f2c896933:success","clientVersion":"0.0.3894","searchFilterCounts":[{"language":"default","tag":"Tech","count":44},{"language":"default","tag":"Services","count":18},{"language":"default","tag":"Linux","count":14},{"language":"default","tag":"Windows","count":11},{"language":"default","tag":"Tools","count":11},{"language":"default","tag":"Attacks","count":9},{"language":"default","tag":"Exploitation Frameworks","count":8},{"language":"default","tag":"Metasploit","count":8},{"language":"default","tag":"Web","count":7},{"language":"default","tag":"Overview","count":6}]},"assistantConfig":{"enableAskAiButton":false,"enableStarterQuestions":false,"enableAskAiSearchBar":true},"hasChatPermissions":false,"hasWebMcpPermissions":false,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-v7-file-tree","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"pause-universal-search-reconcile","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"per-site-search-delta","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-branches-v2-autocommit","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-branches-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-private-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"teamspace","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"vite-origin","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-nav-generations","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"byok-sep-25","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-agent-model-picker","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"client-snapshot-docs-config","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"isAtlas":false,"googleFontsInlined":true},"customCss":[{"filePath":"custom.css","content":"a[href*=mintlify]{display:none!important}.cl-item{display:flex;align-items:baseline;gap:.625rem;cursor:pointer;padding:.3rem 0;line-height:1.6;user-select:none}.cl-item input[type=checkbox]{accent-color:#dc2626;width:1rem;height:1rem;flex-shrink:0;cursor:pointer;margin-top:2px}.cl-item span{user-select:text}.cl-item:has(input[type=checkbox]:checked) span{opacity:.4;text-decoration:line-through;text-decoration-color:#dc2626;transition:opacity .2s ease}:not(html):not(body)::-webkit-scrollbar{display:none!important;width:0!important}:not(html):not(body){scrollbar-width:none!important;-ms-overflow-style:none!important}body:has(.homepage) #sidebar,body:has(.homepage) #sidebar-content{display:none!important}"}],"page":{"pagePath":"attacks/privilege-escalation","slug":"/attacks/privilege-escalation","pageMetadata":{"title":"Privilege Escalation","description":"Escalate from low-privilege user to root or SYSTEM.","href":"/attacks/privilege-escalation/index"},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"Escalate from low-privilege user to root or SYSTEM.\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){const _components={p:`p`,strong:`strong`,..._provideComponents(),...props.components},{Card,Columns}=_components;if(!Card)_missingMdxReference(`Card`,true);if(!Columns)_missingMdxReference(`Columns`,true);return _jsxs(_Fragment,{children:[_jsxs(_components.p,{children:[`Privilege escalation involves exploiting misconfigurations, vulnerabilities, or weak permissions to `,_jsx(_components.strong,{children:`elevate access`}),` from a limited user to a privileged one.`]}),`\n`,_jsxs(Columns,{cols:2,children:[_jsx(Card,{title:`Linux PrivEsc`,icon:`linux`,href:`/attacks/privilege-escalation/linux`,children:_jsx(_components.p,{children:`SUID, sudo misconfigs, cron jobs, capabilities, and kernel exploits.`})}),_jsx(Card,{title:`Windows PrivEsc`,icon:`windows`,href:`/attacks/privilege-escalation/windows`,children:_jsx(_components.p,{children:`Token impersonation, service exploits, registry, and AlwaysInstallElevated.`})})]})]})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"codeStyling":{"theme":{"light":"github-light","dark":"tokyo-night"}},"config":{},"pageMetadata":{"title":"Privilege Escalation","description":"Escalate from low-privilege user to root or SYSTEM.","href":"/attacks/privilege-escalation/index"}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":[],"subdomain":"dudji","siteName":"Dudji's Docs","title":"Privilege Escalation - Dudji's Docs","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-03-15T21:58:04.692Z","originalFileLocation":"attacks/privilege-escalation/index.mdx"},"headHtml":"\u003cmeta data-mint-head name=\"description\" content=\"Escalate from low-privilege user to root or SYSTEM.\">\u003cmeta data-mint-head name=\"application-name\" content=\"Dudji\u0026#x27;s Docs\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/dudji/zneJunrtFpLjA7Xx/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/dudji/zneJunrtFpLjA7Xx/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/dudji/zneJunrtFpLjA7Xx/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/dudji/zneJunrtFpLjA7Xx/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/dudji/zneJunrtFpLjA7Xx/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/dudji/zneJunrtFpLjA7Xx/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/dudji/zneJunrtFpLjA7Xx/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/dudji/zneJunrtFpLjA7Xx/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/dudji/zneJunrtFpLjA7Xx/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"Privilege Escalation - Dudji\u0026#x27;s Docs\">\u003cmeta data-mint-head property=\"og:description\" content=\"Escalate from low-privilege user to root or SYSTEM.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Dudji\u0026#x27;s Docs\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://hackbook.dudji.com/attacks/privilege-escalation\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Privilege Escalation - Dudji\u0026#x27;s Docs\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Escalate from low-privilege user to root or SYSTEM.\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/dudji/zneJunrtFpLjA7Xx/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Dudji\u0026#x27;s Docs\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#d5363e\">\u003clink data-mint-head rel=\"canonical\" href=\"https://hackbook.dudji.com/attacks/privilege-escalation\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/attacks/privilege-escalation.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://hackbook.dudji.com/#organization\",\"name\":\"Dudji's Docs\",\"url\":\"https://hackbook.dudji.com\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/dudji/eqP9RDjskrXV_bQE/logo/light.svg?fit=max\u0026auto=format\u0026n=eqP9RDjskrXV_bQE\u0026q=85\u0026s=a1a4d80894ccf5e2c85d642954915ca9\"}},{\"@type\":\"WebSite\",\"@id\":\"https://hackbook.dudji.com#website\",\"name\":\"Dudji's Docs\",\"url\":\"https://hackbook.dudji.com\",\"publisher\":{\"@id\":\"https://hackbook.dudji.com/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://hackbook.dudji.com/attacks/privilege-escalation#webpage\",\"url\":\"https://hackbook.dudji.com/attacks/privilege-escalation\",\"name\":\"Privilege Escalation\",\"description\":\"Escalate from low-privilege user to root or SYSTEM.\",\"dateModified\":\"2026-03-15T21:58:04.692Z\",\"isPartOf\":{\"@id\":\"https://hackbook.dudji.com#website\"},\"breadcrumb\":{\"@id\":\"https://hackbook.dudji.com/attacks/privilege-escalation#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://hackbook.dudji.com/attacks/privilege-escalation#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Privilege Escalation\",\"item\":\"https://hackbook.dudji.com/attacks/privilege-escalation/index\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Privilege Escalation\",\"item\":\"https://hackbook.dudji.com/attacks/privilege-escalation\"}]},{\"@type\":[\"Article\",\"TechArticle\"],\"@id\":\"https://hackbook.dudji.com/attacks/privilege-escalation#article\",\"headline\":\"Privilege Escalation\",\"name\":\"Privilege Escalation\",\"description\":\"Escalate from low-privilege user to root or SYSTEM.\",\"url\":\"https://hackbook.dudji.com/attacks/privilege-escalation\",\"mainEntityOfPage\":{\"@id\":\"https://hackbook.dudji.com/attacks/privilege-escalation#webpage\"},\"dateModified\":\"2026-03-15T21:58:04.692Z\",\"publisher\":{\"@id\":\"https://hackbook.dudji.com/#organization\"},\"isPartOf\":{\"@id\":\"https://hackbook.dudji.com#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Dudji's Docs\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Dudji's Docs","nav":{"global":{"anchors":[]},"tabs":[{"tab":"Overview","pages":[{"title":"Overview","href":""}]},{"tab":"Playbook","pages":[{"title":"Playbook","href":"/playbook"}]},{"tab":"Attacks","groups":[{"group":"Overview","pages":[{"title":"Attacks","href":"/attacks"}]},{"group":"Web","root":{"title":"Web Attacks","href":"/attacks/web/index"},"pages":[{"title":"Local File Inclusion","href":"/attacks/web/local-file-inclusion"},{"group":"WordPress","root":{"title":"WordPress","href":"/attacks/web/wordpress/index"},"pages":[{"title":"WordPress Fundamentals","href":"/attacks/web/wordpress/fundamentals"},{"title":"WordPress Enumeration","href":"/attacks/web/wordpress/enumeration"},{"title":"WordPress Exploitation","href":"/attacks/web/wordpress/exploitation"},{"title":"WordPress Hardening","href":"/attacks/web/wordpress/hardening"}]},{"group":"SQL Injection","root":{"title":"SQL Injection","href":"/attacks/web/sql-injection"},"pages":[{"title":"SQL Injection UNION Attacks","href":"/attacks/web/sql-injection/sql-injection-union-attacks"},{"title":"Blind SQL Injection","description":"Extract data from databases where query results aren't returned in the HTTP response.","href":"/attacks/web/sql-injection/blind-sql-injection"}]}]},{"group":"Privilege Escalation","root":{"title":"Privilege Escalation","href":"/attacks/privilege-escalation/index"},"pages":[{"title":"Linux Privilege Escalation","description":"Common Linux privilege escalation techniques — from enumeration to root.","href":"/attacks/privilege-escalation/linux"},{"title":"Windows","href":"/attacks/privilege-escalation/windows"}]}]},{"tab":"Tech","pages":[{"title":"Tech","href":"/tech"}]},{"tab":"Payloads","pages":[{"title":"Payloads","href":"/payloads"}]},{"tab":"Tools","pages":[{"title":"Tools","href":"/tools"}]}]},"title":"Privilege Escalation - Dudji's Docs","buildId":"dpl_8LJVMfxYNq6LJkohTrn2iyWT8umj","deploymentId":"dpl_8LJVMfxYNq6LJkohTrn2iyWT8umj","dynamics":[],"chunks":[]}