What Is Privilege Escalation? How Attackers Climb From User to Admin

A privilege escalation attack happens when someone who already has a foothold on a system uses a flaw or a loose setting to gain more rights than they were given. A normal user becomes an administrator, or one customer’s account starts reading another customer’s data. It is rarely the first step of an attack. It is the step that turns a small break-in into a serious one.

What is privilege escalation in plain terms?

Most systems give people only the access their job needs. Privilege escalation is any way of getting around that limit. MITRE’s ATT&CK framework lists it as its own tactic, where the adversary is trying to gain higher-level permissions.

Attackers usually start small. A phished mailbox, a stolen password or a vulnerable web page gives them a low-rights account. That account cannot reach the finance share or the domain controller. So they look for a way up.

What is the difference between vertical and horizontal escalation?

There are two directions, and they cause different damage.

• Vertical escalation moves up. A standard user gains admin, root or SYSTEM rights.
• Horizontal escalation moves sideways. The attacker keeps the same level of rights but takes over another person’s account, or reads records that belong to someone else.

Vertical escalation is what most people picture. Horizontal escalation is just as common in web applications, where changing an ID in a URL can expose a stranger’s order history.

How does a privilege escalation attack work?

MITRE groups the methods into a long list of techniques. Four of them cover most of what testers find in the field. Each one gives an attacker a different route from a weak account to a strong one.

Exploiting a software vulnerability

A flaw in the operating system, a driver or an installed service can let low-rights code run with high rights. MITRE tracks this as exploitation for privilege escalation. Patching closes these holes. The trouble is the gap between a fix being released and a fix being installed.

Abusing built-in elevation controls

Systems have features that exist to grant rights safely. MITRE’s entry on abuse of elevation control mechanisms covers setuid and setgid programs on Linux, Windows User Account Control bypasses, and misuse of sudo and its cached credentials. The feature works as designed. The attacker simply finds a gap in how it was set up.

Using valid accounts

Often there is nothing to exploit. The attacker finds an admin password in a script, a shared note or a config file, then logs in. No alert fires, because the login looks normal.

Taking advantage of weak permissions

Services that run as administrator, writable folders in a service’s path, and groups that nobody has reviewed in years all hand out rights for free. Our write-up on the forgotten admin right behind most cases shows how ordinary this is.

Why does a privilege escalation attack keep working?

Because access piles up over time. People change roles and keep their old rights. Service accounts get broad permissions so that something will work, and nobody trims them later. The NSA and CISA reviewed their own assessments and named improper separation of user and administrator privilege as one of the top ten network misconfigurations. The advisory calls the build-up “privilege creep”.

It also describes how quickly this goes wrong. In one assessment, a phished user with administrative permissions let the team take over a whole domain in under a business day.

Web applications have the same problem. OWASP ranks broken access control first in its 2021 Top 10 and notes that 94% of applications were tested for some form of it. Its list of examples includes missing least-privilege rules, tampering with URLs or API requests, and manipulating JWTs or cookies.

What does a privilege escalation attack look like in practice?

Picture a small accountancy firm. An employee clicks a phishing link and the attacker gets a normal user session. On that machine they find a scheduled task that runs a script as an administrator, and the script sits in a folder that any user can edit. They change one line and wait. At the next run they have admin rights on that server. From there they dump saved credentials and reach the file server.

Nothing in that story needed a zero-day. It needed one weak permission, and that is how most of these attacks go. A recent example from Active Directory shows the same pattern: an unreviewed default setting did the damage, not a clever exploit.

How can you prevent privilege escalation?

You will not remove every vulnerability, so aim to shrink what an attacker gains when they land. That is the best defence against a privilege escalation attack. The NCSC’s guidance on identity and access management and the CISA advisory point the same way.

1. Apply least privilege. Give each account only what the role needs. The NCSC advises you to review user accounts and systems for unnecessary privileges on a regular basis.
2. Separate admin and daily accounts. Admins should not read email or browse the web from accounts that can administer servers.
3. Protect admin accounts with MFA and keep their number small. Where you can, grant admin rights only for the time a task needs.
4. Tighten service accounts. Run services as non-administrators and give them narrow permissions.
5. Patch and fix settings. Close known flaws, and check for security misconfigurations such as default settings and writable paths.
6. Enforce access checks on the server. For web apps, deny by default and log repeated access control failures.
7. Monitor. Alert on new admin group members and odd use of privileged accounts.

How do penetration testers find escalation paths?

Finding these paths is a large part of what we do. It is also the part automated tools handle worst.

A scanner can list missing patches, but it cannot tell you that a low-rights user can chain three small weaknesses into domain admin. A tester starts where a real attacker would, as an ordinary user, and tries to climb. The result shows which accounts, services and permissions form the path, so you fix the link that matters.

If you want that tested properly, Aardwolf Security can scope an internal network penetration test that starts from a low-rights account. You can get in touch to talk through what would suit your setup.

Frequently asked questions

Is privilege escalation the same as a privilege escalation vulnerability?

Not quite. The vulnerability is the weakness, such as a bug or a bad permission. The escalation is what an attacker does with it.

Does privilege escalation need a software bug?

No. Stolen credentials, over-generous groups and unsafe scheduled tasks all work without one. Many cases come down to configuration.

Which is worse, vertical or horizontal escalation?

Vertical usually does more damage, since admin rights open everything. Horizontal can still expose customer data at scale, so treat both as serious.

Can antivirus stop it?

Sometimes it catches known tools. It will not fix an over-privileged account or a writable service folder, so it is no substitute for tidy permissions.

How often should I test for it?

Test after major changes to your network or applications, and at least once a year, because new accounts and new services bring new escalation paths. Review admin group membership far more often than that.