Privilege escalation map: Linux euid vs Windows tokens
The scenario is fictional (RFC 5737 IPs). Detection and defense only; no exploit steps. Once an attacker has a foothold, the next move is almost always escalation. This season covers it for Linux and Windows servers.
The scenario is fictional (RFC 5737 IPs). Detection and defense only; no exploit steps.
Once an attacker has a foothold, the next move is almost always escalation. This season covers it for Linux and Windows servers.
What you'll learn
- Two families: A = misconfiguration (SUID, sudo, writable cron, unquoted service paths) and B = vulnerability (PwnKit, Dirty Pipe)
- Linux: the uid vs euid mismatch
- Windows: token, privileges, integrity level
- The series map
Linux vs Windows
| Linux | Windows | |
|---|---|---|
| Core model | uid / euid | access token, privileges, integrity level |
| Tell-tale in logs | uid=33 euid=0 |
low-privilege parent -> System-integrity child |
| Key logs | auditd, auth.log | 4672, 4688, 7045, Sysmon 1 |
Family A is fixed by inventory and least privilege. Family B is fixed by patching.
Next: detecting the Linux uid != euid mismatch, including a bug I found in the book's own one-liner.
Adapted from chapter 25 of my Japanese book on server defense.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.