Local Privilege Escalation

Definition

Low-privilege user gains admin/root/SYSTEM.

Root cause

Weak perms, misconfigured services, kernel bugs, token abuse.

Affected components

• Components in the “Access Control” class
• Application / API handlers
• Supporting libraries

Impact

Full host compromise.

Severity

High

Safe lab reproduction

Linux/Windows privesc labs (own VMs)

Detection methodology

EDR process trees, unusual service installs, SUID/ACL audits.

Evidence examples

• Lab reproduction notes: Linux/Windows privesc labs (own VMs)
• Request/response excerpts (redacted)
• Detection signal: EDR process trees, unusual service installs, SUID/ACL audits

Remediation

Hardening, patching, least privilege, remove dangerous SUID.

Secure coding examples

CIS baselines + continuous config audit.