Privilege escalation in plain English
Think of a hotel. Every guest receives a key card that opens only their own door. The housekeeping staff have cards for an entire floor, and the hotel manager has a master card for every room. If a guest finds a master card left lying at the front desk, they can suddenly enter any room. That is exactly what privilege escalation is: someone obtains access rights they are not entitled to.
IT works in a similar way. A normal user account may open its own files and use approved programs. An administrator account, by contrast, can do almost anything: install software, disable security programs, create new accounts. Attackers usually start out with few rights, for example after someone has fallen for a phishing email. That’s why their next goal is almost always to obtain higher privileges.
Experts distinguish between two directions:
- Vertical privilege escalation: moving up, for example from a normal user to administrator.
- Horizontal privilege escalation: a sideways step, meaning access to the data of other accounts at the same level. An example: a customer of an online portal suddenly sees another customer’s invoices. Experts often call this IDOR.
How privilege escalation works
Attackers specifically look for weaknesses that let them climb higher. Typical causes include:
- Missing updates: Flaws in the operating system, drivers, or programs for which an update has long been available. Often, a public exploit – ready-made attack code – already exists.
- Incorrectly set permissions: If normal users can modify a program file that later runs with administrator rights, they can inject their own code into it.
- Insecurely configured services: Background programs or scheduled tasks run with high privileges and can be manipulated.
- Plaintext passwords: Credentials sit in scripts, configuration files, or notes on network drives – readable by anyone who looks there.
- Weaknesses in the directory service: In Windows networks, Active Directory manages all accounts and permissions. Using techniques such as Kerberoasting (cracking the passwords of certain service accounts) or pass-the-hash (signing in with a captured password fingerprint instead of the password itself), attackers work their way up to domain administrator. This account controls practically the entire network.
Privilege escalation rarely happens in isolation. It usually alternates with lateral movement – moving sideways from computer to computer. Together, the two form an attack path from initial access to the target.
A practical example
A fictional but typical scenario: At a logistics company, an employee opens a booby-trapped email attachment. The attacker now controls the employee’s computer – but only with normal user rights. On a network drive, the attacker finds an old installation script containing the password of the local administrator account. Because this password is the same on all workstations, it lets them sign in to many devices.
A domain administrator had signed in to one of these devices shortly before. That administrator’s credentials are still in memory, and the attacker can extract them. A few steps later, the attacker controls the entire corporate network. Each individual mistake seems harmless – only the combination makes it dangerous. A penetration test uncovers exactly these kinds of chains.
Why does this matter for businesses?
With normal user rights, an attacker can usually cause only limited damage. With administrator rights, they can disable security software, delete backups, exfiltrate data on a large scale, and distribute malware to every system. Whether privilege escalation succeeds therefore often decides whether an incident remains limited to a single computer or hits the entire organization.
Standards address the issue, too. The control catalog of the ISO/IEC 27001 standard, for example, calls for privileged access rights to be restricted and managed.
How to protect your organization
- Least privilege: Each account receives only the rights it really needs for its tasks.
- Timely updates: Structured patch management – the planned installation of security updates – closes known gaps before attackers can exploit them.
- Separate administrator accounts: Administrators handle everyday tasks with a normal account and use privileged accounts only for administration – ideally following a tiered model that separates workstations, servers, and domain controllers (the central servers of Active Directory).
- Unique local passwords: LAPS, a feature built into Windows, assigns each device its own regularly changing password for the local administrator account.
- No passwords in files: Credentials belong in a password manager or vault, not in scripts and file shares.
- Regular reviews: Check permissions, services, and group memberships. Set up alerts for when new administrator accounts are created.
How Rootsektor can help
In a Network & Infrastructure penetration test, we specifically check how far an attacker can get from an ordinary user account – up to and including taking over the domain, as far as the agreed rules of engagement allow. We perform internal tests either on-site or remotely – via VPN or through a provided test system. Our Active Directory security assessment also takes a close look at the permission structure of your directory service.