Privilege Escalation

---

Privilege escalation is exploiting flaws in an operating system or other application to gain a greater level of access than was intended for the user or application.

Types

• vertical privilege escalation
  • aka elevation
  • When an attacker can perform functions that are normally assigned to users in higher roles, and often explicitly denied to the attacker
  • e.g.,
    • a process might run with local administrator privileges
    • but a vulnerability allows the arbitrary code to run with higher SYSTEM privileges
• horizontal privilege escalation
  • When a user accesses or modifies specific resources that they are not entitled to
  • accessing functionality or data intended for other users
  • e.g.,
    • via a process running with local administrator privileges on a client workstation
    • arbitrary code is able to execute as a domain account on an application server

Remediation

• Input Validation
• patch systems, platforms, and applications
• enforce least privilege
• use controls designed to prevent privilege escalation:
  • data execution prevention (DEP)
  • Address Space Layout Randomization (ASLR)