Getting the lid off¶

The account that arrives is rarely the account that is wanted. Escalation is the local trade: a shell that can read becomes a shell that can write, and a user becomes whatever the machine was willing to hand out to anyone who asked in the right order. The routes are dull and durable. A sudo rule written once for a maintenance job, a service binary sitting in a directory its own group can write to, a kernel three years behind the estate it runs in: each looked reasonable to somebody on the day, and each is still there.

The same trade runs where there is no host to speak of. A cloud account escalates through the permission graph, where an identity allowed to edit a policy is allowed to write itself an administrator, and a container escalates through whichever kernel feature was relaxed to make the workload run at all.

Escalation is rehearsed on fenced ground in the TryHackMe rooms and the Root-Me challenges.