Don't Panic: Post-Exploitation and Privilege Escalation

A foothold is a place to start, not a verdict about how far someone can go. Post-exploitation asks what an authorized starting identity can actually reach after initial access. Privilege escalation is the narrower case where an action produces higher-level permissions. The account name may sound impressive, but the permission check gets the final word.

The useful mental picture is an access path: an identity, an action it is allowed to take, a resource, and a resulting security context. Each connection needs evidence. A writable service file looks promising. It only becomes an elevation path if a more privileged process consumes that exact file in a way that changes authority. If the process never reads it, the diagram is a fine diagram and a poor finding.

There are several kinds of permission boundary. Linux has user and group IDs plus capability sets. Windows processes carry access tokens with groups and privileges, and an administrator can run under a filtered token. A cloud request meets applicable policies, where an explicit deny can defeat an apparent allow. These models all ask who can do what, but they do not award the same prize. Root on one host does not grant control of a directory or cloud tenant.

Several neighboring activities can be mistaken for elevation. Discovery reveals who and what is present. Finding a password is credential access; using an existing identity on a second machine is lateral movement. Preserving access after the current session is persistence. None of these observations alone demonstrates higher privilege. A report that blends them into one success story hides the transition that mattered.

A permission that looks dangerous is a candidate. Check its target, trigger, and remaining restrictions. Then choose the smallest proof the engagement allows. If that proof needs a service restart, production credentials, or an excluded system, stop and write down the untested condition. A careful hypothesis is more useful than a confident claim that cannot be defended.

The Cheatsheet gives the edge-by-edge model and the difference between candidate and confirmed. The Practice Reference shows how to inspect a context and select a proof grade. The exercise lets you apply that reasoning to a fictional service without touching a machine. Start there if the phrase "privilege escalation" currently suggests one universal button. There is no such button, which is inconvenient but also the reason the evidence matters.