Move as another logged-on user by stealing their token
On a multi-user host, duplicating the primary token of another session lets you act as that user, including a domain admin who logged in.
Tag: privesc
Escalate through weak service permissions and unquoted paths
A service you can reconfigure, or one whose unquoted path runs through a writable directory, executes your binary as its account on restart.
SeImpersonate to SYSTEM with a potato technique
A service account holding SeImpersonatePrivilege can coerce a SYSTEM authentication and duplicate its token for a full-privilege shell.
Inject into a root process with cap_sys_ptrace
A shell or binary holding cap_sys_ptrace can attach to a root-owned process and hijack it to run your shellcode as root.
Abuse sudo LD_PRELOAD and LD_LIBRARY_PATH
If sudoers preserves LD_PRELOAD or LD_LIBRARY_PATH, any command you are allowed to run as root loads your shared object first.
Plant a root SUID over an NFS no_root_squash export
When an export is shared with no_root_squash, a SUID binary you create as root on your own box stays root-owned on the server.
Hijack a writable or PATH-relative systemd unit
A root-run service with a writable unit file or a relative ExecStart lets an unprivileged user execute code as root on the next start.
Break out of a container through the Docker socket
A mounted or reachable docker.sock is root on the host, because you can start a container that bind-mounts the host filesystem.
Root via pkexec argument confusion (PwnKit)
A memory-corruption flaw in the SUID pkexec turns any local account into root on unpatched polkit installations.
Escalate through Linux file capabilities
A binary carrying cap_setuid or cap_dac_read_search grants root-equivalent power without any SUID bit, and defenders rarely audit it.