Container breakout through a mounted docker socket
A container with /var/run/docker.sock can start a new privileged container that mounts the host root.
Tag: privesc
Escape a privileged pod to the node
A privileged or hostPath-mounting pod is a foothold on the node; mount the host filesystem or use host namespaces.
GCP privilege escalation with serviceAccounts.getAccessToken
iam.serviceAccounts.getAccessToken over a more privileged service account lets you mint its token and inherit its access.
AWS privilege escalation via iam:PassRole and Lambda
If you can pass a more privileged role and create or invoke a function, you inherit that role's credentials.
DNSAdmins to Domain Controller via server-level DLL
Membership in DNSAdmins can load an arbitrary DLL into the DNS service, which runs as SYSTEM on the DC.
Abuse writable GPOs for code execution on an OU
Write access to a GPO linked to an OU means an immediate or scheduled task on every computer in that OU.
sAMAccountName spoofing (noPac) to impersonate a DC
Renaming a machine account to match a DC and requesting a ticket after reset yields a service ticket as domain admin.
ESC1 certificate template abuse for domain admin
A template that allows enrollee-supplied subject and has a client-auth EKU lets a low-priv user request a cert as any account.
Mass assignment to escalate your own role
Endpoints that bind the whole request body to a model often accept fields the UI never sends, like role or isAdmin.