What Is Privilege Escalation?
Privilege escalation is the step where an attacker turns a small foothold into real control — converting a low-privilege account into an administrator, or reaching data that belongs to someone else. It is what makes an initial compromise dangerous: the first door an attacker opens is rarely the one that matters, and escalation is how they reach the one that does.
What are the two types?#
- Vertical escalation — gaining higher privileges. A standard user becomes root or admin. This is the classic “get from user to system owner” move.
- Horizontal escalation — moving sideways to another account at the same level, accessing their data or actions. On the web this is IDOR: user 4711 reads user 4712’s records.
Both defeat the intent of authentication vs authorization: the system knows who you are but fails to constrain what you may do.
How do attackers escalate?#
The routes are consistent across systems:
| Route | Example |
|---|---|
| Unpatched vulnerabilities | Kernel or service exploit granting root |
| Misconfiguration | Overly-permissive sudo, world-writable files |
| Exposed credentials | Passwords in scripts, tokens in memory |
| Weak service accounts | Shared or over-privileged automation identities |
How do you shut escalation down?#
The single most effective control is least privilege: if every account and process holds only what it needs, there is far less to escalate to. Layer on prompt patching, configuration hardening, and monitoring for the telltale signs — a web account suddenly hitting admin endpoints, a service spawning a shell.
Escalation is a stage in the Cyber Kill Chain and a precursor to lateral movement. More at the Security Fundamentals hub.
Frequently asked questions#
What is the difference between vertical and horizontal privilege escalation?
Vertical escalation gains higher privileges — a normal user becoming an administrator or root. Horizontal escalation moves sideways to another account at the same level, accessing that user’s data or actions. Vertical increases power; horizontal broadens reach. Both violate the boundaries authorization is meant to enforce.
How do attackers escalate privileges?
Common routes include unpatched kernel or service vulnerabilities, misconfigured permissions and sudo rules, exposed credentials in files or memory, weak service accounts, and abusing legitimate features. On the web, it usually looks like broken access control — reaching an admin function or another user’s object.