Privilege Escalation at Glance

Before discussing more about privilege escalation, first we must know what is 'privilege'. Privilege is the level of authority given to user on a specific system or file. Or we can say that privilege is 'what the user are permitted to do". For example, a general user doesn't have the privilege to change the sytem settings on a machine while the administrator have it.

So, what if the general user what to change the system settings but doesn't know the administrator password? A general person will do nothing about it, but a hacker will do something to get the access that they are actually not entitled to. And that is something called Privilege Escalation.

The hacker usually gain the access by exploiting a bug or the other vulnerability on the system that allows the security to bypassed. There are two types of privilege escalation :

a. Vertical PE

    This type of privilege escalation is where a general user or application have and administrator-like authority on the system. For example, a member of a forum can do anything on the forum like he is the moderator/administrator of the forum by stealing the moderator/administrator password.

b. Horizontal PE

    This type of privilege escalation is where a user have an access to the other user's privilege in a system. Their level of authority is the same on the system. For example, Agus is a member of a forum, Budi is also the member of the same forum. Agus have an access to Budi's account and can do whatever Agus like with Budi's account.

Hope this helps you understand a little better about Privilege Escalation.

"the quieter you become, the more you are able to hear.."