Cloud

AWS

• AWS-IAM-Privilege-Escalation
• Pacu

GCP

• GCP-IAM-Privilege-Escalation
• GCPBucketBrute

Docker

Presentations

• Bypassing Docker Authz Plugin and Using Docker-Containerd for Privesc
• Container security notes
• Dirty COW - (CVE-2016-5195) - Docker Container Escape
• Don't expose the Docker socket (not even to a container)
• Escaping Containers to Execute Commands on Play with Docker Servers
• Hack Allows Escape of Play-with-Docker Containers
• Understanding Docker container escapes
• Introduction to Docker Hacking
• Escaping privileged containers for fun
• Docker security checklist
• Escaping Docker Privileged Containers
• Hacking Docker the Easy way
• Docker Breakout
• Escaping Docker container using waitid() – CVE-2017-5123

Tools

• BOtB
• CDK - sourced container penetration toolkit, offering stable exploitation in different slimmed containers without any OS dependency.
• Deepce
• Dokcer-escape-tool
• PrivilegedDockerEscape

Linux

Capabilities

• An Interesting Privilege Escalation vector (getcap/setcap)
• Exploiting capabilities
• Capabilities

Escape restricted shells

• Escaping from Restricted Shell and Gaining Root Access to SolarWinds Log & Event Manager (SIEM) Product
• Linux Restricted Shell Bypass
• Restricted Linux Shell Escaping Techniques

NFS

• Exploiting a Mis-Configured NFS Share
• Linux Privilege Escalation using Misconfigured NFS
• Linux Privilege Escalation using weak NFS permissions
• NFS weak permissions

Presentations

• Linux Privilege Escalation - Tradecraft Security Weekly #22 - based systems.
• Privilege Escalation FTW
• Linux privilege escalation for fun, profit, and all around mischief

SUDO and SUID

• Gaining a Root shell using MySQL User Defined Functions and SETUID Binaries
• GTFOBins
• Abusing SUDO
• Sudo (LD_PRELOAD)

Tools

• Arch-Audit
• AutoLocalPrivilegeEscalation
• BeRoot
• exploit-suggester - p” on Solaris machines and outputs a list of exploits that you might want to try.
• GTFONow
• kernelpop
• LES
• LinEnum
• LinPEAS
• Linux Exploit Suggester 2 - generation exploit suggester based on Linux_Exploit_Suggester
• Linux_Exploit_Suggester
• linux-kernel-exploits
• Linuxprivchecker.py - text passwords and applicable exploits.
• Linux Privilege Escalation Check Script - text password and applicable exploits.
• linux-smart-enumeration
• linux-soft-exploit-suggester - soft-exploit-suggester finds exploits for all vulnerable software in a system helping with the privilege escalation.
• PrivEsc
• pspy
• SUDO_KILLER - like systems.
• traitor - hanging fruit to pop a root shell. Linux privilege escalation made easy!
• ttyinject
• unix-privesc-check
• uptux
• active-cve-check
• cve-check-tool
• LPVS
• Unix-Privilege-Escalation-Exploits-Pack - UX, Solaris, RHEL, SUSE etc.

TTY Pushback / TIOCSTI injection

• TTY Input Pushback Privilege Escalation
• The oldest privesc: injecting careless administrators' terminals using TTY pushback
• TIOCSTI is a kernel problem.

• Basic Linux Privilege Escalation
• Enumeration is the Key
• Linux elevation of privileges ToC
• Linux - Privilege Escalation
• Linux Privilege Escalation
• Linux Privilege Escalation
• Linux Privilege Escalation
• Local Priv Esc - Linux
• PrivilageEsc Linux
• Linux Privilege Escalation – Exploiting User Groups
• Local Linux Enumeration & Privilege Escalation
• PENETRATION TESTING PRACTICE LAB - VULNERABLE APPS / SYSTEMS
• POST CATEGORY : Privilege Escalation
• Privilege escalation: Linux
• Privilege Escalation & Post-Exploitation
• Back To The Future: Unix Wildcards Gone Wild - school Unix hacking technique, that will still work in 2013.
• Privilege Escalation Cheatsheet (Vulnhub)
• Hackers Hut
• A guide to Linux Privilege Escalation - Feroze
• Local Linux privilege escalation overview
• Pentest Book - Privilege Escalation
• Penetration-Testing-Grimoire/Privilege Escalation/linux.md
• Linux Privilege Escalation

Linux and Windows

Presentations

• My 5 Top Ways to Escalate Privileges
• Privilege Escalation
• Awesome-Hacking-Resources (Privilege escalation section)
• Metasploit Local Exploit Suggester: Do Less, Get More!
• Recipe for Root
• Windows / Linux Local Privilege Escalation Workshop

Windows

DLL Hijacking

• DLL Hijacking
• DLL Search Order Hijacking
• PrivEsc: DLL Hijacking
• Windows Privilege Escalation via DLL Hijacking - clear view on one of the most used techniques for privilege escalation by the Threat Actors. by HacknPentest

Groups.xml

• Finding Passwords in SYSVOL & Exploiting Group Policy Preferences

NoFilter

• #NoFilter - Abusing Windows Filtering Platform for Privilege Escalation

Potato

• CertPotato
• Hot Potato
• Hot Potato – Windows Privilege Escalation
• Juicy Potato (abusing the golden privileges)
• No more JuicyPotato? Old story, welcome RoguePotato!
• Remote Potato
• Rotten Potato – Privilege Escalation from Service Accounts to SYSTEM
• Coerced potato
• Hot Potato

Presentations

• LOLBAS
• OSCP Windows PrivEsc - Part 1
• Privilege escalation: Windows
• Windows elevation of privileges ToC
• Windows Priv Esc
• Windows Privilege Escalation Guide
• Windows - Privilege Escalation
• Windows Privilege Escalation
• Windows Privilege Escalations
• Level Up! Practical Windows Privilege Escalation - Andrew Smith
• SANS Webcast: Pen Testing with PowerShell - Local Privilege Escalation Techniques
• Windows Privilege Escalation Techniques (Local) - Tradecraft Security Weekly #2
• Windows Privilege Escalation Unquoted Service - Part 1
• Windows Privilege Escalation Unquoted Service - Part 2
• Windows Privilege Escalation Unquoted Service - Part 3
• awesome-windows-security
• Windows Local Privilege Escalation Cookbook
• Windows-Privilege-Escalation - by-step windows privlege escalation methodology.
• Windows-Privilege-Escalation-Resources
• Level Up! - Practical Windows Privilege Escalation (Presentation Slides)
• Windows Local Privilege Escalation
• Windows Privilege Escalation

PrintNightmare

• Universal Privilege Escalation and Persistence

Tools

• ADAPE-Script
• GodPotato - Windows 2022, now as long as you have "ImpersonatePrivilege" permission.
• JAWS - Just Another Windows (Enum) Script
• juicy-potato
• NoFilter
• Potato
• PowerSploit
• PrivescCheck - exploitation, by itm4n.
• RemotePotato0
• RoguePotato
• RottenPotato
• RottenPotatoNG - no need for meterpreter or other tools.
• Seatbelt - survey "safety checks" relevant from both offensive and defensive security perspectives.
• SessionGopher
• SweetPotato
• Tater
• Watson
• WindowsEnum
• Windows-Exploit-Suggester
• Windows Exploit Suggester - Next Generation (WES-NG) - NG is a tool based on the output of Windows' systeminfo utility which provides the list of vulnerabilities the OS is vulnerable to, including any exploits for these vulnerabilities. Every Windows OS between Windows XP and Windows 10, including their Windows Server counterparts, is supported. By bitsadmin
• windows-privesc-check
• winPEAS
• WinPwnage
• Sherlock

Unquoted services with spaces

• PrivEsc: Unquoted Service Path
• Unquoted Service Path
• UNQUOTED SERVICE PATHS
• Windows Privilege Escalation — Part 1 (Unquoted Service Path)
• Windows Privilege Escalation – Unquoted Services
• Windows Privilege Escalation via Unquoted Service Paths