Overview of the common escalation methodology

Everything that starts with a methodology offers an approach to a problem solution. In this section, we will go through the common escalation methodology utilized by attackers during a red teaming exercise, or penetration testing.

Figure 12.1 depicts the methodology that can be used:

Figure 12.1: A typical user privilege hierarchy

In line with the cyber kill chain methodology, the actions taken to achieve the objective include escalation of privilege to maintain persistence to the target environment.

The following are the types of user accounts that are found in any target system:

• Normal user: Typical access through a backdoor run at the level of the user who executes the backdoor. These are the normal users of the system (Windows or Unix) and are either local users or domain users with limited system access to perform only tasks that are allowed for them.
• Local administrator: Local administrators...