Privilege escalation concepts (labs only)

What privilege escalation means

When an attacker first gets in, they often have only limited rights — a normal user account, not administrator. Privilege escalation is any way of gaining higher rights from there. "Vertical" escalation means going from a low-privilege user to an admin/root. "Horizontal" means taking over another user's account at the same level. It is a key step in a real attack, so defenders must understand it to stop it.

Common causes (studied to fix them)

Notice the pattern: almost every cause is a mistake in configuration or an un-patched flaw. That is why the defence is mostly good hygiene — least privilege, correct permissions, patching, and removing secrets. You learn the causes so you can find and fix them, not so you can exploit someone.

Detection and defence

Detection: sudden use of admin commands by a normal account, new admin users appearing, changes to sensitive files, and alerts from endpoint protection. Defence: least privilege everywhere, patching, file-integrity monitoring, and logging of privilege use to a SIEM. A well-run system makes escalation hard and noisy.