26.1 What Privilege Escalation Is
In short: Privilege escalation means gaining more rights than you were given.
Privilege escalation means gaining more rights than you were given.
| Type | Meaning | Example |
|---|---|---|
| Vertical | A low user becomes a higher one | A normal user becomes root/admin |
| Horizontal | Same level, but another user's access | One customer reads another customer's data |
An attacker's usual flow: get in as a limited user (a web shell, a cracked SSH login), then escalate to root, because root can read every file, install anything, and cover tracks. Defensively, if you enforce least privilege, even a foothold stays limited.
Ravindra Bagale's Tip
Students think "I got in, so the job is done." No! Most of the time the first shell belongs to a limited user. The real danger comes when it becomes root. That is exactly why least privilege (giving every user/service only the rights it needs) is such an important defence.
Ravindra Bagale's Tip – मराठी
Students समजतात "आत गेलो म्हणजे काम झाले". नाही! बहुतेक वेळा पहिला shell limited user चा असतो. खरा धोका तेव्हा येतो जेव्हा तो root बनतो. म्हणूनच least privilege (प्रत्येक user/service ला फक्त गरजेपुरते अधिकार) हा इतका महत्त्वाचा defence आहे.
Ravindra Bagale's Tip – हिंदी
Students समझते हैं "अंदर पहुँच गए मतलब काम हो गया". नहीं! ज़्यादातर पहला shell limited user का होता है. असली खतरा तब आता है जब वह root बन जाता है. इसीलिए least privilege (हर user/service को सिर्फ़ ज़रूरत भर के अधिकार) इतना ज़रूरी defence है.
Practice task
In your notes, write the difference between vertical and horizontal escalation with one real-world example of each (one from a Linux server, one from a web app like your reels app).