Linux (GTFOBins) & Windows (LOLBAS) Privilege Escalation Finder (2026)

Horizontal privilege escalation (lateral movement on the same host) occurs when a standard user accesses resources or shells belonging to another standard user account (e.g., moving from www-data to developer). Vertical privilege escalation elevates permissions from a low-privileged account to full administrative control (root on Linux or NT AUTHORITY\SYSTEM / Administrator on Windows).

When standard GNU Bash starts and detects that its Effective UID (EUID, set to 0 by the SUID bit) does not match its Real UID (RUID, the calling user), it automatically resets EUID back to RUID as a security precaution. Passing '/bin/bash -p' (privileged mode) instructs Bash to preserve the SUID root effective user ID.

Linux Capabilities break root privileges into granular units. If an administrator grants 'cap_setuid+ep' to an interpreter like /usr/bin/python3 or /usr/bin/node (visible via 'getcap -r / 2>/dev/null'), that binary does not show an 's' in ls -l permissions, yet any user can call os.setuid(0) inside Python to spawn a root shell.

SeImpersonatePrivilege ('Impersonate a client after authentication') is granted by default to local service accounts (LOCAL SERVICE, NETWORK SERVICE, IIS APPPOOL). Tools like PrintSpoofer, RoguePotato, and GodPotato coerce the Windows SYSTEM account to authenticate to a local named pipe or DCOM listener and then impersonate that SYSTEM token to execute arbitrary commands.

If a Windows service binary path contains spaces and is not wrapped in quotation marks (for example, C:\Program Files\Custom App\Service Engine\srv.exe), the Service Control Manager attempts to execute C:\Program.exe, then C:\Program Files\Custom.exe, and then C:\Program Files\Custom App\Service.exe in order. If a standard user has write permissions to any of those parent directories, placing a payload at that path executes it as SYSTEM on service restart.