Purple Edge
Get started

Privilege Escalation

advanced7 labsSubscription

Local privilege escalation on Linux and Windows: SUID/sudo/cron/capabilities, kernel and service flaws, Windows service/registry/token/UAC/DLL abuses, and automated enumeration.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    intermediate Hands-on lab Subscription

    Linux Privesc: SUID & sudo

    Turn a low-privileged shell into root by abusing SUID-root binaries via GTFOBins and exploiting misconfigured (NOPASSWD) sudo rules.

    35 min3 tasksPrivilege Escalation
  2. 2
    intermediate Hands-on lab Subscription

    Linux Privesc: cron, PATH & Capabilities

    Escalate to root three ways: hijack a writable root cron script, abuse a relative-PATH lookup in a privileged binary, and exploit a file with cap_setuid set.

    40 min3 tasksPrivilege Escalation
  3. 3
    advanced Subscription

    Linux Privesc: Kernel & Vulnerable Services

    When config is locked down, the code itself is the target: identify the kernel/service version and exploit a known flaw such as PwnKit (CVE-2021-4034) in Polkit's pkexec to get root.

    45 min3 tasksPrivilege Escalation
  4. 4
    intermediate Hands-on lab Subscription

    Windows Privesc: Services & Registry

    Escalate to SYSTEM on Windows by abusing a service whose binary or configuration a standard user can modify, and by weaponizing the AlwaysInstallElevated registry policy via a crafted MSI.

    40 min3 tasksPrivilege Escalation
  5. 5
    advanced Hands-on lab Subscription

    Windows Privesc: Tokens & UAC Bypass

    Abuse SeImpersonatePrivilege with the Potato family and PrintSpoofer to impersonate SYSTEM from a service account, then bypass UAC to elevate an admin-but-filtered token to high integrity.

    45 min3 tasksPrivilege Escalation
  6. 6
    advanced Hands-on lab Subscription

    Windows Privesc: Unquoted Paths & DLL Hijacking

    Exploit an unquoted service path with a writable intermediate directory, and abuse Windows DLL search order to drop a malicious DLL a privileged process loads, both leading to SYSTEM.

    45 min3 tasksPrivilege Escalation
  7. 7
    intermediate Hands-on lab Subscription

    Automated Enumeration (LinPEAS/WinPEAS/pspy)

    Run linpeas, winpeas, and pspy to triage privilege-escalation misconfigurations at speed, read their colour-coded output, and confirm one concrete escalation on each OS.

    35 min3 tasksPrivilege Escalation

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-06-15