NexurAI
Turning a low-priv shell into SYSTEM or root on the box you already landed on.
You've landed a low-privilege shell - now what? This path covers local and domain privilege escalation: turning a foothold into SYSTEM or root, or a normal user into Domain Admin. These are the flaws that follow initial access in nearly every real intrusion.
A memory-corruption bug in pkexec lets any local user escalate to root - present in default installs for over a decade.
polkit's pkexec (most Linux distributions) · 2022
The attacker runs pkexec with crafted argument/environment vectors that trigger out-of-bounds writes, gaining a root shell locally.
Hunt for pkexec executions with unusual environments, unexpected root shells spawned from pkexec, and auditd execve anomalies.
Patch polkit; as a stopgap, remove the SUID bit from pkexec.
The Print Spooler service lets an authenticated user load an arbitrary driver DLL as SYSTEM - remote code execution and privilege escalation.
Windows Print Spooler (RpcAddPrinterDriverEx) · 2021
The attacker points the spooler at a malicious 'printer driver' DLL on a share; spoolsv.exe loads it with SYSTEM privileges and runs the payload.
Watch spoolsv.exe spawning cmd/powershell or writing DLLs under C:\Windows\System32\spool\drivers; alert on new drivers added over RPC/SMB.
Patch, disable the Print Spooler where not needed, and restrict 'Point and Print' driver installation to administrators.
A flawed use of AES-CFB8 in Netlogon lets an attacker set a Domain Controller's machine password to empty - instant domain admin from the network.
Windows Netlogon (all supported Windows Server DCs) · 2020
The attacker sends ~256 Netlogon authentication attempts with a zeroed challenge until one succeeds, then resets the DC's computer account password and dumps domain credentials (DCSync).
Alert on Netlogon events 4742/5805, a burst of NetrServerAuthenticate calls, and machine-account password changes for a DC; EDR on lsass access and DCSync replication from non-DC hosts.
Apply the August 2020 patch and enforce 'secure RPC' (enforcement mode); monitor for accounts using vulnerable Netlogon.
Turn this knowledge into detections you can prove - write real rules scored on precision and recall.