Enumerate systematically and rank every escalation path

applied · 85 min · Objective 4.3

Task

Build a Linux VM with several escalation paths of different quality, enumerate it systematically, and rank every path you find by reliability and by risk to uptime — because on a real host you choose the safest working path, not the first one you notice. Objective 4.3 is host-based attacks.

Steps

  1. On the lab you own, build a disposable Linux VM with three escalation paths: a safe one (a sudo misconfiguration), a risky one (a kernel exploit that may crash the host), and a subtle one (a writable service path). Snapshot it.
  2. Enumerate systematically and record every candidate in /tmp/paths.md, one per line with path:, reliability: and uptime-risk:.
  3. Rank them: the sudo path is reliable and safe, the kernel exploit is a last resort because it risks the host, the service path depends on timing.
  4. Escalate by the safest working path, not the most interesting one.
  5. Record what each path would have looked like to a defender, and which is loudest.
  6. Write the remediation for each, and revert the snapshot.

Verify

grep -cE "^path:" /tmp/paths.md
grep -cE "^uptime-risk:\s*(low|medium|high)" /tmp/paths.md
grep -ciE "sudo|safest|last resort|kernel.*risk" /tmp/paths.md

The first count must be at least 3 — you found multiple paths. The second must equal it: every path is ranked for uptime risk, which is what makes you choose the safe one on a client's production host. The third must be non-zero: you recorded the reasoning that a kernel exploit risking the host is a last resort, not a first move.

Notes

On a real engagement, the kernel exploit that crashes a production server is the finding that ends the engagement badly — so the ranking matters as much as the escalation. Escalation is mostly enumeration, and enumerating the host you already landed on is where most paths come from. Everything ran on a disposable VM you built, where crashing it costs a snapshot revert rather than a client's uptime.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.