Exploitation & Privilege Escalation Concepts

Three words get used loosely and mean distinct things. Getting them straight is the foundation of the whole topic.

• A vulnerability is a flaw or weakness in a system — a coding mistake, a design oversight, a misconfiguration — that could be abused to violate the system's security. It is a latent condition, not an event.
• An exploit is the technique or code that actually takes advantage of a specific vulnerability to make the system misbehave.
• A payload is what the exploit delivers — the code that runs once access is gained, defining what the attacker actually accomplishes.

By analogy: an unlocked window is the vulnerability, climbing through it is the exploit, and whatever the burglar does inside is the payload. A zero-day is a vulnerability for which no patch yet exists — "day zero" of the defender's awareness — making it especially dangerous.

A large share of the most severe exploits over the past thirty years trace to a single root cause: memory-safety errors in low-level languages like C and C++, which trust the programmer to manage memory correctly.

The archetype is the buffer overflow. A program reserves a fixed-size region of memory (a buffer) for some data; if it writes more data than the region can hold without checking, the excess spills into adjacent memory. In the worst case, that adjacent memory holds control information — like the address the program will jump to next — and an attacker who controls the overflowing data can redirect execution to code of their choosing. Related classes include use-after-free (using memory that has already been released) and integer overflows that lead to undersized allocations.

The reason this matters for defenders is strategic, not just technical: study after study from major vendors — Microsoft and Google among them — has found that roughly 70% of their serious vulnerabilities are memory-safety issues. That statistic is the single strongest argument for memory-safe languages such as Rust, Go, Java, and C#, which prevent these bugs by construction rather than by hoping every programmer is perfect.

Because eliminating every memory bug is impossible, defenders deployed a layered set of mitigations that do not fix vulnerabilities but make them dramatically harder and less reliable to exploit. They work by attacking the assumptions an exploit depends on.

Initial access rarely lands an attacker where they want to be. A phishing click might yield a foothold as an ordinary user with limited rights. Privilege escalation is the process of turning that limited access into greater control. It comes in two directions:

• Vertical (privilege) escalation — gaining higher-level rights than you were granted, such as a standard user becoming an administrator, root, or SYSTEM. This is the classic goal.
• Horizontal escalation — accessing the resources of another user at the same privilege level, like reading a peer's files or hijacking their session.

Vertical escalation typically abuses a local vulnerability, a misconfiguration (an overly permissive file or service), or stolen credentials. On the defensive side, the counter is the principle of least privilege: give every account, process, and service only the rights it strictly needs, so a compromised foothold yields as little as possible.

Having escalated on one machine, an attacker seldom stops there. Lateral movement is the spread through a network from the initial foothold toward the real objective — often using stolen credentials, trust relationships between systems, or reused local passwords to pivot from host to host. This is where a contained incident becomes an enterprise-wide breach, and where techniques like credential theft and pass-the-hash live in the MITRE ATT&CK matrix.

Two conceptual defenses dominate here. Sandboxing confines a process to a restricted environment so that even if code within it is compromised, it cannot reach the rest of the system — this is why modern browsers render each site in a locked-down sandbox and why containers isolate workloads. Network segmentation and its modern successor, zero trust, remove the flat internal network attackers rely on: every access is authenticated and authorized, so compromising one machine does not grant free rein over the rest.

Assume breach. Design so that the compromise of any single component is survivable, contained, and loud — not silent and total.