T1548: Abuse Elevation Control Mechanism

ComputerDefaults.exe is a Windows system utility for managing default applications for tasks like web browsing, emailing, and media playback.

Private Character Editor Windows Utility

Displays Windows Event Logs in a GUI window.

Microsoft iSCSI Initiator Control Panel tool

ODBC Data Source Administrator to manage User/System DSNs and ODBC drivers.

Used to reset Windows Store settings according to its manifest file

Find searches directory trees for files matching criteria. When configured with SUID permissions or sudo privileges without restrictions, its -exec flag can spawn root shells or execute arbitrary commands.

The GNU Bourne Again SHell (bash) is the default interactive shell on most Linux distributions. Abused for spawning interactive reverse TCP shells, executing encoded base64 commands, and privilege escalation.

AWK is a pattern scanning and processing language. Because AWK includes built-in system() functions and file operations, SUID awk or sudo privileges can be trivially abused to break out of restricted environments and spawn shells.

GNU tar is an archiving utility. Attackers abuse tar checkpoint execution options (--checkpoint-action=exec) to spawn an interactive shell or execute arbitrary commands when running with sudo or SUID permissions.

Vim is an interactive screen text editor. When configured with SUID permissions or privileged sudo rights without command restrictions, attackers escape into a root shell via the :! command.

Env runs a program in a modified environment. When configured with the SUID bit or unrestricted sudo access, running env to launch a shell preserves elevated root EUID permissions.

GNU Debugger (gdb) allows code inspection and execution. When granted SUID permissions or privileged sudo rights, gdb can execute arbitrary shell commands prior to loading programs.

GNU cp copies files. When configured with SUID permissions, attackers can overwrite system authentication files like /etc/passwd or copy binaries with elevated attributes.

Chmod alters file mode bits. SUID or sudo chmod is abused to turn standard shells into persistent SUID root binaries by adding the 4755 permission bit.

Chown changes file owner and group. SUID chown allows users to claim ownership of root-owned scripts or binaries and subsequently modify them.

Xargs builds and executes command lines from standard input. SUID xargs can execute an interactive root shell retaining elevated permissions.

Strace intercepts and records system calls. When run with SUID permissions, strace executes target binaries with preserved root privileges.

Timeout runs a command with a time limit. SUID timeout launches child programs with preserved elevated permissions.

Ionice sets or gets process I/O scheduling class and priority. SUID ionice launches child programs with elevated privileges.

Nice runs a program with modified scheduling priority. SUID nice spawns child programs retaining elevated EUID permissions.

Directory Service command-line utility (dscl) allows reading and writing Directory Service databases. Attackers use dscl for local user discovery, creating hidden administrator accounts, or extracting password hashes.