privilege escalation

The definition takes one sentence. The interview is about the four ways privilege actually moves, and why most escalations are misconfigurations rather than exploits.

The username tells you almost nothing. The interviewer wants the list of privilege transitions reachable from that process, and which of them you would have closed in advance.

Check, then use: two system calls, and an attacker in between. The answer interviewers want replaces names with handles and checks with atomic operations, and can show it in code.

Programs rarely name the file they run or load; they search for it. Whoever can write earlier in the search order chooses the code. The answer covers both platforms and the one rule that fixes both.

Kernel exploits make headlines; misconfigured services, impersonation and stored credentials do the work. The scored answer groups escalation into classes and attaches a control and a detection to each.

sudo is a policy engine that runs as root and parses user input. Grant it carelessly and 'run this one command' becomes 'run anything'.

The kernel is the single shared authority on a machine. A bug there means any process can rewrite who it is.

Escalation rarely needs an admin permission, just a permission that leads to one. The scored answer names the common paths, finds them as a graph, and removes the edges that matter.

The group change is one event; the question is the chain behind it. The strong answer treats tier 0 as compromised until proven otherwise and works backwards from who made the change and with what credentials.