Privilege escalation is what happens after you're already in. You have a shell, but it's low-privilege — you're karen, not root. The question is what the system left unlocked that you can use to change that.
This lab covered seven distinct paths. Some are loud. Some are surgical. All of them worked.
The Vectors
Kernel Exploit — CVE-2015-1328
Ubuntu 14.04, kernel 3.13. Identified via LES, validated manually, transferred over HTTP, compiled on target, executed. Root.
Sudo Misconfiguration
sudo -l showed three passwordless entries. find was the cleanest breakout. One command to root.
SUID Abuse — base64
base64 with SUID set doesn't give you a shell. It gives you privileged file reads. That was enough to pull /etc/shadow, crack a hash, switch users, and read a root-only flag.
Capabilities — vim cap_setuid
getcap -r / surfaced a vim binary in Karen's home directory with cap_setuid+ep. GTFOBins had the rest.
Cron Job Hijack
Root-owned cron task pointing to a script Karen could write to. Replaced it with a reverse shell, started a listener, waited sixty seconds.
PATH Hijacking
Custom SUID binary calling thm without an absolute path. strings wasn't available so ltrace showed the behavior. Planted a fake thm in /tmp, prepended it to $PATH, ran the binary.
NFS no_root_squash
Three exported shares, all with no_root_squash. Built a SUID payload on the mounted share as root on Kali, executed it on the target. Two build failures first — wrong architecture, then glibc mismatch. Static x86-64 build fixed both.