# WTF are RCE and privilege escalation?

> Sarge says: RCE gets them through the wire. Privilege escalation gets them the keys to the base.

- Term: RCE and privilege escalation
- Also called: RCE; remote code execution; privilege escalation; privesc; root access; root privileges; full takeover; chained flaws; exploit chain; vulnerability chain
- Section: Under attack
- Web page: https://codemarine.ai/learn/rce-and-privilege-escalation/

## Short version

RCE lets an attacker run their code on your system. Privilege escalation gets them more power once inside.

## The briefing

- **RCE:** Remote code execution. An attacker can make a system run their code from somewhere else, often over a network. CVSS calls that kind of reach "remotely exploitable".
- **Classic cause:** Injection, where software treats outside input as code or commands.
- **Privilege escalation:** MITRE ATT&CK describes it as techniques adversaries use to gain higher-level permissions. They often get in with unprivileged access, then climb to local administrator or SYSTEM/root.
- **"Root":** The top account on Linux and macOS. SYSTEM is the Windows equivalent. Whoever holds it runs the machine.
- **"Full takeover":** Headline language, not a formal rating. Read the advisory to see what the attacker really gets.
- **"Chained flaws":** One bug sets up the next. The first gets a foothold and the second gets root. The MITRE CWE catalog labels real examples of these chains.
- **One number will not do:** Each flaw normally gets its own CVE and its own score, so one number will not show you the whole attack.

## In the Threat Brief this looks like

> Chained flaws in ExampleApp give an attacker root. Full takeover.

One bug set up the next. "Full takeover" is headline language, so read the advisory for what the attacker really gets.

Example only. The product, versions and names are made up.

## What to do

- Put an RCE on anything facing the internet at the top of the pile. If it needs no login, go faster.
- Do not wave off a "local" or low-privilege bug. It may be the second link in someone's chain.
- Run things with the least privilege they need. That limits what an attacker inherits when something breaks.

## Official sources

- [MITRE ATT&CK: Privilege Escalation (TA0004)](https://attack.mitre.org/tactics/TA0004/)
- [MITRE CWE-94: Improper Control of Generation of Code](https://cwe.mitre.org/data/definitions/94.html)
- [MITRE CWE-78: OS Command Injection](https://cwe.mitre.org/data/definitions/78.html)
- [OWASP: Code Injection](https://community.owasp.org/attacks/Code_Injection)
- [FIRST: CVSS v4.0 Specification](https://www.first.org/cvss/v4.0/specification-document)

## Related

- [CVSS](https://codemarine.ai/learn/cvss-severity.md)
- [Exploited in the wild](https://codemarine.ai/learn/exploited-in-the-wild.md)
- [Prompt injection](https://codemarine.ai/learn/prompt-injection.md)