Privesc

privesc

privesc is the escalation-path command for HarrierOps Azure.

Use it when the question is no longer "who has access?" but "which visible path could turn this foothold into more control?"

What This Command Answers

• Which visible paths could broaden access quickly?
• Which path is most likely to matter first?
• Which path is closest to the current foothold or another already-interesting principal?

Run It

ho-azure privesc --output table

For saved structured output:

ho-azure privesc --output json

Example Table Output

severity	principal	path	asset	current
high	ho-azure-lab-sp	direct-role-abuse	-	yes
high	ua-app	public-identity-pivot	vm-web-01	no

When To Use It

• after Permissions shows strong principals
• when you want likely escalation stories instead of raw identity evidence
• when you need to prioritize the most actionable control-expansion paths first

What To Look For

• paths involving the current identity
• role-assignment or delegation rights that could expand control
• workload-linked identities that could become a cleaner pivot than a user account
• concise reasoning that explains why a path matters immediately

Why It Matters

Privilege inventory is useful, but escalation paths usually determine what changes next.

privesc compresses identity, role, and attachment context into a smaller set of high-signal paths so you can spend time validating the path most likely to change what you can do in the tenant.

What Should Stand Out First

• the path with the highest impact
• the path closest to the current foothold
• the path that is easiest to understand and validate
• whether the current identity or another already-interesting principal is involved

If You See..., Go Next To...

• If you see path_type=direct-role-abuse, go next to RBAC because it shows the exact role assignment evidence and scope behind that escalation path.
• If you see path_type=public-identity-pivot, go next to Managed-Identities and endpoints because one shows the workload-to-identity path and the other shows the ingress path into that workload.
• If the path depends on a service principal or application trust edge, go next to Role-Trusts because it explains who can modify the identity that makes the path possible.

What To Do Next

• Validate the underlying evidence in RBAC or Managed Identities.
• Use Role Trusts if the path appears to depend on indirect control.
• If the current identity is involved, treat that path as a priority before broader inventory work.

Loot Behavior

Loot for this command keeps priority=high rows when present because privesc ships a defended row-level priority field in JSON. That is semantic-high-band loot selection, not just a top-ranked cutoff.

Boundary

privesc should surface credible escalation paths backed by readable evidence.

It is not an exploit framework, a proof engine, or a claim that every imaginable attack chain is present.