To determine the extent to which Large Language Models (LLMs) perform privilege escalation in the post-exploitation phase of penetration testing, this study benchmarks five LLMs across a set of sandboxed, Linux-based TryHackMe labs that are mapped to techniques in the MITRE ATT&CK framework. Despite demonstrating strong general reasoning abilities, LLMs such as GPT-4o, DeepSeek-r1 and Gemini 2.0 have yet to demonstrate their performance in challenging cybersecurity tasks. Two execution frameworks were evaluated: a User-Navigated (human-in-the-loop) framework and a Fully Autonomous CLI Agent. Models were tested without human assistance or dynamic prompt modification. Six behavioural metrics, including success rate, false positives, redundant responses, and inference time, were used to assess reasoning performance, task convergence, and command reliability. When the labs required multi-stage escalation, models like DeepSeek-r1 and GPT-o3 delivered strong results. Repetitive outputs and failure loops were frequently removed by the user-navigated interaction structure, but fully autonomous agents frequently struggled to recover from initial errors. More recent LLMs performed noticeably better than those reported in previous studies despite drawbacks like stateless execution and a lack of reflection mechanisms, suggesting continuous model advancement. In addition to introducing new assessment metrics and a replicable benchmark, this study sheds light on the circumstances that determine the extent to which LLMs perform well or poorly in adversarial, system-level tasks.