> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/privesc.md). # Linux Privilege Escalation Linux privilege escalation notes covering sudo abuse, SUID binaries, cron jobs, Linux capabilities, PATH hijacking, kernel exploits, Docker escape, shared libraries, file permissions, NFS shares, serv Linux privilege escalation is the post-exploitation phase focused on moving from a low-privileged shell to root. The goal is to enumerate the local system, identify misconfigurations, abuse trusted execution paths, and turn weak permissions into a reliable root shell. This section covers practical Linux privilege escalation techniques used during penetration tests, CTF machines, lab environments, and local post-exploitation reviews. ## Privilege Escalation Workflow 1. Stabilize the shell and identify the current user, groups, hostname, kernel, and distribution. 2. Enumerate sudo rights, SUID binaries, capabilities, writable files, cron jobs, NFS exports, and local services. 3. Check group memberships such as docker, lxd, adm, and proxy for direct abuse paths. 4. Review PATH usage, shared library loading, Python imports, and writable execution contexts. 5. Validate kernel and package versions against known local privilege escalation CVEs. 6. Exploit the safest confirmed path and preserve the command sequence for reporting. ## Manual Enumeration Checklist Use this when you land on a Linux host and need a quick local map before choosing a privilege escalation path. ### Basic System Information ```bash uname -a cat /proc/version cat /etc/issue cat /etc/*-release lsb_release -a 2>/dev/null lscpu uptime ``` Hardware and filesystem context: ```bash cat /proc/cpuinfo free -h df -h ``` ### Environment Variables ```bash env set echo $PATH echo $HOME echo $USER ``` ### User Enumeration ```bash whoami id groups cat /etc/passwd cut -d: -f1 /etc/passwd grep -v '/nologin\|/false' /etc/passwd cat /etc/shadow 2>/dev/null cat /etc/group ``` User activity and history: ```bash last lastlog history cat ~/.bash_history 2>/dev/null ``` Sudo access: ```bash sudo -l cat /etc/sudoers 2>/dev/null ``` ### Network Enumeration Interfaces and routes: ```bash ifconfig -a 2>/dev/null ip a route 2>/dev/null ip route netstat -r 2>/dev/null arp -a 2>/dev/null ip neigh ``` Ports and connections: ```bash netstat -tuln 2>/dev/null ss -tuln netstat -tunap 2>/dev/null ss -tunap ``` DNS, hosts, and firewall: ```bash cat /etc/resolv.conf cat /etc/hosts iptables -L 2>/dev/null ``` ### Running Services ```bash service --status-all 2>/dev/null ps aux ps -ef pstree 2>/dev/null systemctl list-units --type=service 2>/dev/null service service_name status 2>/dev/null ``` Startup scripts: ```bash ls -la /etc/init.d/ 2>/dev/null ls -la /etc/rc*.d/ 2>/dev/null ``` ### File System Enumeration Sensitive config and hidden files: ```bash find / -name "*.conf" -o -name "*.config" 2>/dev/null find /home -name ".*" -type f 2>/dev/null ``` Passwords and sensitive artifacts: ```bash grep -r "password" /etc/ 2>/dev/null find /etc \( -name "*.conf" -o -name "*.config" \) -exec grep -l "password" {} \; 2>/dev/null cat /var/apache2/config.inc 2>/dev/null cat /var/lib/mysql/mysql/user.MYD 2>/dev/null cat /root/anaconda-ks.cfg 2>/dev/null cat ~/.bash_history 2>/dev/null cat ~/.mysql_history 2>/dev/null cat ~/.ssh/id_rsa 2>/dev/null cat ~/.ssh/id_rsa.pub 2>/dev/null ``` Finding interesting files: ```bash find / -name "*.txt" 2>/dev/null find / -name "*flag*" 2>/dev/null find / -name "*.txt" 2>/dev/null | grep -i flag grep -r "password" /home 2>/dev/null grep -r "flag" /home 2>/dev/null ``` Permissions: ```bash find / -type f -perm -o+w -not -path "/proc/*" 2>/dev/null find / -type f -perm -o+w -not -path "/proc/*" -not -path "/sys/*" 2>/dev/null find / -type d -perm -o+w -not -path "/proc/*" 2>/dev/null find / -type f -perm -u=s 2>/dev/null find / -type f -perm -g=s 2>/dev/null find / -perm -o+x -type f 2>/dev/null find / -type f -mtime -1 2>/dev/null ``` ### Scheduled Tasks ```bash cat /etc/crontab ls -la /etc/cron.d/ ls -la /etc/cron.daily/ ls -la /etc/cron.hourly/ ls -la /etc/cron.monthly/ ls -la /etc/cron.weekly/ crontab -l ``` ### Installed Software ```bash dpkg -l 2>/dev/null rpm -qa 2>/dev/null which command_name 2>/dev/null ``` Web server paths: ```bash cat /etc/apache2/apache2.conf 2>/dev/null cat /etc/httpd/conf/httpd.conf 2>/dev/null ls -la /var/www/ 2>/dev/null ls -la /srv/www/ 2>/dev/null ``` ### Fast Privilege Checks ```bash find / -perm -4000 -type f -exec ls -la {} \; 2>/dev/null ls -la /etc/passwd sudo -l echo $PATH | tr ':' '\n' | xargs -I {} ls -ld {} 2>/dev/null find /etc/cron* -type f -perm -o+w 2>/dev/null getcap -r / 2>/dev/null ``` ### Automated Enumeration Tools Use automated tools as helpers, not as proof. Keep their output and manually validate every finding before exploitation. ```bash curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh chmod +x LinEnum.sh ./LinEnum.sh wget https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh chmod +x lse.sh ./lse.sh -l1 wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh chmod +x linux-exploit-suggester.sh ./linux-exploit-suggester.sh ``` ### Step-By-Step Triage 1. Collect OS, kernel, distribution, CPU, storage, and uptime. 2. Confirm the current user, groups, shell, sudo access, and readable account files. 3. Enumerate SUID/SGID binaries, sudo rules, capabilities, cron jobs, PATH, NFS, and services. 4. Hunt for writable files, writable directories, credentials, keys, histories, and recent changes. 5. Run automated enumeration if allowed, then manually verify interesting findings. 6. Treat kernel exploits as a last resort after safer misconfiguration paths are ruled out. ## Linux Privilege Escalation Techniques

:terminal:

sudoers

Linux sudoers privilege escalation techniques, sudo -l abuse, allowed binaries, symlink abuse, and sudo version vulnerabilities.Sudoers

:id-card:

SUID Binaries

Linux SUID privilege escalation notes for vulnerable binaries, GTFOBins workflows, PwnKit, Nmap, PHP, screen, and custom SUID binaries.SUID

:clock:

Cron Jobs

Cron job privilege escalation notes for writable scripts, recurring root tasks, pspy64, Logstash jobs, and ImageMagick abuse.Cron Jobs

:linux:

Dirty Pipe

Linux privilege escalation technique notes with practical enumeration, exploitation examples, and validation.Dirty Pipe

:shield-halved:

Permissions

Linux permission misconfiguration notes for writable files, /etc/passwd abuse, Smart Enumeration, and least privilege checks.Permissions

Capabilities

Linux capabilities privilege escalation notes for cap_setuid, cap_dac_read_search, GTFOBins, Python, Perl, Vim, tac, and tar abuse.Capabilities

:route:

PATH Hijacking

PATH hijacking privilege escalation notes for relative binary calls, writable PATH precedence, and malicious command replacement.PATH Hijacking

:microchip:

Kernel Exploitation

Linux kernel exploit notes for local privilege escalation, Linux Exploit Suggester, Dirty COW, OverlayFS, and Ubuntu kernel CVEs.Kernel Exploitation

:network-wired:

NFS Shares

NFS share privilege escalation notes for no_root_squash, writable exports, attacker-mounted shares, and SUID payload validation.NFS Shares

:server:

Services and Systemd

Linux service privilege escalation notes for writable service files, service binaries, systemd units, and unsafe daemon configuration.Services and Systemd

:python:

Python Library Hijacking

Python library hijacking notes for abusing import resolution order and writable working directories during sudo-executed Python scripts.Python Library Hijacking

:users:

User Groups

Linux local group privilege escalation notes for docker, lxd, adm, proxy, logs, host rules, and container abuse.User Groups

:docker:

Docker Escape

Docker escape privilege escalation notes for default Docker Toolbox credentials, SUID manipulation, password reuse, and SSH key pivoting.Docker Escape

:link:

Shared Library Hijacking

Shared library hijacking notes for abusing missing or writable shared objects loaded by privileged Linux binaries.Shared Library Hijacking
## Recommended Tools * [LinPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS) for automated Linux privilege escalation enumeration. * [pspy64](/privesc/cron-jobs/pspy64-cron-enumeration-linux-privilege-escalation.md) for detecting cron jobs and processes without root. * [Linux Exploit Suggester](/privesc/kernel-exploitation/linux-exploit-suggester-linux-privilege-escalation.md) for kernel exploit candidates. * [GTFOBins](https://gtfobins.github.io/) for sudo, SUID, capabilities, and shell escape payloads. * [Smart Enumeration](/privesc/permissions/smart-enumeration-linux-privilege-escalation.md) for structured local misconfiguration checks. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/privesc.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.