| name | privesc-linux-gtfobins |
| description | Linux privilege escalation via sudo rules, SUID/SGID binaries, and capabilities using GTFOBins techniques. Load with a Linux shell needing root, on `sudo -l` output, SUID/`getcap` findings, or "escalate on Linux". Signals: allowed sudo commands, SUID binaries, file capabilities, cron/PATH abuse.
|
| domain | privesc |
| type | technique |
| stability | learning |
| modes | ["pentest"] |
| severity | high |
| mitre | ["T1548.001","T1548.003"] |
| cwe | ["CWE-250","CWE-269"] |
| tools | ["gtfobins","linpeas","pspy"] |
| schema_version | 1 |
Linux privesc via sudo / SUID / capabilities (GTFOBins)
When it applies
You have a low-priv Linux shell. The fastest root is almost always a misconfig — a sudo rule, a
SUID binary, or a file capability that a known GTFOBins technique turns into a root shell or file
read/write. Do this before kernel exploits.
Why it works
Many normal binaries can spawn shells, read/write files, or run commands. When such a binary runs
with elevated rights — via sudo, the SUID bit, or a capability like cap_setuid — that power
becomes yours. GTFOBins catalogs the exact escape for each binary.
Method
- Enumerate the three vectors:
sudo -l — commands you can run as root/another user (even NOPASSWD).find / -perm -4000 -type f 2>/dev/null — SUID binaries.getcap -r / 2>/dev/null — file capabilities (cap_setuid, cap_dac_read_search).
- Look up the binary on GTFOBins for the matching function (sudo / suid / capabilities) and
run the exact escape (e.g.
sudo vim -c ':!/bin/sh', find . -exec /bin/sh \; if SUID, a
capability-based python -c 'import os;os.setuid(0);...').
- Also check: writable cron jobs / scripts run as root (
pspy to watch), writable PATH
entries a root process calls, LD_PRELOAD/env_keep in sudo, wildcard injection in root scripts.
- Stabilize the root shell and grab proof.
Gotchas
sudo -l NOPASSWD entries are the quickest win — check first.- A SUID binary that drops privileges is safe; GTFOBins tells you which escapes actually keep root.
linpeas finds all three fast, but understand the vector before firing — some escapes need exact args.
Verify success
A shell/command running as root (id shows uid=0), or root-only file read/write, via the misconfig.
References
GTFOBins; linpeas; "Linux privilege escalation" (HackTricks); pspy.
