| name | linux-privesc |
| description | Linux local privilege escalation methodology for authorized pentesting and CTF — turn a foothold shell (often a low-priv/service account like www-data) into root. Use after landing any non-root shell on a Linux host and you need to escalate: enumerate the local attack surface (sudo, SUID/SGID, capabilities, cron/timers, writable files, internal root services, credential reuse, kernel) and exploit the weakest link. Triggers on "privesc", "privilege escalation", "I have a shell now what", "escalate to root", "get root", "I'm www-data", "root this box", "linpeas", "sudo -l", "SUID", "GTFOBins". |
Linux local privilege escalation
You have a shell as a non-root user (commonly a service account — www-data,
mysql, an app user). Goal: become root. This skill is the enumerate → find the
one thing you can influence that runs as root → exploit loop, plus the footguns of
driving a half-broken foothold shell.
Scope guardrail
Authorized targets only (CTF box, lab, signed scope). Enumeration maps the local
attack surface; the actual escalation is an acting step — surface the vector and
the one-liner, and let the operator approve before you fire it (same ethos as the
rest of the repo). Reading root.txt proves the privesc; don't go beyond the
assessment objective.
First: stabilise the foothold
A webshell or raw reverse shell is not a TTY, and several escalation steps need one.
- Get a PTY before anything interactive (
su, sudo, ssh, editors):
python3 -c 'import pty; pty.spawn("/bin/bash")' (or script -qc /bin/bash /dev/null).
Without it, su fails with "must be run from a terminal" and sudo can't prompt.
- For a durable, shareable shell use the catch skill (
./roo catch) — drive it
with catch send/capture (run catch enter once to drop from pwncat's local
prompt into the remote shell).
- For clean, scriptable command output, driving the webshell (single commands via
curl --data-urlencode) is often tidier than scraping a tmux pane.
The enumeration ladder (run top-to-bottom; stop when one pays off)
- Who am I / quick wins.
id; sudo -n true 2>&1; cat /etc/passwd | grep sh$.
Note your groups — docker, lxd, disk, adm, sudo/wheel are each a known
root path on their own.
- sudo rights.
sudo -l (try with and without the foothold password). Any
allowed binary → check GTFOBins for the sudo escape. (ALL) NOPASSWD on
anything scriptable is usually instant root.
- SUID / SGID.
find / -perm -4000 -type f 2>/dev/null (and -2000). Diff
against a stock list — anything non-standard (custom binary, an interpreter,
a GTFOBins entry) is the lead. Stock set (mount, su, sudo, passwd, …) is noise.
- Capabilities.
getcap -r / 2>/dev/null. cap_setuid/cap_dac_read_search
on a binary you can run = root or arbitrary file read.
- Cron & timers.
cat /etc/crontab; ls -la /etc/cron.*; systemctl list-timers.
A root job that runs a script you can write (or a relative/PATH-resolved binary
you can hijack, or a wildcard you can inject) → root.
- Writable things root trusts. Writable
/etc/passwd, /etc/sudoers.d/*,
a systemd unit, a script invoked by a root service/cron, or a directory on root's
PATH. find / -writable -type f 2>/dev/null (filter to /etc,/opt,/usr/local).
- Internal services running as root.
ss -tlnp — a daemon bound to
127.0.0.1 is often more privileged and less guarded than the public ones
(admin panels, job/automation runners, DBs, message queues). If it runs as root
and exposes any way to run a command, render a template, or read/write a file,
that's your primitive — reach it locally (curl, or ./roo fwd to pull it to the
host) and look for a command/exec/file feature, an unauthenticated trigger, or an
argument/parameter injected into a shell string (loosely-validated inputs in a
config-driven action runner are a classic — break out of the surrounding quoting).
A root-owned web server (e.g. php -S 127.0.0.1:PORT -t <dir> running as root)
is the same primitive by another name: if any feature writes a file into its docroot
— even a "save"/upload that -sanitizes the name — drop an () and request it → RCE . A surviving is enough;
you don't need path traversal or command injection in the filename.
Tooling
- Manual first (the ladder above) — it's fast and quiet, and you learn the box.
- Stage an automated enumerator when manual stalls: drop
linpeas.sh onto the
target (host it from ./roo shell / ./roo catch upload, or fetch with the box's
own curl/wget) and run it. Downloads egress the public internet, not the VPN.
- GTFOBins (gtfobins.github.io) is the lookup for sudo/SUID/capability escapes.
Confirm & hand off
- Root proof: a SUID-root shell (
cp /bin/bash /tmp/rootbash; chmod 4755 /tmp/rootbash; /tmp/rootbash -p) or a root reverse shell; then id (euid=0) and cat /root/root.txt.
- Note any artifact you leave (a SUID bash, an added user, a modified file) so the
operator can clean up — on a lab box it's wiped at reset, but say so.
- Handoffs: hashcat (crack looted hashes), vuln-research (service/kernel CVEs),
catch (stabilise/keep the shell), memforensics (if you loot a memory image),
ad (if the box is domain-joined and you find domain creds).
