linux-privilege-escalation

A Linux privilege-escalation playbook for use after obtaining a low-privilege shell, aimed at finding a path to root through common misconfigurations and dangerous binaries. It begins with an enumeration checklist to run immediately on landing: system and kernel info, sudo -l, SUID/SGID discovery with find, capability listing with getcap, cron and systemd-timer inspection, writable file and directory searches, listening services, and credential locations such as shell histories, config files, and private keys.

From there it maps concrete escalation techniques. SUID/SGID exploitation is grounded in the GTFOBins methodology with a quick-win table (bash -p, find -exec, vim, python, awk, less, cp, and others) and shared-library hijacking of SUID binaries that load .so files from writable paths. Linux capabilities are covered with a risk table (cap_setuid, cap_dac_override, cap_dac_read_search, cap_sys_admin, cap_sys_ptrace, and more) and exploitation commands. Cron and timer abuse includes writable cron scripts, PATH hijacking, tar wildcard injection, and using pspy to observe jobs without root.

Use it when you need to move from user to root on a Linux host during an authorized engagement. Additional vectors include NFS no_root_squash (planting a SUID binary from a root-controlled mount), writable /etc/passwd or /etc/shadow, LD_PRELOAD and LD_LIBRARY_PATH abuse when sudo preserves those environment variables, membership in the docker group (mounting the host filesystem to gain root), and Python/Perl/Ruby library hijacking via writable module search paths. Two advanced references are called out for deeper work: a top-30 SUID/capabilities exploitation guide and a kernel-version-to-exploit checklist covering DirtyPipe, DirtyCow, OverlayFS, and stability notes. Related skills for container escape, security-module bypass, lateral movement, and Kubernetes are cross-linked.