Linux Privilege Escalation

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

• Mark Linux Privilege Escalation Enumeration Tools as done
  Guide 17 min read

  Linux Privilege Escalation Enumeration Tools

  Focus on #LinPEAS (recommended) #pspy (process snooping for cron and timers) #SUID3NUM (SUID-focused) #linux-exploit-suggester (kernel CVE matching) #lse.sh (Linux Smart Enumeration) #BeRoot #LinEnum (legacy) #unix-privesc-check (minimalist) #checksec (binary/kernel hardening)
• Mark Linux Local System Enumeration as done
  Guide 4 min read

  Linux Local System Enumeration

  Focus on #Linux OS and Kernel Enumeration #Architecture #Installed Packages #Available Binaries and Tools #Container and Virtualization Detection #SELinux and AppArmor #Writable Directories
• Mark Linux Local User and Group Enumeration as done
  Guide 3 min read

  Linux Local User and Group Enumeration

  Focus on #Current User Context #All Local Users #All Local Groups #Sudo Group Members #Currently Logged-In Users #Password and Shadow Files #Service Accounts
• Mark Running Processes and Service Inspection on Linux as done
  Guide 3 min read

  Running Processes and Service Inspection on Linux

  Focus on #Full Linux Process Enumeration #Process Arguments: Credential Exposure #Watching Processes Over Time #Systemd Services #Systemd Timers #Service Binary Permissions #Open Files and Network Connections Per Process
• Mark Cron Jobs and Scheduled Tasks Enumeration on Linux as done
  Guide 4 min read

  Cron Jobs and Scheduled Tasks Enumeration on Linux

  Focus on #System-Wide Crontab Enumeration on Linux #Per-User Crontabs #Checking Script Permissions #Wildcard Usage in Cron Commands #Systemd Timers #at Jobs #Monitoring for Cron Execution
• Mark Locally Listening Services and Internal Ports on Linux as done
  Guide 3 min read

  Locally Listening Services and Internal Ports on Linux

  Focus on #Listing All Listening Ports #Reading Process Names Without Root #Common Localhost-Only Services #Accessing Localhost Services #Unix Domain Sockets
• Mark Mounted Filesystems and Storage Enumeration on Linux as done
  Guide 3 min read

  Mounted Filesystems and Storage Enumeration on Linux

  Focus on #Enumerating Currently Mounted Linux Filesystems #fstab: Persistent Mount Configuration #Block Devices and Unmounted Partitions #Disk Group and Raw Device Access #World-Readable Sensitive Directories
• Mark Sudo Misconfiguration Privilege Escalation as done
  Guide 6 min read

  Sudo Misconfiguration Privilege Escalation

  Focus on #CVE-2021-3156: Baron Samedit (Heap Overflow) #CVE-2019-14287: UID -1 Bypass #GTFOBins: Allowed Binary Abuse #Wildcard Abuse in Sudo Rules #Editable Script Execution #SETENV and LD_PRELOAD Abuse #sudoedit File Write Abuse #Sudo Token Reuse
• Mark SUID and SGID Binary Privilege Escalation as done
  Guide 10 min read

  SUID and SGID Binary Privilege Escalation

  Focus on #Find SUID Privilege Escalation Vectors on Linux #GTFOBins: Known Binaries #Auto-Check with SUID3NUM #Unknown Custom Binary: Analysis Workflow #PATH Hijacking via SUID Binary #Shared Object Injection #SGID Binaries and Group Access
• Mark Linux Capabilities Abuse for Privilege Escalation as done
  Guide 5 min read

  Linux Capabilities Abuse for Privilege Escalation

  Focus on #Enumerate Linux capabilities for privilege escalation #cap_setuid: Escalate to Root UID #cap_dac_read_search: Read Any File #cap_sys_ptrace: Process Injection #cap_net_raw: Network Sniffing #Capabilities vs SUID
• Mark Cron Job Privilege Escalation as done
  Guide 8 min read

  Cron Job Privilege Escalation

  Focus on #Cron Job Privilege Escalation via Writable Scripts #PATH Hijacking Inside Cron Scripts #Missing Binary Hijacking (Ghost Binaries) #Wildcard Injection #Symlink Race Conditions #run-parts from Writable Directories
• Mark Systemd Unit and Timer Privilege Escalation as done
  Guide 2 min read

  Systemd Unit and Timer Privilege Escalation

  Focus on #Systemd Service Privilege Escalation via Writable Unit Files #Writable Drop-in Directory #Writable ExecStart Script #Writable EnvironmentFile #Timers: Scheduled Execution
• Mark Weak File Permissions for Linux Privilege Escalation as done
  Guide 4 min read

  Weak File Permissions for Linux Privilege Escalation

  Focus on #Weak File Permissions Escalation via Root Scripts #/etc/rc.local #/etc/sudoers and /etc/sudoers.d/ #World-Writable Directories in Execution Paths #Writable Python/Perl/Ruby Libraries
• Mark /etc/passwd and /etc/shadow Privilege Escalation as done
  Guide 5 min read

  /etc/passwd and /etc/shadow Privilege Escalation

  Focus on #Writable /etc/passwd: User Injection #Readable /etc/shadow: Offline Cracking #Writable /etc/shadow: Direct Overwrite
• Mark Writable PATH Hijacking for Privilege Escalation as done
  Guide 4 min read

  Writable PATH Hijacking for Privilege Escalation

  Focus on #Identifying Path Hijacking Privilege Escalation Targets #Confirming the Resolution Order #Planting the Malicious Binary #Common Writable PATH Scenarios
• Mark Writable /etc/environment for Privilege Escalation as done
  Guide 4 min read

  Writable /etc/environment for Privilege Escalation

  Focus on #Writable /etc/environment Privilege Escalation via LD_PRELOAD #Technique 2: PATH Injection via /etc/environment #Technique 3: /etc/profile.d/ Script Injection #Technique 4: /etc/bash.bashrc Injection
• Mark LD_PRELOAD and Environment Variable Hijacking as done
  Guide 4 min read

  LD_PRELOAD and Environment Variable Hijacking

  Focus on #LD_PRELOAD via sudo env_keep #LD_LIBRARY_PATH via sudo env_keep #PYTHONPATH Injection #PERL5LIB Injection
• Mark Shared Library Hijacking for Privilege Escalation as done
  Guide 4 min read

  Shared Library Hijacking for Privilege Escalation

  Focus on #Library Search Order #Technique 1: RPATH / RUNPATH Writable Directory #Technique 2: /etc/ld.so.conf.d/ Injection #Technique 3: Missing Library (Phantom Library) #Technique 4: Writable Existing Library File
• Mark Python Library Hijacking for Privilege Escalation as done
  Guide 5 min read

  Python Library Hijacking for Privilege Escalation

  Focus on #Technique 1: Writable sys.path Directory #Technique 2: PYTHONPATH via sudo env_keep #Technique 3: Writable .pth File in site-packages #needrestart PYTHONPATH Hijack
• Mark Group-Based Privilege Escalation on Linux as done
  Guide 6 min read

  Group-Based Privilege Escalation on Linux

  Focus on #docker Group: Root via Socket #lxd / lxc Group: Host Filesystem via Container #shadow Group: Direct Hash Read #disk Group: Raw Device Access #staff Group: PATH Hijacking
• Mark Docker Container Escape and Host Privilege Escalation as done
  Guide 5 min read

  Docker Container Escape and Host Privilege Escalation

  Focus on #Technique 1: Docker Socket Mounted Inside Container #Technique 3: cgroup v1 release_agent #Technique 4: --pid=host Namespace Access #Technique 5: Writable Host Path Mounted into Container
• Mark D-Bus Misconfiguration Privilege Escalation as done
  Guide 2 min read

  D-Bus Misconfiguration Privilege Escalation

  Focus on #Finding D-Bus Privilege Escalation Policies #Technique 1: systemd via D-Bus (Misconfigured Policy) #Technique 2: Custom Service Method Injection #Technique 3: NetworkManager D-Bus Abuse
• Mark Logrotate Exploitation for Privilege Escalation as done
  Guide 4 min read

  Logrotate Exploitation for Privilege Escalation

  Focus on #Technique 1: Writable Config File #Technique 2: logrotten Race Condition #Technique 3: Writable Log Directory + create Mode
• Mark Git Hook Abuse for Linux Privilege Escalation as done
  Guide 3 min read

  Git Hook Abuse for Linux Privilege Escalation

  Focus on #Planting a Git Hook for Privilege Escalation #core.hooksPath Injection #Finding Deployments That Use git as Root
• Mark Unmounted Filesystem Privilege Escalation as done
  Guide 4 min read

  Unmounted Filesystem Privilege Escalation

  Focus on #Mount Without Root: User-Mountable Entries #Loop-Mounted Disk Images #LVM Volumes
• Mark Sudo Token Reuse – Hijacking Active Sudo Sessions as done
  Guide 4 min read

  Sudo Token Reuse – Hijacking Active Sudo Sessions

  Focus on #Technique 1: TTY Injection via /proc/[pid]/fd #Technique 2: nsenter + /proc/[pid]/fd/0 #Technique 3: screen Session Hijacking #Technique 4: tmux Session Hijacking
• Mark Credential Hunting for Linux Privilege Escalation as done
  Guide 5 min read

  Credential Hunting for Linux Privilege Escalation

  Focus on #Shell History Files #Config Files #Environment Variables #SSH Private Keys #Database Credentials #System and Application Logs #Password Reuse #Automated Linux Credential Hunting
• Mark Credential hunting in files as done
  Guide 3 min read

  Credential hunting in files

  Focus on #High-yield paths #Find likely secret files by name #Grep for secrets with a tight pattern set #Git and deployment artifacts
• Mark SSH keys and agent harvesting as done
  Guide 3 min read

  SSH keys and agent harvesting

  Focus on #User SSH material #Find private keys without guessing names #SSH agent and forwarded agent reuse
• Mark Shell history credential hunting as done
  Guide 2 min read

  Shell history credential hunting

  Focus on #Common history files #Grep histories for secrets and endpoints #Other user artifacts that routinely contain creds
• Mark Browser saved passwords as done
  Guide 4 min read

  Browser saved passwords

  Focus on #Locate browser profiles fast #HackBrowserData (Most modern browsers) #firefox_decrypt (Firefox) #LaZagne (Chromium)
• Mark Process secret hunting as done
  Guide 2 min read

  Process secret hunting

  Focus on #Pull a single process args and environment #Hunt for likely secret flags across all processes #systemd ExecStart and environment (when readable)
• Mark Linux Kernel Local Privilege Escalation as done
  Guide 6 min read

  Linux Kernel Local Privilege Escalation

  Focus on #Hardening Checks: Exploitability Gates #Automated Enumeration #CVE-2022-0847: Dirty Pipe #CVE-2023-0386: OverlayFS SUID Privilege Escalation #CVE-2021-4034: PwnKit (Polkit pkexec) #Netfilter / nftables Exploits
• Mark Dirty Pipe (CVE-2022-0847) – Linux Kernel Privilege Escalation as done
  Guide 4 min read

  Dirty Pipe (CVE-2022-0847) – Linux Kernel Privilege Escalation

  Focus on #Affected Versions #Exploit 1: Overwrite /etc/passwd (Recommended) #Exploit 2: Overwrite SUID Binary #When the Exploit Fails
• Mark Dirty COW (CVE-2016-5195) – Legacy Kernel Privilege Escalation as done
  Guide 4 min read

  Dirty COW (CVE-2016-5195) – Legacy Kernel Privilege Escalation

  Focus on #Exploit 1: /etc/passwd Overwrite (dirtycow-mem) #Exploit 2: SUID Binary Patching (cowroot) #Compile on Target Without gcc #Stability Notes
• Mark Polkit Local Privilege Escalation – PwnKit and CVE-2021-3560 as done
  Guide 5 min read

  Polkit Local Privilege Escalation – PwnKit and CVE-2021-3560

  Focus on #CVE-2021-4034: PwnKit #CVE-2021-3560: D-Bus Race Condition #Permissive Policy Files #systemd-run Bypass (Misconfigured Environments)

Practice

Apply the module hands-on.