# Linux Privilege Escalation

> Enumerate misconfigurations, abuse sudo and SUID, hijack services, hunt credentials, and exploit kernel vulnerabilities to escalate to root on Linux.

- **URL:** https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation
- **Certification:** [OSCP (PEN-200) Study Path](https://hackindex.io/learn/oscp-pen-200-study-path.md)
- **Estimated study hours:** 5
- **Published:** 2026-09-25
- **Updated:** 2026-09-25

Linux privilege escalation starts with thorough enumeration and ends with root. PEN-200 covers automated tools like LinPEAS and pspy, sudo and SUID misconfigurations, cron job abuse, service exploits, library hijacking, credential hunting, and kernel vulnerabilities. Most Linux boxes fall to a misconfiguration rather than a CVE, so methodical enumeration is the skill that matters most.

## Enumeration and Automated Tools

Map the system before attacking: OS version, kernel, users, groups, sudo rules, SUID binaries, running processes, cron jobs, listening services, and mounted filesystems. LinPEAS covers most of this in one run. pspy reveals hidden cron jobs and timed processes without root. Understanding what each tool checks lets you fill in the gaps manually when automated output is incomplete.

## Sudo, SUID, and Service Exploits

Sudo misconfigurations (GTFOBins abuse, wildcard injection, SETENV + LD_PRELOAD) and SUID binary abuse are the most common Linux escalation paths. Cron jobs with writable scripts, systemd units with weak permissions, PATH hijacking, and library hijacking (shared objects, Python modules, LD_PRELOAD) provide additional vectors. Group membership (docker, lxd, disk, shadow) can grant root-equivalent access. Container escapes apply when the target runs inside Docker or LXC with elevated privileges.

## Credential Hunting and Kernel Exploits

Credential hunting targets shell history, config files, SSH private keys, environment variables, browser saved passwords, and process arguments. Password reuse across accounts is common. When misconfigurations yield nothing, kernel exploits (Dirty Pipe, PwnKit, Dirty COW, OverlayFS) provide a fallback. Kernel exploitation carries crash risk, so enumerate and attempt misconfigurations first.

## Study material

- [Linux Privilege Escalation Enumeration Tools](https://hackindex.io/platforms/linux/privilege-escalation/privilege-escalation-enumeration-tools.md) (read, core)
- [Linux Local System Enumeration](https://hackindex.io/platforms/linux/enumeration/local-system-enumeration.md) (read, core)
- [Linux Local User and Group Enumeration](https://hackindex.io/platforms/linux/enumeration/local-user-and-group-enumeration.md) (read, core)
- [Running Processes and Service Inspection on Linux](https://hackindex.io/platforms/linux/enumeration/running-processes-and-services.md) (read, core)
- [Cron Jobs and Scheduled Tasks Enumeration on Linux](https://hackindex.io/platforms/linux/enumeration/cron-jobs-and-scheduled-tasks.md) (read, core)
- [Locally Listening Services and Internal Ports on Linux](https://hackindex.io/platforms/linux/enumeration/locally-listening-services.md) (read, core)
- [Mounted Filesystems and Storage Enumeration on Linux](https://hackindex.io/platforms/linux/enumeration/mounted-filesystems-and-storage.md) (read, core)
- [Sudo Misconfiguration Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/sudo-misconfiguration.md) (read, core)
- [SUID and SGID Binary Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/suid-binary-privilege-escalation.md) (read, core)
- [Linux Capabilities Abuse for Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/capabilities-abuse.md) (read, core)
- [Cron Job Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/cron-job-privilege-escalation.md) (read, core)
- [Systemd Unit and Timer Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/systemd-unit-and-timer-privilege-escalation.md) (read, core)
- [Weak File Permissions for Linux Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/weak-file-permissions.md) (read, core)
- [/etc/passwd and /etc/shadow Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/passwd-shadow-manipulation.md) (read, core)
- [Writable PATH Hijacking for Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/writable-path-hijacking.md) (read, core)
- [Writable /etc/environment for Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/writable-etc-environment.md) (read, core)
- [LD_PRELOAD and Environment Variable Hijacking](https://hackindex.io/platforms/linux/privilege-escalation/ld-preload-environment-hijacking.md) (read, core)
- [Shared Library Hijacking for Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/shared-library-hijacking.md) (read, core)
- [Python Library Hijacking for Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/python-library-hijacking.md) (read, core)
- [Group-Based Privilege Escalation on Linux](https://hackindex.io/platforms/linux/privilege-escalation/group-based-privilege-escalation.md) (read, core)
- [Docker Container Escape and Host Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/docker-container-escape.md) (read, core)
- [D-Bus Misconfiguration Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/dbus-privilege-escalation.md) (read, core)
- [Logrotate Exploitation for Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/logrotate-exploitation.md) (read, core)
- [Git Hook Abuse for Linux Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/git-hook-abuse.md) (read, core)
- [Unmounted Filesystem Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/unmounted-filesystem-privilege-escalation.md) (read, core)
- [Sudo Token Reuse – Hijacking Active Sudo Sessions](https://hackindex.io/platforms/linux/privilege-escalation/sudo-token-reuse.md) (read, core)
- [Credential Hunting for Linux Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/credential-hunting.md) (read, core)
- [Credential hunting in files](https://hackindex.io/platforms/linux/post-exploitation/credentials/credential-hunting-in-files.md) (read, core)
- [SSH keys and agent harvesting](https://hackindex.io/platforms/linux/post-exploitation/credentials/ssh-keys-and-agent-harvesting.md) (read, core)
- [Shell history credential hunting](https://hackindex.io/platforms/linux/post-exploitation/credentials/shell-history-credential-hunting.md) (read, core)
- [Browser saved passwords](https://hackindex.io/platforms/linux/post-exploitation/credentials/browser-saved-passwords.md) (read, core)
- [Process secret hunting](https://hackindex.io/platforms/linux/post-exploitation/credentials/pprocess-secret-hunting.md) (read, core)
- [Linux Kernel Local Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/kernel-local-privilege-escalation.md) (read, core)
- [Dirty Pipe (CVE-2022-0847) – Linux Kernel Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/dirty-pipe-cve-2022-0847.md) (read, core)
- [Dirty COW (CVE-2016-5195) – Legacy Kernel Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/dirty-cow-cve-2016-5195.md) (read, core)
- [Polkit Local Privilege Escalation – PwnKit and CVE-2021-3560](https://hackindex.io/platforms/linux/privilege-escalation/polkit-local-auth-escalation.md) (read, core)