# Privilege Escalation

> Linux privesc guides covering SUID, sudo, cron, kernel CVEs, and more

- **URL:** https://hackindex.io/platforms/linux/privilege-escalation
- **Platform:** [Linux](https://hackindex.io/platforms/linux.md)
- **Tags:** root, suid, permissions
- **Published:** 2026-02-13
- **Updated:** 2026-05-05

Linux privilege escalation (often shortened to **privesc**) is the process of moving from a low-privileged user to a higher-privileged context, typically **root**, by abusing misconfigurations, weak permissions, overly-permissive policies, or vulnerabilities.

On most real systems, the fastest wins come from **userland mistakes** (sudo rules, writable scripts, unsafe services) rather than “magic exploits.” When misconfigs don’t exist, **kernel-level local privilege escalation (LPE)** can become the last option, usually riskier and noisier.

This section is a **practical map of the most common Linux privesc paths**, with dedicated subpages for each technique.

## Guides

- [Linux Capabilities Abuse for Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/capabilities-abuse.md): Explores exploiting misconfigured Linux capabilities (e.g., CAP_SETUID, CAP_NET_RAW) to escalate privileges without full SUID binaries.
- [Credential Hunting for Linux Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/credential-hunting.md): Techniques for locating stored credentials on Linux systems, including config files, history, environment variables, and memory to escalate privileges.
- [Cron Job Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/cron-job-privilege-escalation.md): Exploit misconfigured cron jobs running as root to escalate privileges via writable scripts, PATH hijacking, or wildcard injection on Linux systems.
- [D-Bus Misconfiguration Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/dbus-privilege-escalation.md): Exploit misconfigured D-Bus services on Linux to escalate privileges by abusing insecure policy rules, exposed interfaces, and unauthorized method calls.
- [Dirty COW (CVE-2016-5195) – Legacy Kernel Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/dirty-cow-cve-2016-5195.md): Race condition in Linux kernel's copy-on-write mechanism allows local attackers to gain root privileges by writing to read-only memory mappings.
- [Dirty Pipe (CVE-2022-0847) – Linux Kernel Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/dirty-pipe-cve-2022-0847.md): Exploits Linux kernel pipe buffer flaw (CVE-2022-0847) to overwrite read-only files and escalate privileges to root on kernels 5.8–5.16.11.
- [Docker Container Escape and Host Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/docker-container-escape.md): Techniques for escaping Docker containers via misconfigured runtimes, privileged flags, mounted sockets, and kernel exploits to gain host root access.
- [Git Hook Abuse for Linux Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/git-hook-abuse.md): Exploiting misconfigured Git hooks in Linux to execute arbitrary code with elevated privileges, targeting writable .git/hooks directories in privileged repositories.
- [Group-Based Privilege Escalation on Linux](https://hackindex.io/platforms/linux/privilege-escalation/group-based-privilege-escalation.md): Exploiting misconfigured Linux group memberships (docker, sudo, disk, lxd) to escalate privileges and gain root access.
- [Linux Kernel Local Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/kernel-local-privilege-escalation.md): Exploit misconfigured kernels, SUID binaries, and kernel vulnerabilities to escalate from low-privileged user to root on Linux systems.
- [LD_PRELOAD and Environment Variable Hijacking](https://hackindex.io/platforms/linux/privilege-escalation/ld-preload-environment-hijacking.md): Exploiting LD_PRELOAD and environment variables to inject malicious shared libraries, hijacking process execution to escalate privileges on Linux systems.
- [Logrotate Exploitation for Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/logrotate-exploitation.md): Exploits misconfigured logrotate to escalate privileges by abusing writable log paths or race conditions to execute arbitrary commands as root.
- [/etc/passwd and /etc/shadow Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/passwd-shadow-manipulation.md): Exploiting world-writable /etc/passwd or /etc/shadow misconfigurations to inject rogue users or crack hashed credentials for root access.
- [Polkit Local Privilege Escalation – PwnKit and CVE-2021-3560](https://hackindex.io/platforms/linux/privilege-escalation/polkit-local-auth-escalation.md): Exploiting Polkit vulnerabilities (PwnKit/CVE-2021-3560) to escalate privileges to root on Linux systems via SUID misuse and authentication bypass.
- [Linux Privilege Escalation Enumeration Tools](https://hackindex.io/platforms/linux/privilege-escalation/privilege-escalation-enumeration-tools.md): Covers automated enumeration tools for Linux privesc, including LinPEAS, LinEnum, and LSE to identify misconfigurations, SUID binaries, and escalation vectors.
- [Python Library Hijacking for Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/python-library-hijacking.md): Exploit misconfigured Python library paths and writable site-packages to hijack imports, inject malicious modules, and escalate privileges on Linux systems.
- [Shared Library Hijacking for Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/shared-library-hijacking.md): Exploit misconfigured shared library paths (LD_PRELOAD, rpath, ldconfig) on Linux to inject malicious .so files and escalate privileges via trusted process execution.
- [Sudo Misconfiguration Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/sudo-misconfiguration.md): Exploiting misconfigured sudo rules to escalate privileges on Linux systems, covering NOPASSWD entries, sudoers abuse, and GTFOBins techniques.
- [Sudo Token Reuse – Hijacking Active Sudo Sessions](https://hackindex.io/platforms/linux/privilege-escalation/sudo-token-reuse.md): Exploit cached sudo credentials by hijacking active TTY sessions via /proc, enabling privilege escalation without knowing the target user's password.
- [SUID and SGID Binary Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/suid-binary-privilege-escalation.md): Exploit misconfigured SUID/SGID binaries on Linux to escalate privileges by abusing executables that run with elevated owner or group permissions.
- [Systemd Unit and Timer Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/systemd-unit-and-timer-privilege-escalation.md): Exploit misconfigured systemd units and timers with weak permissions or writable paths to escalate privileges on Linux systems.
- [Unmounted Filesystem Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/unmounted-filesystem-privilege-escalation.md): Discover and mount hidden filesystems on Linux to uncover sensitive files, credentials, or SUID binaries that may enable local privilege escalation.
- [Weak File Permissions for Linux Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/weak-file-permissions.md): Exploiting misconfigured file permissions on Linux to escalate privileges via world-writable files, SUID binaries, and sensitive credential exposure.
- [Writable /etc/environment for Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/writable-etc-environment.md): Exploit writable /etc/environment to inject malicious env vars, hijacking privileged processes or sudo sessions to escalate privileges on Linux systems.
- [Writable PATH Hijacking for Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/writable-path-hijacking.md): Exploit misconfigured PATH variables by injecting malicious binaries into writable directories, hijacking privileged process execution to escalate local Linux permissions.