Linux:
Privilege Escalation
Linux privesc guides covering SUID, sudo, cron, kernel CVEs, and more
Linux Capabilities Abuse for Privilege Escalation
Explores exploiting misconfigured Linux capabilities (e.g., CAP_SETUID, CAP_NET_RAW) to escalate privileges without full SUID binaries.
Credential Hunting for Linux Privilege Escalation
Techniques for locating stored credentials on Linux systems, including config files, history, environment variables, and memory to escalate privileges.
Cron Job Privilege Escalation
Exploit misconfigured cron jobs running as root to escalate privileges via writable scripts, PATH hijacking, or wildcard injection on Linux systems.
D-Bus Misconfiguration Privilege Escalation
Exploit misconfigured D-Bus services on Linux to escalate privileges by abusing insecure policy rules, exposed interfaces, and unauthorized method calls.
Dirty COW (CVE-2016-5195) – Legacy Kernel Privilege Escalation
Race condition in Linux kernel's copy-on-write mechanism allows local attackers to gain root privileges by writing to read-only memory mappings.
Dirty Pipe (CVE-2022-0847) – Linux Kernel Privilege Escalation
Exploits Linux kernel pipe buffer flaw (CVE-2022-0847) to overwrite read-only files and escalate privileges to root on kernels 5.8–5.16.11.
Docker Container Escape and Host Privilege Escalation
Techniques for escaping Docker containers via misconfigured runtimes, privileged flags, mounted sockets, and kernel exploits to gain host root access.
Git Hook Abuse for Linux Privilege Escalation
Exploiting misconfigured Git hooks in Linux to execute arbitrary code with elevated privileges, targeting writable .git/hooks directories in privileged repositories.
Group-Based Privilege Escalation on Linux
Exploiting misconfigured Linux group memberships (docker, sudo, disk, lxd) to escalate privileges and gain root access.
Linux Kernel Local Privilege Escalation
Exploit misconfigured kernels, SUID binaries, and kernel vulnerabilities to escalate from low-privileged user to root on Linux systems.
LD_PRELOAD and Environment Variable Hijacking
Exploiting LD_PRELOAD and environment variables to inject malicious shared libraries, hijacking process execution to escalate privileges on Linux systems.
Logrotate Exploitation for Privilege Escalation
Exploits misconfigured logrotate to escalate privileges by abusing writable log paths or race conditions to execute arbitrary commands as root.
/etc/passwd and /etc/shadow Privilege Escalation
Exploiting world-writable /etc/passwd or /etc/shadow misconfigurations to inject rogue users or crack hashed credentials for root access.
Polkit Local Privilege Escalation – PwnKit and CVE-2021-3560
Exploiting Polkit vulnerabilities (PwnKit/CVE-2021-3560) to escalate privileges to root on Linux systems via SUID misuse and authentication bypass.
Linux Privilege Escalation Enumeration Tools
Covers automated enumeration tools for Linux privesc, including LinPEAS, LinEnum, and LSE to identify misconfigurations, SUID binaries, and escalation vectors.
Python Library Hijacking for Privilege Escalation
Exploit misconfigured Python library paths and writable site-packages to hijack imports, inject malicious modules, and escalate privileges on Linux systems.
Sudo Misconfiguration Privilege Escalation
Exploiting misconfigured sudo rules to escalate privileges on Linux systems, covering NOPASSWD entries, sudoers abuse, and GTFOBins techniques.
Sudo Token Reuse – Hijacking Active Sudo Sessions
Exploit cached sudo credentials by hijacking active TTY sessions via /proc, enabling privilege escalation without knowing the target user's password.
SUID and SGID Binary Privilege Escalation
Exploit misconfigured SUID/SGID binaries on Linux to escalate privileges by abusing executables that run with elevated owner or group permissions.
Systemd Unit and Timer Privilege Escalation
Exploit misconfigured systemd units and timers with weak permissions or writable paths to escalate privileges on Linux systems.
Unmounted Filesystem Privilege Escalation
Discover and mount hidden filesystems on Linux to uncover sensitive files, credentials, or SUID binaries that may enable local privilege escalation.
Weak File Permissions for Linux Privilege Escalation
Exploiting misconfigured file permissions on Linux to escalate privileges via world-writable files, SUID binaries, and sensitive credential exposure.
Writable /etc/environment for Privilege Escalation
Exploit writable /etc/environment to inject malicious env vars, hijacking privileged processes or sudo sessions to escalate privileges on Linux systems.
Linux privilege escalation (often shortened to privesc) is the process of moving from a low-privileged user to a higher-privileged context—typically root—by abusing misconfigurations, weak permissions, overly-permissive policies, or vulnerabilities.
On most real systems, the fastest wins come from userland mistakes (sudo rules, writable scripts, unsafe services) rather than “magic exploits.” When misconfigs don’t exist, kernel-level local privilege escalation (LPE) can become the last option—usually riskier and noisier.
This section is a practical map of the most common Linux privesc paths, with dedicated subpages for each technique.