A Repeatable Privesc Method

You popped a shell as www-data through a file upload bug. The box is not yours yet. www-data can read the web root and not much else, and the flag you want sits in /root. The gap between that shell and root is almost never a single clever trick. It is a checklist you run every time, in the same order, so you never miss the boring misconfiguration that hands you the box.

The first mistake people make is firing off a kernel exploit they found on Google before they even know what user they are. Slow down. Root is usually sitting behind a sudo rule or a writable script, and those cost you nothing to check. The exploit is the last thing you reach for, not the first.

Stabilize the shell first

A raw reverse shell has no job control, no tab completion, and dies if you press Ctrl-C. Fix that before you do real work. The Python PTY trick upgrades you to a usable terminal.

Know your context

Before you enumerate the system, enumerate yourself. Your user, your groups, and the OS version decide which whole categories of attack are even worth trying. A user in the docker or lxd group is basically root already. A user with a sudo entry might be one command away.

The order that works

Run these top to bottom. The list is sorted by effort and risk, cheapest and safest first. Stop the moment one pays off.

1. sudo -l rights, especially any NOPASSWD entry.
2. SUID and SGID binaries you can abuse (next lesson).
3. Cron jobs and scripts running as root that you can write to.
4. Writable files that root reads or executes, and weak file permissions.
5. Credentials in config files, history files, and environment variables.
6. Group memberships like docker, lxd, disk, adm.
7. Kernel and service version, checked against known exploits. Last.

Kernel exploits sit at the bottom for a reason. They can panic the box, and a crashed target on a real engagement means an angry client and lost access. Try every misconfiguration first.