Linux Privilege Escalation
You have a shell as a nobody. Here is the checklist that turns it into root.
What you will learn
- -Run a first-five-minutes enumeration checklist after a foothold
- -Identify SUID, sudo, cron, and capability misconfigurations
- -Know when a kernel exploit is the last resort
You landed a as www-data. Useful, but limited. is
the climb from that low-privilege user to root. On Linux it is rarely a single
magic . It is : look everywhere the sysadmin left a gap, then
walk through it. This lesson is the checklist and the four gaps that pay off most.
The first-five-minutes sweep
Before anything clever, gather context. Who are you, what can you reach, what is unusual.
$id; whoami; sudo -l$find / -perm -4000 -type f 2>/dev/null$getcap -r / 2>/dev/null$cat /etc/crontab; ls -la /etc/cron.*$uname -a; cat /etc/os-releaseGap 1: SUID binaries
A SUID binary runs with its owner's privileges, not yours. A SUID- binary
that can be coaxed into running a shell or reading a file gives you root's power.
The permission string shows an s where the owner execute bit would be:
chmod 755 file to set these bits.If find turns up something like /usr/bin/find or /bin/cp with SUID set,
check GTFOBins, the reference that lists exactly how to abuse a given binary.
For example, a SUID find can spawn a root shell directly:
$find . -exec /bin/sh -p \\; -quitGap 2: sudo rules
sudo -l lists what your user may run as another user, sometimes without a
. A single overly generous rule is often the whole box. If you may run an
editor, a scripting language, or a file reader as root, you are effectively root.
sudo vim -c ':!/bin/sh' drops a root shell from an allowed vim. Again,
GTFOBins has the exact escape for each command.
Gap 3: cron jobs
Scheduled tasks that run as root are a goldmine when they touch something you can
write. If a root cron job runs /opt/backup.sh every minute and that script is
world-writable, you append your own command and wait for the clock:
$ls -la /opt/backup.sh$echo 'cp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash' >> /opt/backup.shGap 4: capabilities
Linux capabilities slice root's power into pieces, so a binary can have just
one. That sounds safer, but the wrong one is still root. cap_setuid on a
scripting language lets it set its UID to 0. getcap -r / finds them, and
GTFOBins tells you how to cash each one in.
When enumeration finds nothing, an old kernel (from uname -a) may have a public
local-root exploit like DirtyPipe or DirtyCow. Try these last: they can panic the
box, they are noisy, and a misconfiguration is almost always cleaner and safer to
exploit than a kernel bug.
linpeas.sh automates this entire sweep and color-codes the findings. Run it,
but understand every line it flags. The tool finds the gap. You still have to
know why it is a gap and how to walk through it.
You get a shell as a low-privilege user. Which is the sound first move?
Which find command lists every SUID file on a target while hiding permission-denied noise?
-perm -4000 matches the SUID bit, -type f limits to files, and 2>/dev/null discards the flood of permission-denied errors so the real results stand out.