Linux Privilege Escalation
A structured reference for Linux privilege escalation techniques, organized for quick lookup during exams and engagements.
Enumeration
| Topic |
Description |
| Environment Enumeration |
System info, users, groups, network, defenses, file systems |
| Services & Internals |
Running processes, packages, cron jobs, sudo version, GTFOBins |
| Credential Hunting |
Config files, SSH keys, bash history, database creds, mail spools |
| Privileged Groups |
Docker, LXD/LXC, disk, adm, staff group escalations |
Exploitation Techniques
| Topic |
Description |
| Special Permissions (SUID/SGID) |
SUID/SGID enumeration, GTFOBins, shared object hijacking |
| Capabilities Abuse |
cap_setuid, cap_dac_override, capability enumeration |
| Sudo Rights Abuse |
GTFOBins sudo exploits, LD_PRELOAD, sudo CVEs, env_keep abuse |
| PATH Abuse |
Writable PATH dirs, SUID hijacking, LD_PRELOAD, cron PATH injection |
| Wildcard Abuse |
Tar checkpoint injection, rsync, chown, chmod wildcard exploitation |
| Escaping Restricted Shells |
rbash/rksh/rzsh breakouts via interpreters, editors, SSH, pagers |